eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Authorize remote modules with bearer proofs

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 19:16:30 +02:00
commit 7e39a19c18
8 changed files with 572 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -105,7 +105,8 @@ The bootstrap implementation provides:
- `geth auth grant <subject> <resource> <capability> [--grant-id <id>]`
- `geth auth revoke <resource> <grant-id>`
- local filesystem CAS commands: `add`, `get`, `fetch`, `hash`, `has`, `pin`,
`unpin`, `cleanup`, `providers`, `list`
`unpin`, `cleanup`, `providers`, `list`; remote fetch accepts
`--bearer-secret <secret>`
- local CAS tree objects describe file trees and are stored as CAS blobs
- local file-root commands: `geth cas root add/list/scan`
- local file conflict metadata commands:
@ -117,9 +118,11 @@ The bootstrap implementation provides:
`geth db sync <node-id> <name>`
- local SQLite-backed KV commands: `geth kv create/set/get`; `kv set` accepts
`--subject <principal>` to exercise local capability checks for non-local
callers; `geth kv sync <node-id> <name>` pulls authorized remote updates
callers; `geth kv sync <node-id> <name> [--bearer-secret <secret>]` pulls
authorized remote updates
- local JSON document commands: `geth document create/status/set/get`; `geth
document sync <node-id> <name>` pulls authorized remote JSON state
document sync <node-id> <name> [--bearer-secret <secret>]` pulls authorized
remote JSON state
- local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`; `geth pubsub
pub <topic> <message> --node <node-id>` publishes to an authorized peer;
`geth pubsub sub <topic> --node <node-id>` reads an authorized peer snapshot
@ -129,15 +132,15 @@ The bootstrap implementation provides:
- `geth ssh cert approve <request-id> --ca-key <path> [--sign] [--subject <principal>]`
- `geth ssh cert import <request-id> --cert <path> [--subject <principal>]`
- `geth ssh cert list [--subject <principal>]`
- `geth ssh cert sync <node-id>`
- `geth ssh cert sync <node-id> [--bearer-secret <secret>]`
- `geth ssh revocation add <kind> <target> [--subject <principal>]`
- `geth ssh revocation list [--subject <principal>]`
- `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec|openssh-krl] [--subject <principal>]`
- `geth ssh revocation import <path> [--format jsonl|openssh-krl-spec] [--subject <principal>]`
- `geth ssh revocation sync <node-id>`
- SSH proxy authorization probe: `geth ssh proxy <node-id>`
- `geth ssh revocation sync <node-id> [--bearer-secret <secret>]`
- SSH proxy authorization probe: `geth ssh proxy <node-id> [--bearer-secret <secret>]`
- pipe registry/connect commands: `geth pipe listen <name>` and
`geth pipe connect <name> [--node <node-id>]`
`geth pipe connect <name> [--node <node-id>] [--bearer-secret <secret>]`
`geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
include the Iroh EndpointID plus currently known relay/direct addresses.
@ -153,6 +156,9 @@ hash to the requested BLAKE3 CAS hash before storing them locally. Successful
fetches record the serving peer as a local provider, visible with
`geth cas providers <hash>`. This is the bootstrap transfer path; future work
will move provider/fetch behavior to `iroh-blobs`.
Remote resource commands that accept `--bearer-secret` can also authorize with a
resource-scoped bearer proof. This does not enroll the caller as a trusted node;
it only unlocks the requested capability on that one resource.
`geth ssh cert sync <node-id>` requires `ssh_cert.sync` on `resource:ssh:certs`
at the peer. `geth ssh revocation sync <node-id>` requires
`ssh_revocation.sync` on `resource:ssh:revocations`. Both commands merge