eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify stored keychain SSH signatures

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 18:58:07 +02:00
commit f7f14f6b27
10 changed files with 160 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/architecture.md
View file

@ -239,8 +239,9 @@ reports the reduced local view. `keychain init --signing-key <path>` writes the
canonical keychain signing payloads, runs `ssh-keygen -Y sign` with the explicit
`geth.keychain.v1@geth.local` namespace, and stores the resulting OpenSSH
signatures in local SQLite. `keychain status` reports the stored signature
count. Verification and rejection of unsigned replicated keychain operations are
still future work.
count and verifies stored signatures against their canonical payloads with
OpenSSH when possible. Rejection of unsigned or invalid replicated keychain
operations is still future work.
The authorization plane is `geth-auth`: resource-local signed operation logs,
grants, revocations, groups, and `auth explain`. Auth operations reduce into a