eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add canonical sigchain bundle format

Browse source
This commit is contained in:
Eric Wendland 2026-07-19 03:16:14 +02:00
commit decff4b995
14 changed files with 1515 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

25
README.md
View file

@ -650,23 +650,32 @@ operator-pinned chain ID, OpenSSH root public key, and namespace. Parent hashes
define order without a redundant sequence counter. Every record carries a
public authority transition for devices, keys, causal revocation, scoped
permissions, and anchor policy, plus optional profile commitments whose payloads
can be selectively disclosed. Geth already provides a verifier for independently
produced JSONL transport files:
can be selectively disclosed. Geth already provides a verifier for JSONL
interchange and canonical bundles:
```sh
geth keychain verify-sigchain \
--in ./geth.sshsigchain.v1.jsonl \
--in ./chain.sscb \
--chain-id <64-hex-character-chain-id> \
--root-key ~/.ssh/geth-root.pub
# Convert the human-friendly record interchange to the canonical snapshot.
geth keychain bundle-create --in ./chain.jsonl --out ./chain.sscb
# Extract records and available disclosures for inspection.
geth keychain bundle-extract --in ./chain.sscb --out ./chain.jsonl
```
The verifier reports active authority devices/keys, disclosed and incomplete
profiles, the head digest, and current attester/backend anchor thresholds.
SSHSIGCHAIN local
record storage, signing, publication, import, accepted-head persistence, and
profiles, the head digest, and current attester/backend anchor thresholds. It
auto-detects JSONL interchange or the canonical `.sscb` bundle. The bundle is
the deterministic on-disk/full-snapshot distribution format and can be hosted
unchanged at `/.well-known/sshsigchain/v1/<chain-id>/chain.sscb` by a static
HTTP server. HTTP and every other distribution backend remain untrusted inputs.
Local append workflows, accepted-head persistence, concrete fetchers, and
concrete anchor adapters remain follow-up work. Until they exist, do not
substitute an unpinned checkpoint or a local operation-log view for the
SSHSIGCHAIN trust tuple.
substitute an unpinned checkpoint, HTTP response, or local operation-log view
for the SSHSIGCHAIN trust tuple.
Signing is mediated by OpenSSH. `--signing-key` may point at a private key file,
a FIDO/YubiKey OpenSSH security-key stub, or a public key whose private half is