eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OpenSSH certificate signing path

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:56:47 +02:00
commit 91c65e367d
9 changed files with 160 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/architecture.md
View file

@ -83,8 +83,11 @@ shell remain future work, and will not make SSH a geth transport backend.
SSH certificate flows use the same split. Nodes can request new OpenSSH
certificates or renewals through geth metadata. A machine with the CA key or
YubiKey can approve the request and run an explicit `ssh-keygen -s ...` command,
then import the resulting certificate for distribution. Certificate and key
revocations are stored as signed-list-ready records. The bootstrap can pull
or pass `--sign` to execute that command immediately and import the resulting
certificate into local metadata for distribution. This relies on the local
OpenSSH ecosystem, so hardware-backed keys remain mediated by `ssh-keygen` and
the host's agent/security-key flow. Certificate and key revocations are stored
as signed-list-ready records. The bootstrap can pull
certificate-flow metadata over Iroh with `geth ssh cert sync <node-id>` when the
peer grants `ssh_cert.sync` on `resource:ssh:certs`, and revocation metadata with
`geth ssh revocation sync <node-id>` when the peer grants `ssh_revocation.sync`
@ -204,9 +207,12 @@ forward bytes or connect to sshd/admin shell.
`geth-ssh-identity` defines SSH trust namespaces plus certificate request,
approval, certificate import, and revocation-list data models. The bootstrap
persists these flows locally and exports revocations as JSONL or OpenSSH KRL
specification text. It can also invoke `ssh-keygen -k` to produce a binary
OpenSSH KRL; serial and key-ID KRL entries require a CA public key via
`--ca-public`, matching OpenSSH behavior. It can import geth JSONL revocation
specification text. Certificate approval normally emits the exact
`ssh-keygen -s ...` command, and `approve --sign` can run that command, import
the resulting OpenSSH certificate, and mark the request signed. It can also
invoke `ssh-keygen -k` to produce a binary OpenSSH KRL; serial and key-ID KRL
entries require a CA public key via `--ca-public`, matching OpenSSH behavior.
It can import geth JSONL revocation
exports and OpenSSH KRL specification source files. Binary OpenSSH KRL files are
not enumerable through OpenSSH tooling, so geth treats binary import as
unsupported and asks for JSONL or the spec source. Revocation lists are not yet

4
docs/roadmap.md
View file

@ -218,6 +218,10 @@ resource-scoped capability decisions.
metadata.
- `[x]` Approval emits an explicit `ssh-keygen -s ...` command for
CA/YubiKey use.
- `[x]` `geth ssh cert approve --sign` can run `ssh-keygen`, import the
resulting OpenSSH certificate, and mark the request signed.
- `[x]` Tests cover signing with a generated local OpenSSH CA key when
`ssh-keygen` is available.
- `[x]` `geth ssh revocation add/list/export` persists and exports
revocations.
- `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification