eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sync SSH metadata over Iroh

Browse source
This commit is contained in:
Eric Wendland 2026-05-18 17:24:10 +02:00
commit 9887b47a40
7 changed files with 686 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/architecture.md
View file

@ -80,8 +80,11 @@ SSH certificate flows use the same split. Nodes can request new OpenSSH
certificates or renewals through geth metadata. A machine with the CA key or
YubiKey can approve the request and run an explicit `ssh-keygen -s ...` command,
then import the resulting certificate for distribution. Certificate and key
revocations are stored as signed-list-ready records and will be replicated over
Iroh in later phases.
revocations are stored as signed-list-ready records. The bootstrap can pull
certificate-flow metadata over Iroh with `geth ssh cert sync <node-id>` when the
peer grants `ssh_cert.sync` on `resource:ssh:certs`, and revocation metadata with
`geth ssh revocation sync <node-id>` when the peer grants `ssh_revocation.sync`
on `resource:ssh:revocations`.
## Resource Model
@ -164,7 +167,8 @@ OpenSSH KRL; serial and key-ID KRL entries require a CA public key via
exports and OpenSSH KRL specification source files. Binary OpenSSH KRL files are
not enumerable through OpenSSH tooling, so geth treats binary import as
unsupported and asks for JSONL or the spec source. Revocation lists are not yet
replicated over Iroh.
full CRDT-replicated resources, but the daemon can already pull cert-flow and
revocation metadata from authorized peers over the protected Iroh control ALPN.
## Keychain, Auth, And Secrets

25
docs/roadmap.md
View file

@ -210,8 +210,12 @@ resource-scoped capability decisions.
revocations.
- `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification
text or as a binary OpenSSH KRL through `ssh-keygen`.
- `[ ]` Future completion requires auth checks for request, approve, import,
publish, and read capabilities.
- `[x]` Authorized peers can pull SSH cert-flow metadata with
`geth ssh cert sync <node-id>`.
- `[x]` Authorized peers can pull SSH revocation metadata with
`geth ssh revocation sync <node-id>`.
- `[ ]` Future completion requires auth checks for local request, approve,
import, publish, and read capabilities.
## Phase 3: CAS, KV, And Pubsub
@ -302,11 +306,20 @@ Goal: add authorized stream-oriented management workflows over Iroh.
admin shell.
- Knowing an EndpointID alone cannot reach sshd.
- `[ ]` SSH certificate and revocation distribution.
- `[~]` SSH certificate and revocation distribution.
Acceptance criteria:
- Issued cert records and revocation records replicate over Iroh.
- Consumers can list current certs/revocations from local state while offline.
- Conflicting or unsigned records are rejected or quarantined.
- `[x]` Cert request and imported certificate records can be pulled from an
imported peer over Iroh.
- `[x]` Revocation records can be pulled from an imported peer over Iroh.
- `[x]` Remote sync validates the caller's signed peer card against the
observed Iroh EndpointID before considering authorization.
- `[x]` Cert metadata sync requires `ssh_cert.sync` on `resource:ssh:certs`.
- `[x]` Revocation metadata sync requires `ssh_revocation.sync` on
`resource:ssh:revocations`.
- `[x]` Consumers can list current certs/revocations from local state while
offline after sync.
- `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
- `[ ]` Conflicting or unsigned records are rejected or quarantined.
- `[x]` OpenSSH KRL import/export.
Acceptance criteria: