pico

feat: access control using ssh certs rss

created pr with 84.1 on 2025-12-01T05:25:52Z · by c8ef7d19

added 84.2 on 2025-12-13T00:51:45Z · by c8ef7d19


                      1:  659964e ! 1:  af4cda9 feat: access control using ssh certs


                      -:  ------- > 2:  d9a74df chore: logging and cleanup

added 84.3 on 2025-12-13T02:02:13Z · by c8ef7d19


                      1:  af4cda9 < -:  ------- feat: access control using ssh certs


                      2:  d9a74df ! 1:  bb8ef88 feat: access control using ssh certs

cmds

checkout latest patchset:

ssh pr.pico.sh print 84 | git am -3

checkout any patchset in a patch request:

ssh pr.pico.sh print 84.[rev] | git am -3

add changes to patch request:

git format-patch main --stdout | ssh pr.pico.sh pr add 84

Patchset `84.2` on 2025-12-13T00:51:45Z · commit d9a74df

feat: access control using ssh certs

Eric Bower 2025-12-01T05:17:10Z

→ chore: logging and cleanup

Eric Bower 2025-12-13T00:48:22Z

chore: logging and cleanup

Eric Bower 2025-12-13T00:48:22Z

Semantic diff summary

0 added, 2 modified, 0 signature changed, 0 removed across 2 analyzed files

pkg/apps/pico/ssh.go

function_declaration StartSshServer modified

pkg/shared/ssh.go

function_declaration PubkeyAuthHandler modified

+2 -1 pkg/apps/pico/ssh.go #

......@@ -76,7 +76,8 @@ func StartSshServer() {
		promPort,
		"ssh_data/term_info_ed25519",
		func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
			perms, _ := sshAuth.PubkeyAuthHandler(conn, key)
			perms, err := sshAuth.PubkeyAuthHandler(conn, key)
			logger.Warn("pubkey auth handler", "err", err)
			if perms == nil {
				perms = &ssh.Permissions{
					Extensions: map[string]string{

+7 -7 pkg/shared/ssh.go #

......@@ -42,7 +42,7 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
	cert, ok := key.(*ssh.Certificate)
	if ok {
		if cert.CertType != ssh.UserCert {
			return nil, fmt.Errorf("ssh: cert has type %d", cert.CertType)
			return nil, fmt.Errorf("ssh-cert has type %d", cert.CertType)
		}

		found := false

......@@ -53,16 +53,16 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
			}
		}
		if !found {
			return nil, fmt.Errorf("ssh: principals not valid")
			return nil, fmt.Errorf("ssh-cert principals not valid")
		}

		clock := time.Now
		unixNow := clock().Unix()
		if after := int64(cert.ValidAfter); after < 0 || unixNow < int64(cert.ValidAfter) {
			return nil, fmt.Errorf("ssh: cert is not yet valid")
			return nil, fmt.Errorf("ssh-cert is not yet valid")
		}
		if before := int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) {
			return nil, fmt.Errorf("ssh: cert has expired")
			return nil, fmt.Errorf("ssh-cert has expired")
		}

		pubkey = utils.KeyForKeyText(cert.SignatureKey)

......@@ -82,9 +82,9 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
	}

	// TODO: fix since we don't always have access to public key record here
	if !user.PublicKey.IsValid() {
		return nil, fmt.Errorf("public key has been revoked")
	}
	// if !user.PublicKey.IsValid() {
	// 	return nil, fmt.Errorf("public key has been revoked")
	// }

	if user.Name == "" {
		log.Error("username is not set")

...	...		@@ -76,7 +76,8 @@ func StartSshServer() {
76	76		promPort,
77	77		"ssh_data/term_info_ed25519",
78	78		func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
79		-	perms, _ := sshAuth.PubkeyAuthHandler(conn, key)
	79	+	perms, err := sshAuth.PubkeyAuthHandler(conn, key)
	80	+	logger.Warn("pubkey auth handler", "err", err)
80	81		if perms == nil {
81	82		perms = &ssh.Permissions{
82	83		Extensions: map[string]string{

...	...		@@ -42,7 +42,7 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
42	42		cert, ok := key.(*ssh.Certificate)
43	43		if ok {
44	44		if cert.CertType != ssh.UserCert {
45		-	return nil, fmt.Errorf("ssh: cert has type %d", cert.CertType)
	45	+	return nil, fmt.Errorf("ssh-cert has type %d", cert.CertType)
46	46		}
47	47
48	48		found := false

...	...		@@ -53,16 +53,16 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
53	53		}
54	54		}
55	55		if !found {
56		-	return nil, fmt.Errorf("ssh: principals not valid")
	56	+	return nil, fmt.Errorf("ssh-cert principals not valid")
57	57		}
58	58
59	59		clock := time.Now
60	60		unixNow := clock().Unix()
61	61		if after := int64(cert.ValidAfter); after < 0 \|\| unixNow < int64(cert.ValidAfter) {
62		-	return nil, fmt.Errorf("ssh: cert is not yet valid")
	62	+	return nil, fmt.Errorf("ssh-cert is not yet valid")
63	63		}
64	64		if before := int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before \|\| before < 0) {
65		-	return nil, fmt.Errorf("ssh: cert has expired")
	65	+	return nil, fmt.Errorf("ssh-cert has expired")
66	66		}
67	67
68	68		pubkey = utils.KeyForKeyText(cert.SignatureKey)

...	...		@@ -82,9 +82,9 @@ func (r *SshAuthHandler) PubkeyAuthHandler(conn ssh.ConnMetadata, key ssh.Public
82	82		}
83	83
84	84		// TODO: fix since we don't always have access to public key record here
85		-	if !user.PublicKey.IsValid() {
86		-	return nil, fmt.Errorf("public key has been revoked")
87		-	}
	85	+	// if !user.PublicKey.IsValid() {
	86	+	// return nil, fmt.Errorf("public key has been revoked")
	87	+	// }
88	88
89	89		if user.Name == "" {
90	90		log.Error("username is not set")

pico

Patchset 84.2 on 2025-12-13T00:51:45Z · commit d9a74df

Patchset `84.2` on 2025-12-13T00:51:45Z · commit d9a74df