feat: Remote SSH PRD: Phase 3 — SSH trust and authentication - #369
Merged
Conversation
3 tasks
Adds client SSH key registration/revocation, real OpenSSH user certificate signing (ssh-ed25519-cert-v01@openssh.com) backed by a server-side CA secret, CA trust installation on managed VMs (TrustedUserCAKeys), the direct existing-key authorized_keys alternative, and a real TCP-level SSH host-key scan that closes the Phase 2 gap where host-key fingerprints were plumbed but never populated. Reprovisioning now records an explicit host-key rotation (old/new fingerprint, generation, provider resource id). New Edge Function remote-ssh-trust handles key register/list/revoke, certificate issuance, and authorized_keys install/remove, all with server-side ownership/status checks. Migration 016 adds the algorithm column to remote_client_keys and a remote_endpoint_authorized_keys table.
Ziinc
force-pushed
the
claude/remote-ssh-prd-phase-3
branch
from
August 28, 2026 15:19
dddd041 to
b841412
Compare
Ziinc
changed the title
Contributor
|
🚀 Web preview: https://preview-369.treq-9zy.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #368 (Phase 2). Implements Phase 3 of
prds/remote-ssh.md("SSH trust and authentication").remote-ssh-trustEdge Function), public material only.ssh-ed25519-cert-v01@openssh.com) with the CA seed held only in server-side secrets, never returned or persisted.TrustedUserCAKeyssshd drop-in) via Fly Machines exec, invoked after provisioning/reprovisioning.authorized_keysinstall/remove.Known gaps
ssh-ed25519client keys are supported for certificate signing; RSA/ECDSA are rejected (400) rather than faked.KEX_ECDH_REPLYwithout completing the exchange — trust-on-first-observation, same trust model asssh-keyscan, not MITM-proof; documented inline.remote_bootstrap.rsfor Phase 4's native transport but aren't yet wired into the live Sprites create/replace path — the Deno Edge Function versions are what's actually invoked today.sshd/ssh-keygen(no credentials/binaries in this environment).Test plan
cargo build,cargo fmt --check,cargo clippy --lib,cargo test --lib(34/34)deno check/deno linton new/changed Edge Function filesauth.users/auth.uid()shims; constraints and new table verified with real insertssshdStacked PR: Phase 4 (native desktop SSH transport) branches from this one next.
Generated by Claude Code