6fe756dc93
* Add support for ssh commit signing * Split out ssh verification to separate file * Show ssh key fingerprint on commit page * Update sshsig lib * Make sure we verify against correct namespace * Add ssh public key verification via ssh signatures When adding a public ssh key also validate that this user actually owns the key by signing a token with the private key. * Remove some gpg references and make verify key optional * Fix spaces indentation * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update templates/user/settings/keys_ssh.tmpl Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update models/ssh_key_commit_verification.go Co-authored-by: Gusted <williamzijl7@hotmail.com> * Reword ssh/gpg_key_success message * Change Badsignature to NoKeyFound * Add sign/verify tests * Fix upstream api changes to user_model User * Match exact on SSH signature * Fix code review remarks Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
82 lines
2.4 KiB
Markdown
Vendored
82 lines
2.4 KiB
Markdown
Vendored
# Armored ssh signatures in go
|
|
|
|
[](https://pkg.go.dev/github.com/42wim/sshsig#section-documentation)
|
|
|
|
Package sshsig implements signing/verifying armored SSH signatures.
|
|
You can use this package to sign data and verify signatures using your ssh private keys or your ssh agent.
|
|
It gives the same output as using `ssh-keygen`, eg when signing `ssh-keygen -Y sign -f keyfile -n namespace data`
|
|
|
|
This code is based upon work by <https://github.com/sigstore/rekor>
|
|
|
|
References: <https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig>
|
|
|
|
You can find some examples on how to use this library on: <https://pkg.go.dev/github.com/42wim/sshsig#pkg-examples>
|
|
|
|
## Examples
|
|
|
|
```golang
|
|
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"net"
|
|
"os"
|
|
|
|
"github.com/42wim/sshsig"
|
|
"golang.org/x/crypto/ssh/agent"
|
|
)
|
|
|
|
func ExampleSignWithAgent() {
|
|
// This example will panic when you don't have a ssh-agent running.
|
|
conn, err := net.Dial("unix", os.Getenv("SSH_AUTH_SOCK"))
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
ag := agent.NewClient(conn)
|
|
|
|
// This public key must match in your agent (use `ssh-add -L` to get the public key)
|
|
pubkey := []byte(`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAo3D7CGN01tTYY/dLKXEv8RxRyxa32c51X0uKMhnMab wim@localhost`)
|
|
//
|
|
data := []byte("hello world")
|
|
|
|
res, err := sshsig.SignWithAgent(pubkey, ag, bytes.NewBuffer(data), "file")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
fmt.Println(string(res))
|
|
}
|
|
|
|
func ExampleSign() {
|
|
privkey := []byte(`-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
|
QyNTUxOQAAACCOjP6i4Pm/pYAAmpAMNZ6xrbHl9RW8xdul6kzIWuKMMAAAAIhoQm34aEJt
|
|
+AAAAAtzc2gtZWQyNTUxOQAAACCOjP6i4Pm/pYAAmpAMNZ6xrbHl9RW8xdul6kzIWuKMMA
|
|
AAAEBfIl93TLj6qHeg37GnPuZ00h8OVv1mzlhy0rhuO4Y0do6M/qLg+b+lgACakAw1nrGt
|
|
seX1FbzF26XqTMha4owwAAAAAAECAwQF
|
|
-----END OPENSSH PRIVATE KEY-----`)
|
|
|
|
data := []byte("hello world")
|
|
|
|
res, err := sshsig.Sign(privkey, bytes.NewBuffer(data), "file")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
fmt.Println(string(res))
|
|
|
|
// Output:
|
|
// -----BEGIN SSH SIGNATURE-----
|
|
// U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgjoz+ouD5v6WAAJqQDDWesa2x5f
|
|
// UVvMXbpepMyFrijDAAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
|
|
// OQAAAEBeu9Z+vLxBORysiqEbTzJP0EZKG0/aE5HpTtvimjQS6mHZCAGFg+kimNatBE0Y1j
|
|
// gS4pfD73TlML1SyB5lb/YO
|
|
// -----END SSH SIGNATURE-----
|
|
}
|
|
|
|
func main() {
|
|
ExampleSign()
|
|
}
|
|
```
|