eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OpenSSH certificate signing path

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:56:47 +02:00
commit 91c65e367d
9 changed files with 160 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

5
AGENTS.md
View file

@ -177,7 +177,10 @@ Roadmap items should be actionable and checkable:
specification imports are supported; binary KRL import is unsupported because
OpenSSH KRL files are not enumerable through OpenSSH tooling. Tests cover
public-key and certificate binary KRL revocations when `ssh-keygen` is
available. Local SSH certificate and revocation commands accept optional
available. `geth ssh cert approve` emits the OpenSSH signing command by
default; `approve --sign` runs `ssh-keygen`, imports the resulting
certificate, and marks the request signed when local signing succeeds. Local
SSH certificate and revocation commands accept optional
`--subject` principals and enforce `ssh_cert.*` capabilities on
`resource:ssh:certs` plus `ssh_revocation.*` capabilities on
`resource:ssh:revocations` for non-owner subjects. Authorized peers can pull