eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce SSH workflow capabilities locally

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:44:13 +02:00
commit f7e85960f7
8 changed files with 328 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

14
AGENTS.md
View file

@ -173,11 +173,15 @@ Roadmap items should be actionable and checkable:
specification imports are supported; binary KRL import is unsupported because
OpenSSH KRL files are not enumerable through OpenSSH tooling. Tests cover
public-key and certificate binary KRL revocations when `ssh-keygen` is
available. Authorized peers can pull SSH certificate-flow metadata with
`ssh_cert.sync` on `resource:ssh:certs` and revocation metadata with
`ssh_revocation.sync` on `resource:ssh:revocations`. The daemon live-syncs
known peers every 30 seconds using per-peer cursors; this is pull-only
metadata sync, not yet a CRDT/resource-log replication model.
available. Local SSH certificate and revocation commands accept optional
`--subject` principals and enforce `ssh_cert.*` capabilities on
`resource:ssh:certs` plus `ssh_revocation.*` capabilities on
`resource:ssh:revocations` for non-owner subjects. Authorized peers can pull
SSH certificate-flow metadata with `ssh_cert.sync` on `resource:ssh:certs` and
revocation metadata with `ssh_revocation.sync` on
`resource:ssh:revocations`. The daemon live-syncs known peers every 30
seconds using per-peer cursors; this is pull-only metadata sync, not yet a
CRDT/resource-log replication model.
- cr-sqlite apply, iroh-docs, iroh-blobs provider/fetch, Automerge sync,
broader auth enforcement, and Keyhive/BeeKEM-style authorization are future
roadmap items unless implemented later.