eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OpenSSH certificate signing path

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:56:47 +02:00
commit 91c65e367d
9 changed files with 160 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

39
crates/geth-node/src/lib.rs
View file

@ -3117,6 +3117,7 @@ pub fn handle_request(
valid_for,
serial,
out,
sign,
subject,
} => {
ensure_subject_authorized(
@ -3152,6 +3153,38 @@ pub fn handle_request(
&valid_for,
serial,
)?;
let expected_certificate_path = expected_openssh_cert_path(&public_key_path);
let mut signed = false;
let mut certificate_id_value = None;
let mut note = "request approved; run the signing command on the CA/YubiKey machine, then import the resulting -cert.pub file".to_owned();
if sign {
geth_ssh_identity::ensure_ssh_keygen_available()?;
let output = std::process::Command::new(&signing_command[0])
.args(&signing_command[1..])
.output()?;
if !output.status.success() {
return Err(geth_ssh_identity::SshIdentityError::SshKeygenFailed(
String::from_utf8_lossy(&output.stderr).trim().to_owned(),
)
.into());
}
let certificate = std::fs::read_to_string(&expected_certificate_path)?;
let record = SshCertificateRecord {
id: certificate_id(&certificate),
request_id: request.id.clone(),
certificate_fingerprint: ssh_public_key_fingerprint(&certificate),
certificate,
imported_at: UnixMillis(geth_store::now_ms()),
};
store.insert_ssh_certificate(&stored_from_ssh_certificate(&record))?;
store.update_ssh_cert_request_status(
request.id.as_str(),
SshCertRequestStatus::Signed.as_str(),
)?;
signed = true;
certificate_id_value = Some(record.id);
note = "request approved, signed with ssh-keygen, and imported into local certificate metadata".to_owned();
}
let approval = SshCertApproval {
request_id: request.id,
approved_by_node: NodeId::new(node.node_id.clone()),
@ -3159,9 +3192,11 @@ pub fn handle_request(
key_id: request_id,
valid_for,
serial,
output_path: Some(expected_openssh_cert_path(&public_key_path)),
output_path: Some(expected_certificate_path),
signing_command,
note: "request approved; run the signing command on the CA/YubiKey machine, then import the resulting -cert.pub file".to_owned(),
signed,
certificate_id: certificate_id_value,
note,
};
Ok(ControlResponse::SshCertApproved { approval })
}