Skip to content

Conversation

@EthanHeilman
Copy link

@EthanHeilman EthanHeilman commented Nov 8, 2024

Prior to this PR the key id of the SSH certificate was always chosen to be a random value. This PR changes this so that the key ID (a.k.a. the Certificate ID) can be specified by the user in the SigningArguments passed SignCert. This PR maintains backwards compatibility, if no key ID is specified to defaults to the old behavior.

By allowing the key ID to specified in the Signing Argument, the key ID can be associated with the user's identity as intended to OpenSSH.

"key id is a free-form text field that is filled in by the CA at the time of signing; the intention is that the contents of this field are used to identify the identity principal in log messages." -OpenSSH Certificate Spec

This PR:

  • Updates SigningArguments struct to take key id. The key id is then included in the signed certificate
  • A unit test tests to verify this new behavior, checks that backwards compatibility is maintained and improves coverage on the other fields of the SigningArguments
  • Fixes minor bug where we didn't catch an error if base64 decoding failed.
  • Updates the go version to 1.22.4 and adds a go.mod file. Before this PR the go version was old enough that it didn't have a go.mod file.

@EthanHeilman EthanHeilman force-pushed the master branch 2 times, most recently from e55c102 to 04ffbd8 Compare November 8, 2024 14:45
@EthanHeilman EthanHeilman marked this pull request as ready for review November 8, 2024 14:50
@EthanHeilman EthanHeilman marked this pull request as draft November 8, 2024 18:36
@EthanHeilman EthanHeilman marked this pull request as ready for review November 8, 2024 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant