eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce SSH workflow capabilities locally

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:44:13 +02:00
commit f7e85960f7
8 changed files with 328 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/architecture.md
View file

@ -206,8 +206,13 @@ unsupported and asks for JSONL or the spec source. Revocation lists are not yet
full CRDT-replicated resources, but the daemon can already pull cert-flow and
revocation metadata from authorized peers over the protected Iroh control ALPN.
Manual sync commands and the background live-sync loop share the same capability
checks and cursor state. The live-sync loop first asks for authorized stream
watermarks and skips module pulls whose remote high-water value has not advanced.
checks and cursor state. Local SSH certificate and revocation metadata commands
also accept an optional subject principal for authorization testing: non-owner
subjects must hold `ssh_cert.*` capabilities on `resource:ssh:certs` or
`ssh_revocation.*` capabilities on `resource:ssh:revocations` before requests,
approval/import/read operations, or revocation publish/read/import operations
are accepted. The live-sync loop first asks for authorized stream watermarks and
skips module pulls whose remote high-water value has not advanced.
## Keychain, Auth, And Secrets

12
docs/roadmap.md
View file

@ -230,8 +230,16 @@ resource-scoped capability decisions.
manual command.
- `[x]` SSH metadata live-sync stores per-peer high-water cursors in
`module_state` and requests only records at or beyond the cursor.
- `[ ]` Future completion requires auth checks for local request, approve,
import, publish, and read capabilities.
- `[x]` Local SSH cert request/read/approve/import commands can enforce
`ssh_cert.request`, `ssh_cert.read`, `ssh_cert.approve`, and
`ssh_cert.import` for explicit non-owner `--subject` principals.
- `[x]` Local SSH revocation publish/read/import commands can enforce
`ssh_revocation.publish`, `ssh_revocation.read`, and
`ssh_revocation.import` for explicit non-owner `--subject` principals.
- `[x]` Tests cover denied and granted non-owner local SSH cert request and
revocation publish flows.
- `[ ]` Future completion requires all accepted SSH cert/revocation records
to be signed and reducible before replication.
## Phase 3: CAS, KV, And Pubsub