eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sync SSH metadata over Iroh

Browse source
This commit is contained in:
Eric Wendland 2026-05-18 17:24:10 +02:00
commit 9887b47a40
7 changed files with 686 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/roadmap.md
View file

@ -210,8 +210,12 @@ resource-scoped capability decisions.
revocations.
- `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification
text or as a binary OpenSSH KRL through `ssh-keygen`.
- `[ ]` Future completion requires auth checks for request, approve, import,
publish, and read capabilities.
- `[x]` Authorized peers can pull SSH cert-flow metadata with
`geth ssh cert sync <node-id>`.
- `[x]` Authorized peers can pull SSH revocation metadata with
`geth ssh revocation sync <node-id>`.
- `[ ]` Future completion requires auth checks for local request, approve,
import, publish, and read capabilities.
## Phase 3: CAS, KV, And Pubsub
@ -302,11 +306,20 @@ Goal: add authorized stream-oriented management workflows over Iroh.
admin shell.
- Knowing an EndpointID alone cannot reach sshd.
- `[ ]` SSH certificate and revocation distribution.
- `[~]` SSH certificate and revocation distribution.
Acceptance criteria:
- Issued cert records and revocation records replicate over Iroh.
- Consumers can list current certs/revocations from local state while offline.
- Conflicting or unsigned records are rejected or quarantined.
- `[x]` Cert request and imported certificate records can be pulled from an
imported peer over Iroh.
- `[x]` Revocation records can be pulled from an imported peer over Iroh.
- `[x]` Remote sync validates the caller's signed peer card against the
observed Iroh EndpointID before considering authorization.
- `[x]` Cert metadata sync requires `ssh_cert.sync` on `resource:ssh:certs`.
- `[x]` Revocation metadata sync requires `ssh_revocation.sync` on
`resource:ssh:revocations`.
- `[x]` Consumers can list current certs/revocations from local state while
offline after sync.
- `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
- `[ ]` Conflicting or unsigned records are rejected or quarantined.
- `[x]` OpenSSH KRL import/export.
Acceptance criteria: