Add binary OpenSSH KRL export

crates/geth/tests/bootstrap.rs

@@ -1331,6 +1331,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
         geth_control::ControlRequest::SshRevocationExport {
             out: export_path.clone(),
             format: "jsonl".to_owned(),
+            ca_public: None,
         },
     )
     .expect("export revocations");
@@ -1346,6 +1347,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
         geth_control::ControlRequest::SshRevocationExport {
             out: krl_spec_path.clone(),
             format: "openssh-krl-spec".to_owned(),
+            ca_public: None,
         },
     )
     .expect("export revocation krl spec");
@@ -1368,3 +1370,76 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
             .contains("key: ssh:blake3:test")
     );
 }
+
+#[test]
+fn ssh_revocation_export_can_write_binary_openssh_krl() {
+    if Command::new("ssh-keygen").arg("-?").output().is_err() {
+        return;
+    }
+
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let key_path = home.path().join("revoked");
+    let status = Command::new("ssh-keygen")
+        .arg("-q")
+        .arg("-t")
+        .arg("ed25519")
+        .arg("-N")
+        .arg("")
+        .arg("-f")
+        .arg(&key_path)
+        .status()
+        .expect("generate ssh key");
+    assert!(status.success());
+    let public_key_path = key_path.with_extension("pub");
+    let public_key = std::fs::read_to_string(&public_key_path).expect("read public key");
+
+    geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SshRevocationAdd {
+            kind: "public-key".to_owned(),
+            target: public_key,
+            reason: Some("test binary krl".to_owned()),
+        },
+    )
+    .expect("add revocation");
+    let krl_path = home.path().join("revocations.krl");
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SshRevocationExport {
+            out: krl_path.clone(),
+            format: "openssh-krl".to_owned(),
+            ca_public: None,
+        },
+    )
+    .expect("export binary krl");
+    match response {
+        geth_control::ControlResponse::SshRevocationExported {
+            format,
+            count,
+            note,
+            ..
+        } => {
+            assert_eq!(format, "openssh-krl");
+            assert_eq!(count, 1);
+            assert!(note.contains("binary KRL"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+    assert!(krl_path.exists());
+
+    let query = Command::new("ssh-keygen")
+        .arg("-Q")
+        .arg("-f")
+        .arg(&krl_path)
+        .arg(&public_key_path)
+        .output()
+        .expect("query krl");
+    assert!(!query.status.success());
+    assert!(
+        String::from_utf8_lossy(&query.stdout)
+            .to_ascii_lowercase()
+            .contains("revoked")
+    );
+}