mirror of
https://github.com/LamGC/quickly-conf-sshd.git
synced 2026-10-13 07:43:57 +00:00
feat: pin client GPG trust and publish signed Git/Gist key releases
This commit is contained in:
@@ -20,12 +20,13 @@ jobs:
|
||||
- run: npm ci
|
||||
- name: Install shell test interpreters
|
||||
run: |
|
||||
if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
|
||||
if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null || ! command -v gpg >/dev/null; then
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y busybox-static shellcheck
|
||||
sudo apt-get install -y busybox-static shellcheck gnupg
|
||||
fi
|
||||
busybox sh -c 'echo "BusyBox shell ready"'
|
||||
shellcheck --version
|
||||
gpg --version
|
||||
- name: Run unit, shell, and real-browser tests
|
||||
run: npm test
|
||||
env:
|
||||
|
||||
@@ -9,16 +9,40 @@ concurrency:
|
||||
group: production-key-release
|
||||
cancel-in-progress: false
|
||||
jobs:
|
||||
verify:
|
||||
# Repository Actions variables, not production environment variables: this
|
||||
# job deliberately has no production environment or production secrets.
|
||||
# The workflow/verifier themselves must be protected against modification.
|
||||
if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
persist-credentials: false
|
||||
- name: Check exact checkout and optional pinned GPG commit signature
|
||||
run: node scripts/verify-commit-signature.mjs
|
||||
env:
|
||||
REQUIRE_GPG_SIGNATURE: ${{ vars.REQUIRE_GPG_SIGNATURE }}
|
||||
GPG_ALLOWED_PRIMARY_FINGERPRINTS: ${{ vars.GPG_ALLOWED_PRIMARY_FINGERPRINTS }}
|
||||
GPG_PUBLIC_KEYS: ${{ vars.GPG_PUBLIC_KEYS }}
|
||||
deploy:
|
||||
needs: verify
|
||||
# Deliberate opt-in prevents accidental deployment when this PR is merged.
|
||||
# Configure production credentials and real server keys before enabling.
|
||||
# Both push and workflow_dispatch must pass the same verification job.
|
||||
if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
environment: production
|
||||
outputs:
|
||||
attempted: ${{ steps.deploy.outputs.attempted }}
|
||||
deployment_outcome: ${{ steps.deploy.outcome }}
|
||||
verification_outcome: ${{ steps.remote.outcome }}
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||
with:
|
||||
@@ -27,12 +51,13 @@ jobs:
|
||||
- run: npm ci
|
||||
- name: Install shell test interpreters
|
||||
run: |
|
||||
if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
|
||||
if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null || ! command -v gpg >/dev/null; then
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y busybox-static shellcheck
|
||||
sudo apt-get install -y busybox-static shellcheck gnupg
|
||||
fi
|
||||
busybox sh -c 'echo "BusyBox shell ready"'
|
||||
shellcheck --version
|
||||
gpg --version
|
||||
- run: npm test
|
||||
env:
|
||||
BROWSER_TESTS: '1'
|
||||
@@ -40,9 +65,34 @@ jobs:
|
||||
run: npm run build
|
||||
- run: node scripts/verify-release.mjs
|
||||
- name: Deploy the validated production bundle
|
||||
run: npx wrangler deploy --config cf-worker/wrangler.toml
|
||||
id: deploy
|
||||
run: |
|
||||
echo 'attempted=true' >> "$GITHUB_OUTPUT"
|
||||
npx wrangler deploy --config cf-worker/wrangler.toml
|
||||
env:
|
||||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||||
- name: Verify published revision and public key payload
|
||||
id: remote
|
||||
run: node scripts/verify-release.mjs --remote
|
||||
notify:
|
||||
needs: [verify, deploy]
|
||||
# Runs only after Wrangler was attempted, including deployment/remote-check
|
||||
# failure. Gist edits alone do not trigger this workflow or an email.
|
||||
if: always() && needs.verify.result == 'success' && needs.deploy.outputs.attempted == 'true'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 3
|
||||
environment: production
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
persist-credentials: false
|
||||
- name: Send optional deployment email-provider webhook
|
||||
run: node scripts/notify-deployment.mjs
|
||||
env:
|
||||
ENABLE_MAIL_NOTIFICATION: ${{ vars.ENABLE_MAIL_NOTIFICATION }}
|
||||
MAIL_NOTIFICATION_WEBHOOK: ${{ secrets.MAIL_NOTIFICATION_WEBHOOK }}
|
||||
MAIL_NOTIFICATION_TO: ${{ vars.MAIL_NOTIFICATION_TO }}
|
||||
DEPLOYMENT_STATUS: ${{ needs.deploy.result }}
|
||||
DEPLOYMENT_PHASE: ${{ needs.deploy.outputs.deployment_outcome != 'success' && 'deployment' || needs.deploy.outputs.verification_outcome != 'success' && 'remote-verification' || 'complete' }}
|
||||
|
||||
@@ -1,45 +1,49 @@
|
||||
# Quickly Configuring SSH Server
|
||||
|
||||
在 Git 仓库中独立管理服务器 SSH 公钥，通过 Cloudflare Worker 发布，再由服务器定期同步。
|
||||
在 Git 仓库或指定账号的 Gist 中独立管理服务器 SSH 公钥，通过同一个 Cloudflare Worker 发布网页、脚本、公钥清单、签名和公钥证书。
|
||||
|
||||
- **优先使用本仓库的 `keys/authorized_keys`**；主清单为空时，可按配置顺序读取备用 HTTPS 公钥源。没有默认 GitHub 账号 SSH Keys 来源。
|
||||
- 网页、脚本与仓库公钥一起构建发布，不再依赖 GitHub Pages；备用公钥独立标记来源和内容摘要。
|
||||
- 首页支持浅色 / 深色 / 跟随系统、手机与宽屏，以及 GitHub 风格的代码块复制按钮。
|
||||
- POSIX Shell 客户端只替换自己的密钥管理区块，保留手工密钥；下载或校验失败保留上次成功的内容。
|
||||
- 不默认读取 GitHub 账号的 SSH 登录钥匙，不依赖独立 GitHub Pages 部署。
|
||||
- 普通模式仅校验公钥格式；可选高信任模式由**服务器脚本**验证 GPG 签名，Worker 无法远程关闭它。
|
||||
- 脚本落盘后固定，定时任务只同步公钥。升级、修改信任指纹或关闭验签需要显式重新安装。
|
||||
- 首页有浅色 / 深色 / 系统主题、响应式布局和逐条命令复制；不显示或内嵌公钥正文、指纹、个人注释。
|
||||
|
||||
> 仓库初始没有服务器公钥，生产构建会拒绝空清单。先填写你独立管理的服务器**公钥**或显式配置备用源；不要上传私钥，也不要直接拿测试夹具上线。
|
||||
> 初始生产清单和备用源为空，没有配置实际签名证书或发布凭据。生产构建不会偷偷使用测试密钥。仓库中的公钥文件不是 GitHub 账号登录凭据。
|
||||
|
||||
## Quick Usage
|
||||
## 使用与重新安装
|
||||
|
||||
以下地址是部署配置中的示例。Fork 后先修改 `deployment.json`，填写公钥并完成自己的 Worker 部署，再使用自己的域名。执行前建议下载并检查脚本。
|
||||
先配置并部署自己的 Worker，再使用自己的域名。以下地址只是本项目的部署配置示例。
|
||||
|
||||
安装公钥并设置定时同步：
|
||||
普通 HTTPS 安装 / 显式重新安装并启用定时同步：
|
||||
|
||||
```sh
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- -c
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- --install --download-script -c
|
||||
```
|
||||
|
||||
新安装默认每 15 分钟同步一次；已有的有效自定义计划会保留。只更新一次：
|
||||
再次执行安装命令会检测已安装脚本，备份并升级。签名策略只在已替换旧客户端之后激活；若后续磁盘写入失败，可能留下新脚本和未完成的配置，请按错误信息检查并显式重新安装，不要把失败当作策略已启用。已有本地配置和自定义定时计划默认保留，不因远端仓库默认值变化而重置。新安装默认每 15 分钟同步。
|
||||
|
||||
**这条命令信任下载到的可执行脚本。** HTTPS、同一 Worker 提供的摘要和后续公钥验签，不能证明首次安装器本身可信。高信任安装应先取得独立渠道核对过的脚本摘要和完整 GPG 指纹，下载、核验本地文件后执行安装。不要把从同一被攻陷来源获得的指纹当作独立信任依据。
|
||||
|
||||
日常同步、预览、状态使用已经落盘的脚本：
|
||||
|
||||
```sh
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- -o
|
||||
```
|
||||
|
||||
预览、帮助与本地状态：
|
||||
|
||||
```sh
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- -o --dry-run
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" -o
|
||||
```
|
||||
|
||||
```sh
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- -h
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" -o --dry-run
|
||||
```
|
||||
|
||||
```sh
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" --status
|
||||
```
|
||||
|
||||
指定计划、取消计划、单独更新已安装脚本：
|
||||
查看完整参数，不修改配置：
|
||||
|
||||
```sh
|
||||
curl -fsSL 'https://ssh.lamgc.me/script.sh' | sh -s -- -h
|
||||
```
|
||||
|
||||
指定 / 取消自己的定时计划：
|
||||
|
||||
```sh
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" -c '0 */6 * * *'
|
||||
@@ -49,73 +53,118 @@ sh "$HOME/.conf-sshd/conf-sshd.sh" -c '0 */6 * * *'
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" -c false
|
||||
```
|
||||
|
||||
```sh
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" -u
|
||||
```
|
||||
|
||||
卸载定时同步与脚本，保留密钥及 SSH 服务配置：
|
||||
|
||||
```sh
|
||||
sh "$HOME/.conf-sshd/conf-sshd.sh" --uninstall
|
||||
```
|
||||
|
||||
这些命令用途不同，按需单独执行。网页只提供逐块复制，不把安装、卸载、密码策略合成“执行全部”。
|
||||
卸载保留授权密钥、SSH 服务配置、本地信任配置与防回滚状态。`-u` 不再下载或替换脚本，会提示显式重新安装。没有自动更新周期；延长更新周期本身也不是安全验证。
|
||||
|
||||
## 公钥清单与发布
|
||||
## Git / Gist 管理模式
|
||||
|
||||
将普通 OpenSSH 公钥逐行放入 `keys/authorized_keys`，可附注释和空行。构建会规范化换行与编码，逐条调用 `ssh-keygen` 校验，拒绝重复钥匙、私钥、无效编码和未知行。
|
||||
### Git
|
||||
|
||||
支持 ED25519、RSA（至少 2048 位）、ECDSA nistp256/384/521 和 OpenSSH 安全密钥类型。第一版不接受 DSA、证书或 `command=`、`environment=` 等 authorized_keys 选项。私钥应始终保留在你的客户端或安全密钥设备上。
|
||||
`keySource.type` 为 `git`（默认）。普通公钥逐行放入 `keys/authorized_keys`；构建校验并去掉所有注释，再发布。若注释曾提交公开仓库，它仍可能存在于历史中，因此发布前也应从源文件去掉个人信息。
|
||||
|
||||
配置文件 `deployment.json`：
|
||||
支持 ED25519、RSA（2048–16384 位）、ECDSA nistp256/384/521 和 OpenSSH 安全密钥格式。不接受 DSA、SSH 证书、`command=` 等 authorized_keys 选项、重复公钥或私钥。
|
||||
|
||||
- `baseUrl`：Worker 的正式 HTTPS origin，不带路径或末尾斜杠。
|
||||
- `repositoryUrl`：自己的项目仓库地址。
|
||||
- `defaultCron`：新安装的默认同步计划，默认 `*/15 * * * *`。
|
||||
- `allowEmpty`：默认 `false`；明确设为 `true` 时，空主清单表示撤销全部，禁止回退到备用源。
|
||||
- `fallbackSources`：默认空数组。可填写最多 5 个公开 HTTPS URL，按顺序尝试；不能带凭据、查询参数或片段，不接受请求端传入的地址。
|
||||
签名发布使用精确签名文档和 detached ASCII-armored GPG 签名。两者与网页、脚本一同构建，作为同一 Worker 发布产物交付；不会在发布后重新生成签名正文。
|
||||
|
||||
页面展示的是**当前已发布版本**，不是每台服务器的实时同步状态。提交合并后还要等待部署成功；服务器会在下一次成功同步时应用。
|
||||
在持有签名私钥的可信电脑上，先生成新的文档（序号必须递增，时间自行选择）：
|
||||
|
||||
### 有序备用源
|
||||
```sh
|
||||
node scripts/prepare-key-release.mjs --input keys/authorized_keys --output keys/ssh.keys --list-id my-servers --sequence 1 --issued-at 1791856800 --expires-at 1794448800
|
||||
```
|
||||
|
||||
只有仓库清单为空，且 `allowEmpty` 不是 `true` 时，Worker 才依次读取 `fallbackSources`。取第一个成功且有效的非空公钥集合，不聚合多个源。仓库清单非空始终优先；明确撤销全部时不调用任何备用源。
|
||||
上例时间仅展示参数格式，不应照抄为正式有效期。工具会拒绝覆盖已有文件；更新时先保留旧版并明确选择新输出，再审阅替换。清空发布必须使用空输入并加 `--revoke`。
|
||||
|
||||
每个备用源有 3 秒超时（含正文读取）、1 MiB 正文限制、最多 1000 个公钥，并拒绝重定向。非 2xx、空正文、无效 UTF-8、私钥/选项/证书、损坏密钥或重复密钥会跳过并尝试下一个。全部失败时 `/ssh.keys` 和 `/release.json` 返回 503，首页说明暂不可用；客户端保留上次成功的密钥。
|
||||
审核精确文档后，使用你自己的授权签名钥匙手动签名：
|
||||
|
||||
不设置 Worker 备用公钥缓存，不使用陈旧内容兜底；每个相关请求重新获取，要求上游也正确提供当前数据。首页的一次响应中，公钥、复制内容、来源、数量与内容摘要来自同一个结果。不同时间请求可能看到备用源的不同版本，因此页面分别显示代码修订与公钥摘要，不能只用 Git 提交号代表动态公钥版本。
|
||||
```sh
|
||||
gpg --armor --detach-sign --local-user FULL_PRIMARY_FINGERPRINT --output keys/ssh.keys.sig keys/ssh.keys
|
||||
```
|
||||
|
||||
撤销备用源公钥取决于上游更新、下一次成功请求和服务器同步周期；这不是即时断开连接的机制。主清单为空、未允许明确撤销且未配置备用源时，生产构建仍会拒绝。
|
||||
`FULL_PRIMARY_FINGERPRINT` 必须替换为独立核对的完整指纹；GPG 可选择该主钥的签名子钥。不要上传私钥，也不要在 Actions 中自动运行签名步骤。上传的 `ssh.keys` 与 `ssh.keys.sig` 必须保持原始字节；Gist 使用同样文件即可。Git 也可使用工具打包的 `keys/release.bundle`，但不能与 `keys/ssh.keys` 同时存在。
|
||||
|
||||
### 明确撤销全部管理密钥
|
||||
|
||||
确实需要删除全部受管理密钥时，在同一提交中清空公钥清单，并显式将 `allowEmpty` 改为 `true`。发布与新客户端都会检查数量、版本和内容摘要，只有合法的明确空清单才会清空管理区块。
|
||||
### Gist
|
||||
|
||||
先确认其他恢复登录方式可用。手工放在管理区块之外的密钥不会删除；同一把钥匙若还存在于其他 authorized_keys 来源，仍可能允许登录。删除密钥也不会终止已有 SSH 会话。
|
||||
配置固定的 Gist ID、账号数字 `ownerId`、显示用 `ownerLogin` 和文件名。Worker 通过 GitHub REST API 核对所属账号，取得当前修订后，再从那个固定修订读取公钥与签名。不能仅靠 URL 中的用户名判断所属，也不能从任意请求参数传入 Gist/上游地址。
|
||||
|
||||
网络故障、错误正文、未知协议或校验失败都会保留本地旧密钥并报错。因此断网时不能保证及时撤权。旧版本客户端不支持明确空清单撤权，应先升级。
|
||||
公开 Gist 无需读取 token；仅使用明确配置的文件，不跟随 API 返回的任意 raw URL。缺失文件、截断响应、owner 不匹配、超时或非 200 均视为来源失败。
|
||||
|
||||
### 安全边界
|
||||
同一 Gist 同时含 `release.bundle` 与拆分文件时，bundle 优先；切换到拆分文件前应明确移除旧 bundle，避免持续发布旧内容。`ownerLogin` 只是显示信息，数字 owner ID 才是身份固定值。
|
||||
|
||||
服务器密钥与 GitHub 账号认证密钥相互独立。在仓库里保存公钥不会把它注册为 GitHub 账号登录凭据。
|
||||
更新签名文档后必须重新签名。Worker 不持有签名私钥，不会为 Gist 的任意修改自动背书。普通模式可以发布无签名清单；客户端是否验签由其本地策略决定。
|
||||
|
||||
但能修改并发布这个项目的人，以及被配置为备用公钥源的发布者，都能改变使用它的服务器的授权密钥。请保护仓库主分支、CI、Cloudflare 账号和部署权限。HTTPS 保护传输，SHA-256 用于检测截断或版本不一致，**不能抵抗发布源本身被攻陷**。`curl | sh` 仍意味着信任发布的可执行脚本；定时任务只拉公钥，不会自动更新脚本。
|
||||
Gist 配置示例（将 ID 与账号数字 ID 替换为经过核对的真实值）：
|
||||
|
||||
## 安装与部署
|
||||
```json
|
||||
{"keySource":{"type":"gist","id":"0123456789abcdef0123456789abcdef","ownerId":123456,"ownerLogin":"example","file":"ssh.keys","signatureFile":"ssh.keys.sig","bundleFile":"release.bundle"}}
|
||||
```
|
||||
|
||||
### 前提
|
||||
### 可见性
|
||||
|
||||
构建环境需要 Node.js 22+、npm、Git、OpenSSH 客户端工具（`ssh-keygen`）及 POSIX `sh`。依赖固定在 `package-lock.json`。
|
||||
网页不嵌入密钥，不代表数据保密。`/ssh.keys` 可公开读取，公开 Git/Gist 和历史也可访问；去掉注释后，相同公钥字节仍能被关联。私钥始终留在使用者或可信签名端，不能上传本项目、Worker、Actions 或 Gist。
|
||||
|
||||
客户端需要 `sh`、`curl`、`ssh-keygen`、`awk`、`mktemp`、`stat` 和常用 Unix 工具，以及 `sha256sum` / `shasum` / `openssl` 之一；设置定时同步还需 `crontab`。请自行安装所需软件。脚本不安装包、不启动或重载服务；`-n` 保留为兼容参数。
|
||||
## 客户端 GPG 验证（默认 OFF）
|
||||
|
||||
目标为 Linux 上的 dash、Bash 的 sh 用法和 BusyBox ash。真实发行版服务管理、SELinux 标签或自定义 `AuthorizedKeysFile` 不应仅凭单元测试视为已验证。默认目标文件是当前用户的 `$HOME/.ssh/authorized_keys`；自定义 SSH 授权路径需要人工核对。
|
||||
- **OFF**：只下载 `/ssh.keys`，校验协议、公钥格式和明确空清单；不请求 `/ssh.keys.sig` 或 `/public-key.gpg`，即使它们存在也不验签。
|
||||
- **ON**：取得 `/ssh.keys` 原始字节和同源 `/ssh.keys.sig`，用安装时固定的专用本地钥匙环验证。HTTP 下载每次都必须是 200；404、其他状态、重定向、下载失败、证书指纹不符或验签失败均拒绝该更新。绝不自动回退为 OFF。
|
||||
- 验签覆盖完整响应，包括元数据、换行和公钥正文。不能先去注释、重新排序或转换编码再验签。
|
||||
- 本地记录完整 40 位 OpenPGP v4 指纹，不接受短 key ID。`primary` 模式接受该主密钥及经 GPG 验证绑定的有效签名子钥；`subkey` 只接受指定签名子钥，不接受同主钥的其他子钥。主钥下后来新增的签名子钥仍需通过显式重新安装更新本地证书；固定指纹不会自动下载最新子钥集合。
|
||||
- 日常验证使用隔离的专用本地 GPG keyring，不信任用户默认钥匙环，也不自动访问 keyserver；网络返回的其他钥匙不能扩大本地授权。
|
||||
|
||||
### 一次性配置
|
||||
仓库可设置新安装默认值，安装时可显式覆盖。**已安装机器的本地配置优先**，之后改仓库默认值不能关闭它的验证。开启验证、换指纹/信任范围或关闭已有验证都必须显示具体信息并取得本地明确确认；取消或无法确认时不应用修改。
|
||||
|
||||
1. Fork / 克隆仓库，填入自己的服务器公钥和 `deployment.json`。
|
||||
2. 按需要修改 `cf-worker/wrangler.toml` 中的 Worker 名称，并为 `baseUrl` 配置 Worker 自定义域名。无需启用 GitHub Pages。
|
||||
3. 安装依赖、运行检查、构建生产产物：
|
||||
安装在本地明确确认后依序寻找对应证书：已有本地证书、Worker `/public-key.gpg`、可选 Email 的 WKD、配置的有序 keyserver。每一步仍必须匹配完整指纹；没有 Email 时跳过 WKD；内置有序服务器为 `hkps://keys.openpgp.org`、`hkps://keyserver.ubuntu.com`，允许显式覆盖。它们只是证书分发源，不是信任根；缺少 UID、无法导入或不支持指定子钥查询时继续下一源，绝不缩短指纹。全部失败则保留现有配置并停止。通过验证的公共证书保存到专用本地钥匙环。仓库默认 Email 会写入公开安装脚本，只应填写愿意公开的邮箱；它只是发现提示，不能取代指纹。
|
||||
|
||||
公钥证书可公开分发，信任来自独立核对并固定的完整指纹。证书内容即使具有相同主指纹，也未必是最新撤销状态：恶意分发端可能重放旧证书、隐瞒新撤销。客户端检查收到的证书中已有的过期/撤销信息，但不能保证及时获知被隐瞒的撤销。复用本地证书也不会自动获知之后的撤销。重新安装仍优先使用有效的本地证书；若需更新同指纹证书，显式提供从可信渠道取得的新公共证书，再核对其撤销/子钥状态。
|
||||
|
||||
完整指纹和 Email 可在 `clientDefaults` 设置，也可显式安装覆盖。例如先独立核验已下载的本地脚本，再执行：
|
||||
|
||||
```sh
|
||||
sh ./conf-sshd.sh --install -c --gpg-verification on --gpg-fingerprint FULL40HEX --gpg-pin-mode primary --list-id my-servers --gpg-email [email protected]
|
||||
```
|
||||
|
||||
占位指纹必须替换为真实完整指纹；Email 可省略。安装会在本地终端要求输入展示的完整指纹确认，没有静默确认参数。关闭已有验证使用显式重新安装加 `--gpg-verification off`，同样需要终端确认。重新安装可用 `--fallback-urls-file` 指定按行排列的备用文档 URL；`--keyserver` 可重复覆盖内置列表，原有设置默认保留。
|
||||
|
||||
### 签名文档、防回滚与故障
|
||||
|
||||
列表 ID 使用 1–64 个字母、数字、点、下划线或连字符，单独的 `-` 保留给本地未配置状态，不能作为列表名。
|
||||
|
||||
签名文档使用固定 LF 格式：协议标记、列表 ID、单调递增序号、签发/到期 Unix 秒、明确撤销标志、数量、结束标记，以及无注释的规范公钥正文。签名覆盖精确全部字节。
|
||||
|
||||
ON 客户端检查固定列表 ID、有效期和持久化的最高序号/摘要。低序号拒绝；同序号只接受同一文档；明确撤销也必须签名并增加序号。首次安装的最低序号应通过可信渠道确定，否则仅有指纹不能排除有效期内的旧发布。
|
||||
|
||||
更新使用锁、待提交记录、快照检查和原子替换来处理进程中断。待提交发布已过期时不会强行应用，保留其序号下限后允许有效的新发布继续；损坏且无法可信恢复的状态会停止并提示人工检查。不要删除或恢复旧版本的本地防回滚状态；整机快照回滚、本地管理员篡改或底层文件系统掉电持久性不由一个 POSIX 脚本保证。
|
||||
|
||||
下载/验签失败或清单过期会保留最后成功的密钥并报错，**不会自动清空密钥造成锁死**。攻击者仍可阻断更新；离线机器无法保证及时撤权。删除公钥不会终止已有会话，也不会移除管理区块外的手工重复钥匙。部署签名私钥或服务器本地管理员权限失陷超出这层保护范围。
|
||||
|
||||
## 有序备用源
|
||||
|
||||
有两份有意区分的配置：
|
||||
|
||||
1. Worker 部署的 `fallbackSources`：主来源不可用或普通主清单为空时，按顺序取首个有效集合，不合并多个来源。明确撤销阻止回退。
|
||||
2. 每台服务器本地保存的备用 URL：主 Worker 更新失败时，按本地顺序尝试，最多一个主源加五个备用源。每个端点单次请求最多 30 秒；由后续源或下次计划同步重试。只通过显式安装配置改变，远端响应不能覆盖。
|
||||
|
||||
服务器本地备用 URL 必须返回本项目 v1 或 signed-v1 文档；普通原始公钥文件可通过 Worker 来源适配器发布。客户端 ON 时，备用 URL 和对应 `.sig` 必须满足相同指纹、列表 ID、签名、时效和防回滚策略。不能用另一来源的签名拼接，更不能在失败后接受未签名公钥。Worker 不能替未签名备用源伪造可信签名。
|
||||
|
||||
Worker 上游请求有时间、流式字节数、数量限制，并拒绝重定向。没有 Worker 陈旧公钥缓存，每个相关请求重新读取；API 响应 `Cache-Control: no-store`。Gist 的正文与签名取自同一修订。客户端两次 HTTP 请求之间若恰逢新发布，签名不匹配会安全拒绝，后续同步再重试。
|
||||
|
||||
## 配置与部署
|
||||
|
||||
`deployment.json`：
|
||||
|
||||
- `baseUrl`：正式 HTTPS origin，无路径、凭据或末尾斜杠。
|
||||
- `repositoryUrl`：项目 GitHub 地址。
|
||||
- `defaultCron`：新安装默认计划。
|
||||
- `allowEmpty`：普通 Git 模式明确允许撤销全部管理密钥；默认 false。
|
||||
- `fallbackSources`：最多五个公开 HTTPS URL，不含凭据、query、fragment 或本地/IP 地址。
|
||||
- `keySource`：Git 或固定账号 Gist 配置。
|
||||
- `signedRelease`：签名列表身份和可公开发布的证书配置；不是私钥。
|
||||
- `clientDefaults`：首次安装的验签默认值、完整指纹、primary/subkey 范围、列表 ID 和可选公开 Email；不覆盖现有本地设置。
|
||||
|
||||
构建需要 Node.js 22+、npm、Git、OpenSSH 客户端和 POSIX sh；GPG 验证/测试需要 `gpg`。服务器需要 curl、ssh-keygen、awk、mktemp、stat、常用 POSIX 工具及 sha256sum/shasum/openssl 之一，ON 还需要 gpg；计划任务需要 crontab。脚本不会自动安装软件。
|
||||
|
||||
```sh
|
||||
npm ci
|
||||
@@ -124,72 +173,61 @@ npm run build
|
||||
node scripts/verify-release.mjs
|
||||
```
|
||||
|
||||
4. 在 GitHub 的生产环境中配置最小权限的 Cloudflare 部署 token 和账号 ID，对应 `CLOUDFLARE_API_TOKEN`、`CLOUDFLARE_ACCOUNT_ID`。凭据只存放在 Secrets，不能提交到代码或公钥清单。
|
||||
5. 准备好正式公钥、域名和权限后，将仓库变量 `ENABLE_WORKER_DEPLOY` 设为 `true`。此后 main 的更新会运行生产发布流程，也可手动触发。
|
||||
正式上线前配置自己的域名、Worker 名称、正式公钥/签名和最小权限 Cloudflare Secrets。将仓库 `ENABLE_WORKER_DEPLOY=true` 才启用 main 发布；默认关闭。PR 测试不部署。
|
||||
|
||||
默认关闭自动生产发布，防止合并本次改动时意外上线。PR 验证不会读取部署凭据或发布 Worker。
|
||||
### 可选 Git 提交签名门禁
|
||||
|
||||
生产流程先测试和严格构建，再部署，最后核对 `/release.json` 和 `/ssh.keys` 的版本与摘要。没有正式密钥、没有备用源且未显式允许空清单时会失败；不会偷偷改用 GitHub Keys 或测试密钥。
|
||||
`REQUIRE_GPG_SIGNATURE=true` 时，发布验证任务先验证本次精确 `GITHUB_SHA`，然后才执行依赖安装、测试和构建。授权完整主指纹和公钥从 GitHub 设置中的 `GPG_ALLOWED_PRIMARY_FINGERPRINTS`、`GPG_PUBLIC_KEYS` 读取，而不是让待部署提交自行指定。
|
||||
|
||||
发布脚本、网页、仓库公钥和备用源配置属于同一构建产物；动态备用公钥有单独的内容摘要。若要回滚历史版本，先查看公钥差异：回滚可能重新启用已撤销的密钥。部署失败保留旧发布，但不能把这描述为新密钥已生效。
|
||||
GitHub 的通用 Verified 标记不是本项目授权名单。最终 merge/squash 提交必须由授权 GPG 钥匙签署；仅 PR 内旧提交签名不够。手动发布也不能绕过同一验证。
|
||||
|
||||
## Paths
|
||||
**这是附加门禁，不能替代服务器验签。** 同仓库 workflow/验证器可被有权限者修改，需配合主分支与工作流强制审阅、受保护 production 环境和最小权限凭据。能修改验证工作流并访问发布凭据的人仍在信任边界内。
|
||||
|
||||
### 可选部署邮件通知 hook
|
||||
|
||||
默认关闭。通过 `ENABLE_MAIL_NOTIFICATION`、`MAIL_NOTIFICATION_WEBHOOK` 和可选 `MAIL_NOTIFICATION_TO` 接入你控制的邮件提供方 webhook；本项目不内置 SMTP 服务，也不会自行创建凭据。
|
||||
|
||||
通知说明部署结果、代码 SHA、来源模式、列表身份和**部署配置中的**备用 URL。它不是服务器清单，不知道各机器后来修改的本地备用源，也不是每次 Gist 内容变更的监视器。通知失败或被压制不能当作部署未发生/系统安全的证明。
|
||||
|
||||
## API
|
||||
|
||||
| 路径 | 内容 |
|
||||
| --- | --- |
|
||||
| `/` | 浏览器首页；旧 curl/libcurl 请求仍返回脚本（显式请求 HTML 除外） |
|
||||
| `/script.sh` | Shell 脚本，推荐所有新命令使用这个明确地址 |
|
||||
| `/ssh.keys` | 带注释元数据的普通公钥文本 |
|
||||
| `/release.json` | 当前代码版本、有效公钥来源、数量、摘要和空清单状态 |
|
||||
| `/` | 浏览器首页；curl/libcurl/wget/HTTPie 返回脚本，显式 HTML 优先 |
|
||||
| `/script.sh` | 安装脚本 |
|
||||
| `/ssh.keys` | 精确公钥文档；签名存在时就是被签名的原始字节 |
|
||||
| `/ssh.keys.sig` | 对上述文档的 detached GPG 签名；没有可用签名时 404 |
|
||||
| `/public-key.gpg` | 配置的公共 GPG 证书；未配置时 404 |
|
||||
| `/release.json` | 来源、数量、摘要、代码修订及签名是否提供；不表示服务器已验签 |
|
||||
|
||||
动态入口不缓存旧数据；带内容哈希的静态 CSS / JS 可以长期缓存。未知路径返回 404，不能用首页 HTML 代替密钥或脚本错误。
|
||||
脚本、Git 公钥/签名与网站一起构建发布；不需要额外 Pages。动态 Gist/备用数据的序号和摘要与代码修订分别表示。静态 CSS/JS 使用内容哈希缓存，未知接口返回 404，不返回 HTML 冒充密钥。
|
||||
|
||||
## 客户端保护措施
|
||||
## 从旧版迁移
|
||||
|
||||
- 所有参数先解析；未知选项、缺参数或冲突用途会报错。
|
||||
- 下载具有 HTTPS 限制、HTTP 失败检测、超时、有限重试和大小限制。
|
||||
- 响应包含协议版本、Git revision、密钥数量、明确空清单标记和 SHA-256；所有公钥逐条校验。
|
||||
- 每个用户独占运行锁；临时文件使用不可预测名称、严格权限和异常清理。
|
||||
- 只识别唯一且配对的原有 BEGIN / END 管理标记，损坏或重复时停止，避免误吞手工密钥。
|
||||
- 同目录原子替换，写入前保存一个受限备份；重复执行内容相同时不重写文件。
|
||||
- 拒绝符号链接、不合适的所有权/写权限和异常文件类型。
|
||||
- `-c` 只管理自己的 cron 区块；原版已知命令可迁移，无法可靠判断的记录会停止并提示。
|
||||
- 正常密钥同步不会修改 `sshd_config`，也不会重载 SSH 服务。
|
||||
1. 保留恢复会话和备用登录方式，先核对独立服务器清单。
|
||||
2. 显式重新安装新版脚本，检查本地配置、自定义计划、管理区块和手工钥匙。
|
||||
3. 逐台核对脚本版本、完整指纹、验证模式、列表 ID 和序号；等待一段时间不是所有服务器升级完成的证据。
|
||||
4. 再切换新的签名文档格式并按确认流程启用 ON。新版 OFF 可以解析新文档但不验签；旧 v1 客户端会拒绝新格式并保留旧钥匙，不能把它视为已得到保护。
|
||||
5. 另开 SSH 会话验证登录。回滚旧 Worker 可能重新发布历史钥匙；ON 客户端有序号防回滚，但不要依赖普通模式抵抗历史重放。
|
||||
|
||||
如果运行被不可捕获地终止，锁可能残留。先检查 `.conf-sshd/lock/pid` 对应的进程及工作状态，再人工处理锁，不能仅凭锁的年龄删除。
|
||||
## 客户端操作边界
|
||||
|
||||
### Root 密码登录（高级）
|
||||
仅操作当前用户 `$HOME/.ssh/authorized_keys` 的唯一配对管理区块。临时文件、锁、备份、同目录替换和写前快照检查避免可观察到的并发覆盖；不同编辑器不共享锁时仍无操作系统级原子比较交换保证。
|
||||
|
||||
保留 `-p yes` / `-p no`，必须单独显式使用并以 root 运行。不属于安装/同步默认流程。它只设置 `PermitRootLogin`，不会替你打开其他认证策略。
|
||||
`-p yes/no` 是独立 root 高级操作，仅修改 PermitRootLogin，验证 `sshd -t/-T` 后替换，遇 Include/Match 等复杂配置拒绝；不会自动 reload/restart。普通安装/同步不修改 SSH 服务策略。
|
||||
|
||||
脚本会检查原配置、生成临时配置、验证语法与生效值、备份后替换，**不会自动 reload/restart**。发现 Include / Match 等无法安全判断的组合时，会拒绝修改并请你人工处理。应用服务变更前应保留恢复会话并测试新连接。
|
||||
目标为 Linux dash、Bash POSIX 与 BusyBox ash。测试不等于真实服务器登录、SELinux、发行版服务管理或自定义 AuthorizedKeysFile 已验证。异常强制终止可能留下锁，人工确认原进程状态后再处理。
|
||||
|
||||
## 从旧版本迁移
|
||||
|
||||
1. 先建立独立服务器公钥清单并发布新 Worker；或显式配置备用源；不会自动导入 GitHub 账号公钥。
|
||||
2. 检查页面公钥、版本和 `/ssh.keys`，确认是你的服务器密钥。
|
||||
3. 显式更新已安装脚本，或从新的 `/script.sh` 下载并检查后重新运行 `-c`。
|
||||
4. 验证自定义 cron 仍保留，手工密钥不变，另开 SSH 会话验证登录。
|
||||
|
||||
旧客户端对非空的 `/ssh.keys` 仍有基本格式兼容，但不具备新验证、明确空清单撤权与其他保护。不要因为 Worker 更新了就认为所有客户端已升级。
|
||||
|
||||
## 开发与测试
|
||||
## 测试
|
||||
|
||||
```sh
|
||||
npm ci
|
||||
npm test
|
||||
npm run build:test
|
||||
npx wrangler deploy --dry-run --config cf-worker/wrangler.toml
|
||||
```
|
||||
|
||||
`build:test` 只用于测试/预览，使用公开的 RFC 测试公钥，并在产物中标记 `testFixture: true`。生产验证脚本拒绝该产物；生产构建只使用仓库公钥和显式配置的备用源，不允许回退到测试夹具。
|
||||
|
||||
测试覆盖构建配置与注入边界、逐条密钥验证、Worker 路由/缓存、主题/复制交互、Shell 参数/管理区块/失败保留/cron/自更新等。Shell 测试只在临时 HOME、假命令和测试文件中运行，不操作真实 SSH 配置或服务。
|
||||
|
||||
`npm run build:test` 之后若要部署正式版本，必须重新执行 `npm run build` 与 `node scripts/verify-release.mjs`。不得直接部署测试产物。
|
||||
测试只使用临时 HOME、命令替身、公开测试 SSH 钥匙及临时无身份/无访问权限的 GPG 测试钥匙。真实浏览器测试仅访问 localhost。`build:test` 产物标记为测试，生产验证拒绝它；上线必须重新生产构建。
|
||||
|
||||
## License
|
||||
|
||||
Apache-2.0，见 [LICENSE](LICENSE)。
|
||||
|
||||
客户端会检测写入期间可观察到的手工修改并停止；其他编辑器若不遵守同一锁，仍无法保证操作系统级的原子比较并交换。请避免同时手工编辑授权文件。
|
||||
|
||||
+142
-31
@@ -1,3 +1,5 @@
|
||||
import {parsePublishedSignedRelease, withoutKeyComments, SIGNED_BUNDLE_MAX_BYTES, SIGNATURE_SEPARATOR, SIGNED_RELEASE_LIMITS, validateListId} from './signed-release.js';
|
||||
|
||||
// Runtime fallback is deliberately stateless: a request never reuses earlier keys.
|
||||
export const KEY_SOURCE_LIMITS = Object.freeze({sources: 5, timeoutMs: 3000, maxBytes: 1024 * 1024, maxKeys: 1000});
|
||||
const encoder = new TextEncoder();
|
||||
@@ -133,15 +135,42 @@ export async function makeKeyBundle(keys, revision, allowEmpty) {
|
||||
if (!/^[0-9a-f]{40}$/.test(revision)) throw new Error('Release revision must be a 40-character Git commit SHA.');
|
||||
if (typeof allowEmpty !== 'boolean') throw new Error('allowEmpty must be an explicit boolean.');
|
||||
if (!keys.length && !allowEmpty) throw new Error('An empty key set requires explicit revocation.');
|
||||
const payload = keys.map(key => `${key.text}\n`).join('');
|
||||
const payload = withoutKeyComments(keys).map(key => `${key.text}\n`).join('');
|
||||
const digest = hex(await sha256(encoder.encode(payload)));
|
||||
const text = `# conf-sshd-v1\n# revision ${revision}\n# key-count ${keys.length}\n# allow-empty ${allowEmpty ? 'yes' : 'no'}\n# sha256 ${digest}\n# end-metadata\n${payload}`;
|
||||
if (encoder.encode(text).length > KEY_SOURCE_LIMITS.maxBytes) throw new SourceError('too-large');
|
||||
return {sha256: digest, text};
|
||||
}
|
||||
async function snapshot(keys, release, source) {
|
||||
const bundle = await makeKeyBundle(keys, release.revision, release.allowEmpty);
|
||||
return {keys, keysText: bundle.text, sha256: bundle.sha256, keyCount: keys.length, allowEmpty: release.allowEmpty, source, revision: release.revision, keyRevision: bundle.sha256, fetchedAt: new Date().toISOString()};
|
||||
async function snapshot(keys, release, source, signed = null) {
|
||||
if (!/^[0-9a-f]{40}$/.test(release.revision)) throw Error('Release revision must be a 40-character Git commit SHA.');
|
||||
keys = withoutKeyComments(keys);
|
||||
const allowEmpty = signed ? signed.metadata.revoke : release.allowEmpty;
|
||||
const bundle = signed ? {text: signed.document, sha256: hex(await sha256(encoder.encode(keys.map(key => key.text + '\n').join(''))))} : await makeKeyBundle(keys, release.revision, allowEmpty);
|
||||
return {keys, keysText: signed?.document ?? bundle.text, sha256: bundle.sha256, keyCount: keys.length, allowEmpty, source, revision: release.revision, keyRevision: signed ? signed.metadata.documentSha256 : bundle.sha256, fetchedAt: new Date().toISOString(), signedDocument: signed?.document ?? null, signature: signed?.signature ?? null, signatureAvailable: Boolean(signed?.signature), signedBundle: signed?.bundle ?? null, signedMetadata: signed?.metadata ?? null};
|
||||
}
|
||||
|
||||
export function validateKeySource(value = {type: 'git'}) {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) throw Error('keySource must be an object.');
|
||||
const allowed = value.type === 'git' ? ['type'] : ['type', 'id', 'ownerId', 'ownerLogin', 'file', 'signatureFile', 'bundleFile'];
|
||||
if (!['git', 'gist'].includes(value.type) || Object.keys(value).some(key => !allowed.includes(key))) throw Error('Invalid keySource configuration.');
|
||||
if (value.type === 'git') return {type: 'git'};
|
||||
if (typeof value.id !== 'string' || !/^[0-9a-f]{5,64}$/.test(value.id)) throw Error('Gist source requires a fixed lowercase hexadecimal ID.');
|
||||
if (!Number.isSafeInteger(value.ownerId) || value.ownerId < 1) throw Error('Gist source requires a positive numeric ownerId.');
|
||||
if (typeof value.ownerLogin !== 'string' || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(value.ownerLogin)) throw Error('Gist source requires an ownerLogin display name.');
|
||||
const file = value.file ?? 'ssh.keys', signatureFile = value.signatureFile ?? `${file}.sig`, bundleFile = value.bundleFile ?? 'release.bundle';
|
||||
for (const name of [file, signatureFile, bundleFile]) if (typeof name !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name)) throw Error('Gist filenames must be fixed plain filenames.');
|
||||
if (new Set([file, signatureFile, bundleFile]).size !== 3) throw Error('Gist key, signature, and bundle filenames must differ.');
|
||||
return {type: 'gist', id: value.id, ownerId: value.ownerId, ownerLogin: value.ownerLogin, file, signatureFile, bundleFile};
|
||||
}
|
||||
|
||||
export function validateSignedReleaseConfig(value) {
|
||||
if (value === undefined || value === null) return null;
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !['listId', 'publicKeyFile', 'fingerprint'].includes(key))) throw Error('Invalid signedRelease configuration.');
|
||||
validateListId(value.listId);
|
||||
if (Boolean(value.publicKeyFile) !== Boolean(value.fingerprint)) throw Error('Build signature verification requires both publicKeyFile and fingerprint.');
|
||||
if (value.publicKeyFile !== undefined && (typeof value.publicKeyFile !== 'string' || !/^keys\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value.publicKeyFile))) throw Error('Signing public key must be a fixed file inside keys/.');
|
||||
if (value.fingerprint !== undefined && (typeof value.fingerprint !== 'string' || !/^[A-Fa-f0-9]{40}$/.test(value.fingerprint))) throw Error('Signing fingerprint must be the complete 40-character primary fingerprint.');
|
||||
return {listId: value.listId, ...(value.publicKeyFile ? {publicKeyFile: value.publicKeyFile, fingerprint: value.fingerprint.toUpperCase()} : {})};
|
||||
}
|
||||
function boundedOption(options, name) {
|
||||
const value = options[name] ?? KEY_SOURCE_LIMITS[name];
|
||||
@@ -181,43 +210,125 @@ async function readBody(response, signal, maxBytes) {
|
||||
reader.releaseLock();
|
||||
}
|
||||
}
|
||||
async function fetchSource(url, fetchImpl, limits) {
|
||||
async function withDeadline(limits, operation, onTimeout) {
|
||||
const controller = new AbortController();
|
||||
let timer, response;
|
||||
const timeout = new Promise((_, reject) => {
|
||||
timer = setTimeout(() => { reject(new SourceError('timeout')); controller.abort(); }, limits.timeoutMs);
|
||||
let timer;
|
||||
const timeout = new Promise((resolve, reject) => {
|
||||
timer = setTimeout(() => { const recovery = onTimeout?.(); recovery === undefined ? reject(new SourceError('timeout')) : resolve(recovery); controller.abort(); }, limits.timeoutMs);
|
||||
});
|
||||
const operation = (async () => {
|
||||
try {
|
||||
response = await fetchImpl(url, {method: 'GET', redirect: 'manual', cache: 'no-store', headers: {'Accept': 'text/plain, application/octet-stream;q=0.9', 'Cache-Control': 'no-cache, no-store', 'Pragma': 'no-cache'}, signal: controller.signal});
|
||||
if (controller.signal.aborted) throw new SourceError('timeout');
|
||||
if (response.redirected || (response.status >= 300 && response.status < 400)) throw new SourceError('redirect', response.status);
|
||||
if (!response.ok) throw new SourceError('http-error', response.status);
|
||||
const body = await readBody(response, controller.signal, limits.maxBytes);
|
||||
let keys;
|
||||
try { keys = await parsePublicKeys(body, {maxKeys: limits.maxKeys, signal: controller.signal}); } catch { throw new SourceError('invalid-keys'); }
|
||||
if (!keys.length) throw new SourceError('empty');
|
||||
return keys;
|
||||
} finally {
|
||||
if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {});
|
||||
}
|
||||
})();
|
||||
try { return await Promise.race([operation, timeout]); }
|
||||
try { return await Promise.race([operation(controller.signal), timeout]); }
|
||||
finally { clearTimeout(timer); }
|
||||
}
|
||||
async function fetchText(url, fetchImpl, signal, maxBytes, github = false) {
|
||||
let response;
|
||||
try {
|
||||
response = await fetchImpl(url, {method: 'GET', redirect: 'manual', cache: 'no-store', headers: {'Accept': github ? 'application/vnd.github+json' : 'text/plain, application/octet-stream;q=0.9', 'Cache-Control': 'no-cache, no-store', 'Pragma': 'no-cache', ...(github ? {'User-Agent': 'conf-sshd-key-source', 'X-GitHub-Api-Version': '2022-11-28'} : {})}, signal});
|
||||
if (signal.aborted) throw new SourceError('timeout');
|
||||
if (response.redirected || (response.status >= 300 && response.status < 400)) throw new SourceError('redirect', response.status);
|
||||
if (response.status !== 200) throw new SourceError('http-error', response.status);
|
||||
return await readBody(response, signal, maxBytes);
|
||||
} finally {
|
||||
if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {});
|
||||
}
|
||||
}
|
||||
async function parseSourceText(body, release, limits, options, signal, signature = null) {
|
||||
if (options.requireSigned || body.startsWith('# conf-sshd-signed-v1\n')) {
|
||||
try {
|
||||
const separator = body.indexOf(SIGNATURE_SEPARATOR);
|
||||
const document = separator < 0 ? body : body.slice(0, separator);
|
||||
if (separator >= 0) signature = body.slice(separator + SIGNATURE_SEPARATOR.length);
|
||||
const signed = await parsePublishedSignedRelease(document, signature, {listId: release.signedRelease?.listId, now: options.now, checkFreshness: Boolean(options.requireSigned), requireSigned: options.requireSigned, signal});
|
||||
if (signed.keys.length > limits.maxKeys) throw Error('Too many keys.');
|
||||
return {keys: signed.keys, signed};
|
||||
} catch { throw new SourceError('invalid-signed-release'); }
|
||||
}
|
||||
let keys;
|
||||
try { keys = await parsePublicKeys(body, {maxKeys: limits.maxKeys, signal}); } catch { throw new SourceError('invalid-keys'); }
|
||||
if (!keys.length) throw new SourceError('empty');
|
||||
return {keys, signed: null};
|
||||
}
|
||||
async function fetchSource(url, fetchImpl, limits, release, options) {
|
||||
let withoutSignature;
|
||||
return withDeadline(limits, async signal => {
|
||||
const body = await fetchText(url, fetchImpl, signal, limits.maxBytes === KEY_SOURCE_LIMITS.maxBytes ? SIGNED_BUNDLE_MAX_BYTES : limits.maxBytes);
|
||||
if (body.startsWith('# conf-sshd-signed-v1\n') && !body.includes(SIGNATURE_SEPARATOR)) {
|
||||
// A detached pair never combines different sources. A publication race remains a client signature failure.
|
||||
withoutSignature = await parseSourceText(body, release, limits, {...options, requireSigned: false}, signal);
|
||||
let signature = null;
|
||||
try { signature = await fetchText(url + '.sig', fetchImpl, signal, SIGNED_RELEASE_LIMITS.signatureBytes); } catch { /* OFF remains usable when the optional signature is unavailable. */ }
|
||||
return parseSourceText(body, release, limits, options, signal.aborted ? undefined : signal, signature);
|
||||
}
|
||||
return parseSourceText(body, release, limits, options, signal);
|
||||
}, () => options.requireSigned ? undefined : withoutSignature);
|
||||
}
|
||||
async function fetchGist(source, fetchImpl, limits, release, options) {
|
||||
return withDeadline(limits, async signal => {
|
||||
// Both requests, streamed bodies and parsing share one deadline; never follow an upstream raw_url.
|
||||
const get = async suffix => {
|
||||
const body = await fetchText(`https://api.github.com/gists/${source.id}${suffix}`, fetchImpl, signal, 2 * SIGNED_BUNDLE_MAX_BYTES, true);
|
||||
let data;
|
||||
try { data = JSON.parse(body); } catch { throw new SourceError('invalid-gist'); }
|
||||
if (!data || data.id !== source.id || data.owner?.id !== source.ownerId) throw new SourceError('gist-owner-mismatch');
|
||||
if (data.public !== true || data.truncated === true || !data.files || typeof data.files !== 'object' || Array.isArray(data.files)) throw new SourceError('invalid-gist');
|
||||
return data;
|
||||
};
|
||||
const latest = await get('');
|
||||
const gistRevision = latest.history?.[0]?.version;
|
||||
if (typeof gistRevision !== 'string' || !/^[0-9a-f]{40}$/.test(gistRevision)) throw new SourceError('invalid-gist-revision');
|
||||
const pinned = await get(`/${gistRevision}`);
|
||||
const filename = Object.hasOwn(pinned.files, source.bundleFile) ? source.bundleFile : source.file;
|
||||
const file = pinned.files[filename];
|
||||
if (!file || file.filename !== filename || file.truncated !== false || typeof file.content !== 'string' || (file.encoding !== undefined && file.encoding !== 'utf-8')) throw new SourceError('invalid-gist-file');
|
||||
if (filename === source.bundleFile && (!file.content.startsWith('# conf-sshd-signed-v1\n') || !file.content.includes(SIGNATURE_SEPARATOR))) throw new SourceError('invalid-signed-release');
|
||||
const size = encoder.encode(file.content).length;
|
||||
const max = filename === source.bundleFile ? SIGNED_BUNDLE_MAX_BYTES : limits.maxBytes;
|
||||
if (!Number.isSafeInteger(file.size) || file.size !== size || size > max) throw new SourceError('too-large');
|
||||
// Optional signature is read only from this same immutable revision, never from latest/raw URLs.
|
||||
let signature = null;
|
||||
const signatureFile = pinned.files[source.signatureFile];
|
||||
if (signatureFile && signatureFile.filename === source.signatureFile && signatureFile.truncated === false && typeof signatureFile.content === 'string' && (signatureFile.encoding === undefined || signatureFile.encoding === 'utf-8') && Number.isSafeInteger(signatureFile.size) && signatureFile.size === encoder.encode(signatureFile.content).length && signatureFile.size <= SIGNED_RELEASE_LIMITS.signatureBytes) signature = signatureFile.content;
|
||||
const result = await parseSourceText(file.content, release, limits, options, signal, signature);
|
||||
return {...result, source: {type: 'gist', id: source.id, ownerId: source.ownerId, ownerLogin: source.ownerLogin, gistRevision, file: filename, url: `https://gist.github.com/${source.ownerLogin}/${source.id}/${gistRevision}`}};
|
||||
});
|
||||
}
|
||||
|
||||
/** Only release-configured URLs are accepted; callers must never derive release data from a request. */
|
||||
/** Only release-configured sources are accepted. Worker checks structure, never claims OpenPGP verification. */
|
||||
export async function resolveKeys(release, fetchImpl = globalThis.fetch, internalOptions = {}) {
|
||||
if (!release || !Array.isArray(release.keys) || typeof release.allowEmpty !== 'boolean') throw new Error('Invalid deployed key release.');
|
||||
if (release.keys.length) return snapshot(release.keys, release, {type: 'repository'});
|
||||
// An explicit empty release means revoke. It must never be repopulated from a fallback.
|
||||
if (release.allowEmpty) return snapshot([], release, {type: 'explicit-empty'});
|
||||
const sources = validateFallbackSources(release.fallbackSources);
|
||||
const keySource = validateKeySource(release.keySource);
|
||||
validateSignedReleaseConfig(release.signedRelease);
|
||||
if (internalOptions.requireSigned !== undefined && typeof internalOptions.requireSigned !== 'boolean') throw Error('requireSigned must be boolean.');
|
||||
const limits = {timeoutMs: boundedOption(internalOptions, 'timeoutMs'), maxBytes: boundedOption(internalOptions, 'maxBytes'), maxKeys: boundedOption(internalOptions, 'maxKeys')};
|
||||
const sources = validateFallbackSources(release.fallbackSources);
|
||||
const diagnostics = [];
|
||||
if (keySource.type === 'git') {
|
||||
if (release.signedDocument || release.signedBundle) {
|
||||
// A malformed signed primary must never downgrade to different unsigned repository keys.
|
||||
try {
|
||||
const result = await parseSourceText(release.signedDocument || release.signedBundle, release, limits, internalOptions, undefined, release.signature ?? null);
|
||||
return await snapshot(result.keys, release, {type: result.signed.metadata.revoke ? 'explicit-empty' : 'repository'}, result.signed);
|
||||
} catch { diagnostics.push({index: -1, code: 'invalid-signed-release'}); }
|
||||
} else if (!internalOptions.requireSigned) {
|
||||
if (release.keys.length) return snapshot(release.keys, release, {type: 'repository'});
|
||||
// An explicit empty release means revoke. It must never be repopulated from a fallback.
|
||||
if (release.allowEmpty) return snapshot([], release, {type: 'explicit-empty'});
|
||||
}
|
||||
// An explicit unsigned empty primary cannot be replaced by signed fallback keys either.
|
||||
if (!release.signedDocument && !release.signedBundle && release.allowEmpty && !release.keys.length) throw new FallbackUnavailableError([{index: -1, code: 'unsigned-revocation'}]);
|
||||
} else {
|
||||
try {
|
||||
const result = await fetchGist(keySource, fetchImpl, limits, release, internalOptions);
|
||||
return await snapshot(result.keys, release, result.source, result.signed);
|
||||
} catch (error) { diagnostics.push(diagnostic(error, -1)); }
|
||||
}
|
||||
for (const [index, url] of sources.entries()) {
|
||||
try { return await snapshot(await fetchSource(url, fetchImpl, limits), release, {type: 'fallback', url}); }
|
||||
catch (error) { diagnostics.push({index, code: error instanceof SourceError ? error.code : 'network-error', ...(error instanceof SourceError && error.status !== undefined ? {status: error.status} : {})}); }
|
||||
try {
|
||||
const result = await fetchSource(url, fetchImpl, limits, release, internalOptions);
|
||||
return await snapshot(result.keys, release, {type: 'fallback', url}, result.signed);
|
||||
} catch (error) { diagnostics.push(diagnostic(error, index)); }
|
||||
}
|
||||
throw new FallbackUnavailableError(diagnostics);
|
||||
}
|
||||
function diagnostic(error, index) {
|
||||
return {index, code: error instanceof SourceError ? error.code : 'network-error', ...(error instanceof SourceError && error.status !== undefined ? {status: error.status} : {})};
|
||||
}
|
||||
|
||||
+18
-5
@@ -23,10 +23,14 @@ export function createHandler(release, {fetchImpl = globalThis.fetch} = {}) {
|
||||
return new Response(request.method === 'HEAD' ? null : body, {status, headers});
|
||||
};
|
||||
if (url.pathname === '/script.sh') return respond(release.script, 'text/plain; charset=utf-8');
|
||||
if (url.pathname === '/public-key.gpg') {
|
||||
if (!release.publicCertificate) return respond('No public signing certificate is configured.\n', 'text/plain; charset=utf-8', 404);
|
||||
return respond(release.publicCertificate, 'application/pgp-keys');
|
||||
}
|
||||
let snapshot;
|
||||
if (['/ssh.keys','/release.json','/'].includes(url.pathname)) {
|
||||
if (['/ssh.keys','/ssh.keys.sig','/release.json','/'].includes(url.pathname)) {
|
||||
const accept = request.headers.get('Accept') || '';
|
||||
const legacyScript = url.pathname === '/' && !accept.toLowerCase().includes('text/html') && /(?:curl|libcurl)\//i.test(request.headers.get('User-Agent') || '');
|
||||
const legacyScript = url.pathname === '/' && !accept.toLowerCase().includes('text/html') && /(?:curl|libcurl|wget|httpie)\//i.test(request.headers.get('User-Agent') || '');
|
||||
if (!legacyScript) {
|
||||
try {
|
||||
snapshot = {...release, ...await resolveKeys(release, fetchImpl)};
|
||||
@@ -40,17 +44,26 @@ export function createHandler(release, {fetchImpl = globalThis.fetch} = {}) {
|
||||
}
|
||||
}
|
||||
if (url.pathname === '/ssh.keys') return respond(snapshot.keysText, 'text/plain; charset=utf-8');
|
||||
if (url.pathname === '/ssh.keys.sig') {
|
||||
// This detached signature covers every byte returned by /ssh.keys. Never
|
||||
// manufacture a signature for an unsigned source or transform signed data.
|
||||
if (!snapshot.signature || !snapshot.signedDocument || snapshot.keysText !== snapshot.signedDocument) {
|
||||
return respond('No detached signature is available for this key response.\n', 'text/plain; charset=utf-8', 404);
|
||||
}
|
||||
return respond(snapshot.signature, 'application/pgp-signature');
|
||||
}
|
||||
if (url.pathname === '/release.json') {
|
||||
return respond(JSON.stringify({schema:1,revision:snapshot.revision,publishedAt:snapshot.publishedAt,
|
||||
keyCount:snapshot.keyCount,allowEmpty:snapshot.allowEmpty,sha256:snapshot.sha256,keyRevision:snapshot.sha256,
|
||||
source:snapshot.source,fetchedAt:snapshot.fetchedAt,testFixture:Boolean(release.testFixture)})+'\n','application/json; charset=utf-8');
|
||||
keyCount:snapshot.keyCount,allowEmpty:snapshot.allowEmpty,sha256:snapshot.sha256,keyRevision:snapshot.keyRevision ?? snapshot.sha256,
|
||||
source:snapshot.source,fetchedAt:snapshot.fetchedAt,signatureAvailable:Boolean(snapshot.signature),certificateAvailable:Boolean(release.publicCertificate),
|
||||
signedMetadata:snapshot.signedMetadata ?? null,signatureVerifiedByWorker:false,testFixture:Boolean(release.testFixture)})+'\n','application/json; charset=utf-8');
|
||||
}
|
||||
if (url.pathname === '/') {
|
||||
headers.set('Vary', 'Accept, User-Agent');
|
||||
const accept = request.headers.get('Accept') || '';
|
||||
const agent = request.headers.get('User-Agent') || '';
|
||||
// Explicit HTML wins; keep historic curl | sh entry point as a compatibility alias.
|
||||
if (!accept.toLowerCase().includes('text/html') && /(?:curl|libcurl)\//i.test(agent)) {
|
||||
if (!accept.toLowerCase().includes('text/html') && /(?:curl|libcurl|wget|httpie)\//i.test(agent)) {
|
||||
return respond(release.script, 'text/plain; charset=utf-8');
|
||||
}
|
||||
if (!release.pageTemplate) return respond('Homepage unavailable.\n', 'text/plain; charset=utf-8', 503);
|
||||
|
||||
@@ -0,0 +1,78 @@
|
||||
import {parsePublicKeys} from './key-source.js';
|
||||
|
||||
// Parsing is deliberately not OpenPGP verification. The enrolled client verifies these exact bytes.
|
||||
export const SIGNED_RELEASE_LIMITS = Object.freeze({documentBytes: 1024 * 1024, signatureBytes: 64 * 1024, publicKeyBytes: 1024 * 1024, maxKeys: 1000, maxSequence: 2147483647, clockSkewSeconds: 300});
|
||||
export const SIGNATURE_SEPARATOR = '# detached-signature\n';
|
||||
export const SIGNED_BUNDLE_MAX_BYTES = SIGNED_RELEASE_LIMITS.documentBytes + SIGNED_RELEASE_LIMITS.signatureBytes + SIGNATURE_SEPARATOR.length;
|
||||
const encoder = new TextEncoder();
|
||||
const bytes = value => encoder.encode(value).length;
|
||||
const listIdPattern = /^[A-Za-z0-9._-]{1,64}$/;
|
||||
const decimal = /^(?:0|[1-9][0-9]{0,9})$/;
|
||||
|
||||
export function validateListId(value) {
|
||||
if (typeof value !== 'string' || value === '-' || !listIdPattern.test(value)) throw Error('Invalid signed release list ID.');
|
||||
return value;
|
||||
}
|
||||
export function withoutKeyComments(keys) {
|
||||
return keys.map((key, index) => ({...key, text: key.text.split(/[ \t]+/).slice(0, 2).join(' '), label: `Server key ${index + 1}`}));
|
||||
}
|
||||
export function validateSignature(signature) {
|
||||
if (typeof signature !== 'string' || bytes(signature) > SIGNED_RELEASE_LIMITS.signatureBytes || !signature.endsWith('\n') || /[^\x09\x0a\x20-\x7e]/.test(signature)) throw Error('Invalid or oversized detached signature.');
|
||||
const lines = signature.split('\n');
|
||||
if (lines.shift() !== '-----BEGIN PGP SIGNATURE-----' || lines.pop() !== '' || lines.pop() !== '-----END PGP SIGNATURE-----') throw Error('Expected one ASCII-armored PGP detached signature.');
|
||||
while (lines.length && /^[A-Za-z][A-Za-z0-9-]*: [\x20-\x7e]*$/.test(lines[0])) lines.shift();
|
||||
if (lines.shift() !== '') throw Error('Invalid PGP armor header.');
|
||||
if (lines.length && /^=[A-Za-z0-9+/]{4}$/.test(lines.at(-1))) lines.pop();
|
||||
if (!lines.length || lines.some((line, i) => !/^[A-Za-z0-9+/]{1,76}={0,2}$/.test(line) || (i !== lines.length - 1 && line.includes('=')))) throw Error('Invalid PGP armor body.');
|
||||
const payload = lines.join('');
|
||||
try { if (!atob(payload).length) throw Error(); } catch { throw Error('Invalid PGP armor encoding.'); }
|
||||
return signature;
|
||||
}
|
||||
|
||||
export async function parseSignedDocument(document, {listId, now = Math.floor(Date.now() / 1000), checkFreshness = true, signal} = {}) {
|
||||
if (typeof document !== 'string' || bytes(document) > SIGNED_RELEASE_LIMITS.documentBytes || !document.endsWith('\n')) throw Error('Invalid or oversized signed document.');
|
||||
const match = /^# conf-sshd-signed-v1\n# list-id ([A-Za-z0-9._-]{1,64})\n# sequence ([1-9][0-9]{0,9})\n# issued-at (0|[1-9][0-9]{0,9})\n# expires-at (0|[1-9][0-9]{0,9})\n# revoke (yes|no)\n# key-count (0|[1-9][0-9]{0,3})\n# end-metadata\n([\s\S]*)$/.exec(document);
|
||||
if (!match) throw Error('Invalid signed document metadata.');
|
||||
const [, parsedListId, sequenceText, issuedText, expiresText, revokeText, countText, body] = match;
|
||||
validateListId(parsedListId);
|
||||
const sequence = Number(sequenceText), issuedAt = Number(issuedText), expiresAt = Number(expiresText), keyCount = Number(countText), revoke = revokeText === 'yes';
|
||||
if (sequence > SIGNED_RELEASE_LIMITS.maxSequence || keyCount > SIGNED_RELEASE_LIMITS.maxKeys || expiresAt <= issuedAt || revoke !== (keyCount === 0)) throw Error('Inconsistent signed release policy.');
|
||||
if (listId !== undefined && parsedListId !== validateListId(listId)) throw Error('Signed release list ID mismatch.');
|
||||
if (checkFreshness && (!Number.isSafeInteger(now) || now < 0 || issuedAt > now + SIGNED_RELEASE_LIMITS.clockSkewSeconds || expiresAt <= now)) throw Error('Signed release is expired or not yet valid.');
|
||||
const keys = withoutKeyComments(await parsePublicKeys(body, {signal}));
|
||||
// Never normalize, strip comments, add padding, or alter a signed byte during verification/serving.
|
||||
if (keys.length !== keyCount || keys.map(key => key.text + '\n').join('') !== body) throw Error('Signed key body must be canonical and match its key count.');
|
||||
const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(document)));
|
||||
const documentSha256 = Array.from(digest, byte => byte.toString(16).padStart(2, '0')).join('');
|
||||
return {document, keys, metadata: {listId: parsedListId, sequence, issuedAt, expiresAt, revoke, keyCount, documentSha256}};
|
||||
}
|
||||
|
||||
export async function parseSignedBundle(bundle, options = {}) {
|
||||
if (typeof bundle !== 'string' || bytes(bundle) > SIGNED_BUNDLE_MAX_BYTES) throw Error('Invalid or oversized signed bundle.');
|
||||
const separator = bundle.indexOf(SIGNATURE_SEPARATOR);
|
||||
if (separator < 0 || bundle.indexOf(SIGNATURE_SEPARATOR, separator + SIGNATURE_SEPARATOR.length) !== -1) throw Error('Signed bundle must contain exactly one detached-signature separator.');
|
||||
const document = bundle.slice(0, separator), signature = bundle.slice(separator + SIGNATURE_SEPARATOR.length);
|
||||
validateSignature(signature);
|
||||
return {...await parseSignedDocument(document, options), signature, bundle};
|
||||
}
|
||||
|
||||
/** Prepare public bytes for an OFFLINE signer. This function never handles a private key. */
|
||||
export async function makeSignedDocument(input, {listId, sequence, issuedAt, expiresAt, revoke = false}) {
|
||||
validateListId(listId);
|
||||
for (const [name, value] of Object.entries({sequence, issuedAt, expiresAt})) if (!Number.isSafeInteger(value) || !decimal.test(String(value))) throw Error(`Invalid ${name}.`);
|
||||
if (typeof revoke !== 'boolean') throw Error('revoke must be an explicit boolean.');
|
||||
const keys = withoutKeyComments(await parsePublicKeys(input));
|
||||
const document = `# conf-sshd-signed-v1\n# list-id ${listId}\n# sequence ${sequence}\n# issued-at ${issuedAt}\n# expires-at ${expiresAt}\n# revoke ${revoke ? 'yes' : 'no'}\n# key-count ${keys.length}\n# end-metadata\n${keys.map(key => key.text + '\n').join('')}`;
|
||||
await parseSignedDocument(document, {checkFreshness: false});
|
||||
return document;
|
||||
}
|
||||
|
||||
/** A public endpoint may expose a document without a usable signature; OFF clients do not depend on it. */
|
||||
export async function parsePublishedSignedRelease(document, signature = null, options = {}) {
|
||||
const parsed = await parseSignedDocument(document, options);
|
||||
let acceptedSignature = null;
|
||||
try { if (signature !== null) acceptedSignature = validateSignature(signature); }
|
||||
catch { if (options.requireSigned) throw Error('Invalid detached signature.'); }
|
||||
if (options.requireSigned && acceptedSignature === null) throw Error('Missing detached signature.');
|
||||
return {...parsed, signature: acceptedSignature, bundle: acceptedSignature === null ? null : document + SIGNATURE_SEPARATOR + acceptedSignature};
|
||||
}
|
||||
+34
-22
@@ -1,46 +1,58 @@
|
||||
import {validateSignature} from './signed-release.js';
|
||||
|
||||
export const escapeHTML = value => String(value).replace(/[&<>"']/g, c => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[c]));
|
||||
|
||||
export function commandsFor(config) {
|
||||
const fetch = `curl -fsSL '${config.baseUrl}/script.sh' | sh -s --`;
|
||||
const installed = 'sh "$HOME/.conf-sshd/conf-sshd.sh"';
|
||||
return [
|
||||
{id:'install',title:'安装并定时同步',description:`更新当前用户的公钥并设置定时同步；保留已有自定义计划，新安装计划为 ${config.defaultCron || '*/15 * * * *'}。`,command:`${fetch} -c`},
|
||||
{id:'once',title:'仅更新一次公钥',description:'更新为当前发布的公钥，不设置定时任务。',command:`${fetch} -o`},
|
||||
{id:'help',title:'查看帮助',description:'先了解全部参数与行为，不修改配置。',command:`${fetch} -h`},
|
||||
{id:'preview',title:'预览公钥更新',description:'校验当前发布并预览将要修改的文件，不应用更新。',command:`${fetch} -o --dry-run`},
|
||||
{id:'update',title:'单独更新已安装脚本',description:'显式更新客户端脚本；定时公钥同步不会更新可执行代码。',command:'sh "$HOME/.conf-sshd/conf-sshd.sh" -u',advanced:true},
|
||||
{id:'root-off',title:'禁止 root 使用密码登录',description:'仅 root 可执行。校验并修改 SSH 配置，不自动重载服务。',command:`${fetch} -p no`,advanced:true},
|
||||
{id:'root-on',title:'允许 root 使用密码登录',description:'仅 root 可执行，涉及登录安全；实际登录仍受其他 SSH 认证设置限制，不自动重载服务。',command:`${fetch} -p yes`,advanced:true},
|
||||
{id:'uninstall',title:'停止同步并卸载',description:'移除脚本及其定时任务，保留公钥与 SSH 配置。',command:'sh "$HOME/.conf-sshd/conf-sshd.sh" --uninstall',advanced:true},
|
||||
{id:'install',title:'安装或重新安装',description:`下载并安装客户端，再同步公钥与设置计划；发现旧版本时先备份并保留本地配置。保留已有计划，新安装计划为 ${config.defaultCron || '*/15 * * * *'}。首次安装或明确重装都会信任你执行的脚本，推荐先独立核验安装脚本；启用或更换信任须在服务器本地终端确认完整指纹。`,command:`${fetch} --install --download-script -c`},
|
||||
{id:'once',title:'同步一次公钥',description:'使用已安装的固定脚本与本地信任设置同步公钥，不更换脚本或定时计划。',command:`${installed} -o`},
|
||||
{id:'help',title:'查看帮助',description:'下载当前脚本并显示参数，不建立信任；执行前仍应检查下载内容。',command:`${fetch} -h`},
|
||||
{id:'preview',title:'预览公钥同步',description:'使用已安装的脚本与本地信任设置检查更新，预览将要修改的文件，不应用更新。',command:`${installed} -o --dry-run`},
|
||||
{id:'root-off',title:'禁止 root 使用密码登录',description:'仅 root 可执行。使用已安装的脚本校验并修改 SSH 配置，不自动重载服务。',command:`${installed} -p no`,advanced:true},
|
||||
{id:'root-on',title:'允许 root 使用密码登录',description:'仅 root 可执行，涉及登录安全；实际登录仍受其他 SSH 认证设置限制，不自动重载服务。',command:`${installed} -p yes`,advanced:true},
|
||||
{id:'uninstall',title:'停止同步并卸载',description:'移除脚本及其定时任务，保留公钥与 SSH 配置。',command:`${installed} --uninstall`,advanced:true},
|
||||
];
|
||||
}
|
||||
|
||||
function codeBlock(id, text, label) {
|
||||
return `<div class="code-block"><pre tabindex="0"><code id="${id}">${escapeHTML(text)}</code></pre><button type="button" class="copy-button" data-copy-target="${id}" aria-label="${escapeHTML(label)}" title="${escapeHTML(label)}"></button></div>`;
|
||||
}
|
||||
export function renderKeys(keys) {
|
||||
return keys.length ? keys.map((key,i) => `<article class="key-card"><div class="card-heading"><h3>${escapeHTML(key.label)}</h3><span class="key-type">${escapeHTML(key.type)}</span></div><p class="fingerprint">${escapeHTML(key.fingerprint)}</p>${codeBlock(`key-${i}`,key.text,`复制第 ${i + 1} 个公钥`)}</article>`).join('\n') : '<p class="empty-state">此版本明确撤销全部受管理公钥，手工管理的公钥仍保留。</p>';
|
||||
}
|
||||
export function renderCommands(commands) {
|
||||
const card = command => `<article class="command-card"><div class="card-heading"><h3>${escapeHTML(command.title)}</h3></div><p class="command-description">${escapeHTML(command.description)}</p>${codeBlock(`command-${command.id}`,command.command,`复制“${command.title}”命令`)}</article>`;
|
||||
return commands.filter(c=>!c.advanced).map(card).join('\n') + '<details class="advanced-commands"><summary>高级命令</summary><div class="command-list">' + commands.filter(c=>c.advanced).map(card).join('\n') + '</div></details>';
|
||||
}
|
||||
|
||||
|
||||
/** All visible keys/metadata and clipboard data come from one resolved response snapshot. */
|
||||
/** The homepage projects metadata only. Key material remains confined to the APIs. */
|
||||
export function renderPage(template, snapshot) {
|
||||
const {revision, publishedAt, keys = [], commands = [], testFixture, repositoryUrl, source = {type:'repository'}} = snapshot;
|
||||
const unavailable = source.type === 'unavailable' || source.type === 'pending';
|
||||
const sourceLabel = source.type === 'fallback' ? `备用源：${source.url}` : source.type === 'explicit-empty' ? '仓库清单（明确撤销）' : unavailable ? '等待可用公钥源' : '仓库清单';
|
||||
const sourceStatus = source.type === 'fallback' ? '备用源可用' : source.type === 'explicit-empty' ? '明确撤销' : unavailable ? '暂不可用' : '可用';
|
||||
const notice = unavailable ? '公钥源暂不可用，未发布撤销指令；现有服务器保留上次成功密钥。' : source.type === 'fallback' ? '当前使用按配置顺序选中的首个有效备用源；后续请求会重新获取。' : source.type === 'explicit-empty' ? '此版本明确撤销全部受管理公钥；手工公钥与已有会话不受影响。' : '';
|
||||
const publicData = {schema:1,revision,publishedAt,keyCount:keys.length,sha256:snapshot.sha256 || null,keyRevision:snapshot.sha256 || null,source,sourceStatus,keys,commands,baseUrl:snapshot.baseUrl,repositoryUrl,testFixture:Boolean(testFixture)};
|
||||
const revoked = source.type === 'explicit-empty' || (!unavailable && snapshot.allowEmpty === true && (snapshot.keyCount ?? keys.length) === 0);
|
||||
const sourceLabel = source.type === 'fallback' ? `备用源：${source.url}` : source.type === 'gist' ? `Gist：${source.url || '已配置来源'}` : source.type === 'git' ? `Git：${source.url || '已配置来源'}` : unavailable ? '等待可用公钥源' : 'Git 仓库清单';
|
||||
const sourceStatus = source.type === 'pending' ? '待获取' : source.type === 'unavailable' ? '暂不可用' : revoked ? '明确撤销' : source.type === 'fallback' ? '备用源可用' : '可用';
|
||||
const notice = unavailable ? '公钥源暂不可用，未发布撤销指令；现有服务器保留上次成功密钥。' : revoked ? '此发布明确撤销全部受管理公钥；客户端仍须按本地信任设置验证，手工公钥与已有会话不受影响。' : source.type === 'fallback' ? '当前使用按配置顺序选中的首个有效备用源；后续请求会重新获取，来源可用不表示客户端已验证。' : '此处仅展示来源与发布元数据；是否接受公钥，由服务器上的客户端按本地信任设置判断。';
|
||||
// Presence is distinct from parsed document metadata and from cryptographic trust.
|
||||
let signaturePresent = false;
|
||||
if (!unavailable) {
|
||||
if (typeof snapshot.signatureAvailable === 'boolean') signaturePresent = snapshot.signatureAvailable;
|
||||
else if (snapshot.signedDocument && snapshot.keysText === snapshot.signedDocument) {
|
||||
try { signaturePresent = Boolean(validateSignature(snapshot.signature)); } catch { /* No usable detached signature. */ }
|
||||
}
|
||||
}
|
||||
const certificatePresent = typeof snapshot.publicCertificateAvailable === 'boolean' ? snapshot.publicCertificateAvailable : typeof snapshot.publicCertificate === 'string' && snapshot.publicCertificate.length > 0;
|
||||
const certificateStatus = certificatePresent ? '公开证书已提供（安装时核验）' : '未提供公开证书';
|
||||
const signatureStatus = signaturePresent ? '签名包已提供（待客户端验证）' : '未提供签名包';
|
||||
const keyCount = unavailable ? 0 : (snapshot.keyCount ?? keys.length);
|
||||
const publicSource = {type:source.type, ...(source.url ? {url:source.url} : {})};
|
||||
const publicData = {schema:2,revision,publishedAt,keyCount,sha256:snapshot.sha256 || null,keyRevision:snapshot.keyRevision || snapshot.sha256 || null,source:publicSource,sourceStatus,signaturePresent,signatureStatus,certificatePresent,certificateStatus,repositoryUrl,testFixture:Boolean(testFixture)};
|
||||
const replacements = {
|
||||
RELEASE_JSON:JSON.stringify(publicData).replace(/</g,'\\u003c').replace(/\u2028/g,'\\u2028').replace(/\u2029/g,'\\u2029'),
|
||||
KEYS_HTML:unavailable ? '<p class="empty-state">当前无法获取有效公钥。请稍后重试或检查备用源配置。</p>' : renderKeys(keys),
|
||||
COMMANDS_HTML:renderCommands(commands),REVISION:escapeHTML(revision.slice(0,12)),PUBLISHED_AT:escapeHTML(publishedAt),KEY_COUNT:String(keys.length),
|
||||
REPOSITORY_URL:escapeHTML(repositoryUrl),RELEASE_LABEL:testFixture ? '测试预览' : unavailable ? '公钥暂不可用' : '已发布',
|
||||
PREVIEW_NOTICE:testFixture ? '<p class="preview-notice" role="note">测试预览：这里使用公开测试密钥，不能部署到真实服务器。</p>' : '',
|
||||
SOURCE_LABEL:escapeHTML(sourceLabel),SOURCE_STATUS:escapeHTML(sourceStatus),CONTENT_REVISION:escapeHTML(snapshot.sha256?.slice(0,12) || '—'),KEYS_NOTICE:escapeHTML(notice),
|
||||
COMMANDS_HTML:renderCommands(commands),REVISION:escapeHTML(revision.slice(0,12)),PUBLISHED_AT:escapeHTML(publishedAt),KEY_COUNT:String(keyCount),
|
||||
REPOSITORY_URL:escapeHTML(repositoryUrl),RELEASE_LABEL:testFixture ? '测试预览' : unavailable ? '等待发布源' : '发布元数据',
|
||||
PREVIEW_NOTICE:testFixture ? '<p class="preview-notice" role="note">测试预览：这里使用公开测试数据，不能部署到真实服务器。</p>' : '',
|
||||
CERTIFICATE_LINK:certificatePresent ? '<a class="text-link" href="/public-key.gpg">公开签名证书 <span aria-hidden="true">↗</span></a>' : '',
|
||||
SOURCE_LABEL:escapeHTML(sourceLabel),SOURCE_STATUS:escapeHTML(sourceStatus),SIGNATURE_STATUS:escapeHTML(signatureStatus),CERTIFICATE_STATUS:escapeHTML(certificateStatus),CONTENT_REVISION:escapeHTML((snapshot.keyRevision || snapshot.sha256)?.slice(0,12) || '—'),KEYS_NOTICE:escapeHTML(notice),
|
||||
};
|
||||
return template.replace(/@@([A-Z_]+)@@/g, (_, token) => {
|
||||
if (!Object.hasOwn(replacements, token)) throw Error(`Unresolved page template token: ${token}`);
|
||||
|
||||
+730
-32
@@ -1,8 +1,14 @@
|
||||
#!/bin/sh
|
||||
# conf-sshd-script-v2
|
||||
# conf-sshd-client-security-v1
|
||||
# Generated configuration. Never source or eval downloaded data.
|
||||
BASE_URL='@@BASE_URL@@'
|
||||
DEFAULT_CRON='@@DEFAULT_CRON@@'
|
||||
DEFAULT_GPG_VERIFY='@@DEFAULT_GPG_VERIFY@@'
|
||||
DEFAULT_GPG_FINGERPRINT='@@DEFAULT_GPG_FINGERPRINT@@'
|
||||
DEFAULT_GPG_PIN_MODE='@@DEFAULT_GPG_PIN_MODE@@'
|
||||
DEFAULT_LIST_ID='@@DEFAULT_LIST_ID@@'
|
||||
DEFAULT_GPG_EMAIL='@@DEFAULT_GPG_EMAIL@@'
|
||||
|
||||
set -eu
|
||||
umask 077
|
||||
@@ -22,6 +28,23 @@ temps=
|
||||
lock_owned=no
|
||||
created_state=no
|
||||
created_ssh=no
|
||||
gpg_home=
|
||||
download_script=no
|
||||
requested_verification=
|
||||
config_prepared=no
|
||||
validation_only=no
|
||||
enforce_freshness=yes
|
||||
replace_pending=no
|
||||
public_key_file=
|
||||
requested_fingerprint=
|
||||
requested_pin_mode=
|
||||
requested_list_id=
|
||||
requested_min_sequence=
|
||||
fallback_urls_file=
|
||||
primary_url=
|
||||
requested_email=
|
||||
requested_keyservers=
|
||||
trust_options=no
|
||||
|
||||
say() { printf '%s\n' "$*"; }
|
||||
fail() { printf 'conf-sshd: %s\n' "$*" >&2; exit 1; }
|
||||
@@ -32,7 +55,25 @@ Usage: sh conf-sshd.sh [options]
|
||||
-c, --cron ["five fields"|false] Sync and schedule; bare -c keeps an existing
|
||||
schedule, otherwise the configured default.
|
||||
-c false only removes this script's schedule.
|
||||
-u, --update-self Explicitly update the installed script only
|
||||
--install Install/reinstall this trusted local file;
|
||||
retain local trust, URLs and existing schedule.
|
||||
--download-script With --install: HTTPS bootstrap/reinstall from
|
||||
Worker (explicit invocation only; never cron).
|
||||
--gpg-verification on|off Explicitly enroll/change persisted verification;
|
||||
default from repository, existing config wins
|
||||
--gpg-required, --gpg-off Aliases for --gpg-verification on/off
|
||||
--gpg-fingerprint FULL40HEX Independently verified full fingerprint
|
||||
--gpg-pin-mode primary|subkey Primary (default) trusts its valid signing
|
||||
subkeys; subkey permits only that exact subkey
|
||||
--public-key-file FILE Explicit independently verified local certificate;
|
||||
supersedes cached/discovered certificate
|
||||
--list-id ID Required signed-list identity
|
||||
--min-sequence N Enrollment floor, default 1; never lowers state
|
||||
--gpg-email EMAIL Optional WKD identity during explicit install
|
||||
--keyserver HKPS_URL Override built-in ordered keyservers (repeat)
|
||||
--primary-url HTTPS_URL Local first key endpoint; defaults to Worker
|
||||
--fallback-urls-file FILE Ordered one-HTTPS-endpoint-per-line fallbacks
|
||||
-u, --update-self Refused: reinstall explicitly with --install
|
||||
--uninstall Remove own schedule/script; preserve keys/config
|
||||
-p, --allow-root-passwd yes|no Explicit root-only sshd_config edit; never reload
|
||||
-n, --no-install-sshd Compatibility flag; packages are never installed
|
||||
@@ -41,6 +82,29 @@ Usage: sh conf-sshd.sh [options]
|
||||
-h, --help Show this help
|
||||
|
||||
-u, --uninstall, -p and --status are exclusive operations. -o cannot use -c or -p.
|
||||
Trust/URL changes require explicit installation, or keys-only -o enrollment.
|
||||
--install -c also schedules; --install always validates and syncs keys.
|
||||
Running an installer from Worker explicitly trusts that bootstrap code. For higher
|
||||
assurance, verify a downloaded file against an independently obtained SHA-256.
|
||||
No installed script updates itself: cron runs only -o. Ordinary initial -c may
|
||||
bootstrap from Worker over HTTPS; --install --download-script explicitly repeats
|
||||
that bootstrap. HTTPS bootstrap trusts Worker and the transport at install time.
|
||||
During enrollment, approve the full fingerprint and scope in your terminal.
|
||||
No noninteractive trust-confirmation bypass is supported. Certificate discovery:
|
||||
local public keyring, Worker /public-key.gpg, optional email WKD, then ordered
|
||||
HKPS keyservers. Each candidate must match the complete primary/subkey pin.
|
||||
Keyserver/WKD operators may learn the queried fingerprint/email and your IP.
|
||||
A dedicated public-only certificate is saved locally; normal sync uses only it,
|
||||
with no keyserver, WKD or certificate refresh. Reinstall reuses a valid local
|
||||
certificate; --public-key-file explicitly supplies a verified replacement.
|
||||
Built-in keyservers: hkps://keys.openpgp.org, hkps://keyserver.ubuntu.com.
|
||||
A distributor can replay an old matching certificate that omits a revocation;
|
||||
fingerprint pinning does not prove certificate freshness.
|
||||
Strict mode needs GnuPG and a correct clock. A missing rollback-state file fails
|
||||
closed. With --min-sequence omitted, initial enrollment cannot detect a previously
|
||||
published, still-unexpired release being replayed; obtain a current floor out of band.
|
||||
Expired/invalid responses retain last installed keys; expiry is not automatic revocation.
|
||||
Local state uses atomic renames and a pending journal, not a power-loss fsync guarantee.
|
||||
Requires curl, ssh-keygen, awk, standard POSIX tools, mktemp, stat, and one of
|
||||
sha256sum, shasum or openssl. Scheduling also requires crontab. Downloads require
|
||||
HTTPS; existing keys survive any validation/download failure.
|
||||
@@ -61,6 +125,30 @@ while [ "$#" -gt 0 ]; do
|
||||
usage; exit 0 ;;
|
||||
-o|--only-update-keys) select_mode keys ;;
|
||||
-u|--update-self) select_mode update ;;
|
||||
--install) select_mode install ;;
|
||||
--download-script) [ "$download_script" = no ] || fail 'Duplicate --download-script.'; download_script=yes ;;
|
||||
--gpg-required|--gpg-off)
|
||||
[ -z "$requested_verification" ] || fail 'Duplicate GPG verification option.'
|
||||
if [ "$1" = --gpg-required ]; then requested_verification=on; else requested_verification=off; fi
|
||||
trust_options=yes ;;
|
||||
--gpg-verification|--public-key-file|--fingerprint|--gpg-fingerprint|--gpg-pin-mode|--gpg-email|--keyserver|--list-id|--min-sequence|--fallback-urls-file|--primary-url)
|
||||
option=$1
|
||||
[ "$#" -ge 2 ] && [ -n "$2" ] || fail "$option requires a value."
|
||||
shift
|
||||
case $option in
|
||||
--gpg-verification) [ -z "$requested_verification" ] || fail "Duplicate $option."; requested_verification=$1 ;;
|
||||
--public-key-file) [ -z "$public_key_file" ] || fail "Duplicate $option."; public_key_file=$1 ;;
|
||||
--fingerprint|--gpg-fingerprint) [ -z "$requested_fingerprint" ] || fail "Duplicate $option."; requested_fingerprint=$1 ;;
|
||||
--gpg-pin-mode) [ -z "$requested_pin_mode" ] || fail "Duplicate $option."; requested_pin_mode=$1 ;;
|
||||
--list-id) [ -z "$requested_list_id" ] || fail "Duplicate $option."; requested_list_id=$1 ;;
|
||||
--min-sequence) [ -z "$requested_min_sequence" ] || fail "Duplicate $option."; requested_min_sequence=$1 ;;
|
||||
--fallback-urls-file) [ -z "$fallback_urls_file" ] || fail "Duplicate $option."; fallback_urls_file=$1 ;;
|
||||
--primary-url) [ -z "$primary_url" ] || fail "Duplicate $option."; primary_url=$1 ;;
|
||||
--gpg-email) [ -z "$requested_email" ] || fail "Duplicate $option."; requested_email=$1 ;;
|
||||
--keyserver) requested_keyservers="$requested_keyservers$1
|
||||
" ;;
|
||||
esac
|
||||
trust_options=yes ;;
|
||||
--uninstall) select_mode uninstall ;;
|
||||
--status) select_mode status ;;
|
||||
-p|--allow-root-passwd)
|
||||
@@ -79,7 +167,11 @@ while [ "$#" -gt 0 ]; do
|
||||
esac
|
||||
shift
|
||||
done
|
||||
[ "$cron_requested" = no ] || [ "$mode" = sync ] || fail '-c cannot be combined with this operation.'
|
||||
[ "$cron_requested" = no ] || [ "$mode" = sync ] || [ "$mode" = install ] || fail '-c cannot be combined with this operation.'
|
||||
[ "$trust_options" = no ] || [ "$mode" = install ] || [ "$mode" = keys ] || [ "$mode" = sync ] || fail 'Trust and URL settings require explicit installation or keys-only enrollment.'
|
||||
case $requested_verification in ''|on|off) : ;; *) fail '--gpg-verification requires on or off.' ;; esac
|
||||
[ "$download_script" = no ] || [ "$mode" = install ] || fail '--download-script requires --install.'
|
||||
[ "$mode" != update ] || fail 'Remote self-update is disabled. Download and independently verify a local script, then run sh ./conf-sshd.sh --install. Explicit HTTPS bootstrap may use --install --download-script.'
|
||||
|
||||
need() { command -v "$1" >/dev/null 2>&1 || fail "Missing dependency: $1. Install it explicitly before continuing."; }
|
||||
for dep in awk cat chmod cmp cp dd grep id mkdir mktemp mv od rm rmdir sed stat tail tr wc; do need "$dep"; done
|
||||
@@ -94,6 +186,10 @@ state=$HOME/.conf-sshd
|
||||
ssh_dir=$HOME/.ssh
|
||||
auth_file=$ssh_dir/authorized_keys
|
||||
target_script=$state/conf-sshd.sh
|
||||
local_config=$state/local.conf
|
||||
replay_state=$state/replay.state
|
||||
pending_bundle=$state/pending.bundle
|
||||
pending_state=$state/pending.state
|
||||
|
||||
# GNU/Linux and BSD/macOS stat. No filesystem changes precede ownership checks.
|
||||
if stat -c '%u %a %h' "$HOME" >/dev/null 2>&1; then
|
||||
@@ -124,6 +220,10 @@ check_path "$state" dir
|
||||
check_path "$ssh_dir" dir
|
||||
check_path "$auth_file" file
|
||||
check_path "$target_script" file
|
||||
check_path "$local_config" file
|
||||
check_path "$replay_state" file
|
||||
check_path "$pending_bundle" file
|
||||
check_path "$pending_state" file
|
||||
|
||||
validate_cron() {
|
||||
printf '%s\n' "$1" | awk '
|
||||
@@ -151,12 +251,16 @@ if [ "$cron_requested" = yes ] && [ -n "$cron_value" ] && [ "$cron_value" != fal
|
||||
fi
|
||||
|
||||
cleanup() {
|
||||
result=$?
|
||||
result=${1:-$?}
|
||||
trap - 0 HUP INT TERM
|
||||
old_ifs=$IFS; IFS='
|
||||
'
|
||||
for path in $temps; do rm -f "$path"; done
|
||||
IFS=$old_ifs
|
||||
if [ -n "$gpg_home" ]; then
|
||||
if command -v gpgconf >/dev/null 2>&1; then gpgconf --homedir "$gpg_home" --kill all >/dev/null 2>&1 || :; fi
|
||||
rm -rf "$gpg_home"
|
||||
fi
|
||||
if [ "$lock_owned" = yes ]; then rm -f "$state/lock/pid"; rmdir "$state/lock" 2>/dev/null || :; fi
|
||||
if [ "$dry_run" = yes ] || [ "$mode" = uninstall ]; then
|
||||
if [ "$created_ssh" = yes ]; then rmdir "$ssh_dir" 2>/dev/null || :; fi
|
||||
@@ -206,14 +310,22 @@ fi
|
||||
validate_build() {
|
||||
printf '%s\n' "$BASE_URL" | grep -Eq '^https://([A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?|\[[0-9A-Fa-f:]+\])(:[0-9]{1,5})?$' || fail 'BASE_URL must be a configured HTTPS origin.'
|
||||
validate_cron "$DEFAULT_CRON" >/dev/null || fail 'Invalid or unbuilt default cron configuration.'
|
||||
case $DEFAULT_GPG_VERIFY in on|off) : ;; *) fail 'Invalid or unbuilt default GPG verification mode.' ;; esac
|
||||
case $DEFAULT_GPG_PIN_MODE in primary|subkey) : ;; *) fail 'Invalid or unbuilt default pin mode.' ;; esac
|
||||
if [ "$DEFAULT_GPG_VERIFY" = on ]; then
|
||||
printf '%s\n' "$DEFAULT_GPG_FINGERPRINT" | grep -Eq '^[0-9A-Fa-f]{40}$' || fail 'Invalid default GPG fingerprint.'
|
||||
printf '%s\n' "$DEFAULT_LIST_ID" | grep -Eq '^[A-Za-z0-9._-]{1,64}$' || fail 'Invalid default signed list ID.'
|
||||
fi
|
||||
}
|
||||
download() {
|
||||
need curl
|
||||
# No redirects: a configured origin must serve these endpoints directly.
|
||||
curl --fail --silent --show-error --proto '=https' --tlsv1.2 \
|
||||
--connect-timeout 10 --max-time 30 --retry 2 --retry-delay 1 \
|
||||
--retry-max-time 65 --max-filesize 1048576 --output "$2" "$1" || fail "Download failed: $1 (existing files unchanged)."
|
||||
[ "$(wc -c < "$2" | tr -d ' ')" -le 1048576 ] || fail 'Downloaded response is too large.'
|
||||
download_limit=${3:-1048576}
|
||||
# No redirects. Partial/error bodies are never parsed as a successful source.
|
||||
http_status=$(curl --disable --fail --silent --show-error --proto '=https' --tlsv1.2 \
|
||||
--connect-timeout 10 --max-time 30 --retry 0 \
|
||||
--max-filesize "$download_limit" --output "$2" --write-out '%{http_code}' "$1") || return 1
|
||||
[ "$http_status" = 200 ] || return 1
|
||||
[ "$(wc -c < "$2" | tr -d ' ')" -le "$download_limit" ]
|
||||
}
|
||||
sha256() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
|
||||
@@ -249,20 +361,30 @@ replace_file() {
|
||||
mv -f "$staged" "$destination"
|
||||
}
|
||||
validate_script() {
|
||||
sh -n "$1" || fail 'Downloaded script has invalid shell syntax.'
|
||||
[ "$(grep -Fxc '# conf-sshd-script-v2' "$1" || :)" = 1 ] || fail 'Downloaded script is missing its unique version marker.'
|
||||
[ "$(grep -Fxc "BASE_URL='$BASE_URL'" "$1" || :)" = 1 ] || fail 'Downloaded script changed its configured origin.'
|
||||
[ "$(grep -Fxc "DEFAULT_CRON='$DEFAULT_CRON'" "$1" || :)" = 1 ] || fail 'Downloaded script has invalid default cron configuration.'
|
||||
if grep -Eq '@@[A-Z_]+@@' "$1"; then fail 'Downloaded script contains unexpanded build tokens.'; fi
|
||||
sh -n "$1" || fail 'Installer script has invalid shell syntax.'
|
||||
[ "$(grep -Fxc '# conf-sshd-script-v2' "$1" || :)" = 1 ] || fail 'Installer script is missing its unique version marker.'
|
||||
[ "$(grep -Fxc '# conf-sshd-client-security-v1' "$1" || :)" = 1 ] || fail 'Installer script lacks the fixed-client security version marker.'
|
||||
[ "$(grep -Fxc "BASE_URL='$BASE_URL'" "$1" || :)" = 1 ] || fail 'Installer script changed its configured origin.'
|
||||
[ "$(grep -Fxc "DEFAULT_CRON='$DEFAULT_CRON'" "$1" || :)" = 1 ] || fail 'Installer script has invalid default cron configuration.'
|
||||
if grep -Eq '@@[A-Z_]+@@' "$1"; then fail 'Installer script contains unexpanded build tokens.'; fi
|
||||
}
|
||||
install_script() {
|
||||
prepare_script() {
|
||||
validate_build
|
||||
new_temp "$state"; script_tmp=$TEMP
|
||||
# In a piped invocation $0 can name an unrelated cwd file. Always fetch the
|
||||
# configured origin, rather than guessing whether $0 is this script.
|
||||
download "$BASE_URL/script.sh" "$script_tmp"
|
||||
if [ "$download_script" = yes ] || [ "$mode" != install ]; then
|
||||
download "$BASE_URL/script.sh" "$script_tmp" || fail 'Installer download failed; existing script is unchanged.'
|
||||
else
|
||||
case $0 in /*|./*|../*) : ;; *) fail '--install requires an unambiguous local file path (sh ./conf-sshd.sh), or ordinary --download-script.' ;; esac
|
||||
case $0 in /dev/*|/proc/*|/sys/*) fail '--install cannot use stdin, a pipe, or a device file.' ;; esac
|
||||
check_path "$0" file
|
||||
[ -f "$0" ] || fail '--install requires a real local script file.'
|
||||
cp "$0" "$script_tmp"
|
||||
fi
|
||||
validate_script "$script_tmp"
|
||||
}
|
||||
install_script() {
|
||||
replace_file "$target_script" "$script_tmp" 700
|
||||
say 'Installed local script. Scheduled runs update keys only.'
|
||||
}
|
||||
|
||||
# Rewrite only an exact paired managed block or the exact known legacy command.
|
||||
@@ -327,11 +449,7 @@ apply_cron() {
|
||||
say "Managed cron set: $1"
|
||||
}
|
||||
|
||||
sync_keys() {
|
||||
need ssh-keygen
|
||||
validate_build
|
||||
new_temp "$state"; response=$TEMP
|
||||
download "$BASE_URL/ssh.keys" "$response"
|
||||
validate_legacy_response() {
|
||||
last_lf "$response" || fail 'Key response must end with LF.'
|
||||
new_temp "$state"; invalid_bytes=$TEMP
|
||||
tr -d '\012\040-\176\200-\377' < "$response" > "$invalid_bytes"
|
||||
@@ -354,8 +472,12 @@ sync_keys() {
|
||||
[ "$(sha256 "$payload")" = "$expected_hash" ] || fail 'Payload SHA-256 mismatch.'
|
||||
[ "$(wc -l < "$payload" | tr -d ' ')" = "$key_count" ] || fail 'Payload key count mismatch.'
|
||||
if [ "$key_count" = 0 ]; then [ "$allow_empty" = yes ] || fail 'Empty key set was not explicitly allowed.'; fi
|
||||
awk '
|
||||
validate_payload
|
||||
}
|
||||
validate_payload() {
|
||||
awk -v strict="$policy" '
|
||||
{
|
||||
if(strict=="required" && NF!=2) exit 1
|
||||
if($0 ~ /[ \t]$/ || $0 !~ /^[^ ]+ [^ ]+( [^ ].*)?$/ || NF<2) exit 1
|
||||
if($1!="ssh-ed25519" && $1!="ssh-rsa" && $1!="ecdsa-sha2-nistp256" && $1!="ecdsa-sha2-nistp384" && $1!="ecdsa-sha2-nistp521" && $1!="[email protected]" && $1!="[email protected]") exit 1
|
||||
if($2 !~ /^[A-Za-z0-9+\/]+={0,2}$/) {
|
||||
@@ -377,6 +499,8 @@ sync_keys() {
|
||||
[ "$bits" -ge 2048 ] || fail 'RSA keys must be at least 2048 bits.' ;;
|
||||
esac
|
||||
done < "$payload"
|
||||
}
|
||||
apply_payload() {
|
||||
[ -d "$ssh_dir" ] || { mkdir "$ssh_dir"; created_ssh=yes; }
|
||||
# Existing secure directory permissions need not be changed in dry-run mode.
|
||||
if [ "$dry_run" = no ]; then chmod 700 "$ssh_dir"; fi
|
||||
@@ -478,30 +602,604 @@ edit_sshd_config() {
|
||||
[ "$root_password" != yes ] || say 'PermitRootLogin yes does not enable PasswordAuthentication if it is disabled elsewhere.'
|
||||
}
|
||||
|
||||
# All persistent policy/state is a data format with a strict parser, never shell code.
|
||||
validate_url() {
|
||||
[ "${#1}" -le 2048 ] || return 1
|
||||
printf '%s\n' "$1" | grep -Eq '^https://([A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?|\[[0-9A-Fa-f:]+\])(:[0-9]{1,5})?(/[!-~]*)?$' || return 1
|
||||
case $1 in *'?'*|*'#'*|*'\'*) return 1 ;; esac
|
||||
}
|
||||
strict_text() {
|
||||
last_lf "$1" || fail 'Local data must end with LF.'
|
||||
new_temp "$state"; invalid_local=$TEMP
|
||||
tr -d '\012\040-\176' < "$1" > "$invalid_local"
|
||||
[ ! -s "$invalid_local" ] || fail 'Local data contains non-ASCII or control bytes.'
|
||||
}
|
||||
validate_urls() {
|
||||
[ -s "$1" ] || fail 'At least one source URL is required.'
|
||||
[ "$(wc -l < "$1" | tr -d ' ')" -le 6 ] || fail 'At most six source URLs (primary plus five fallbacks) are allowed.'
|
||||
while IFS= read -r source_url; do
|
||||
validate_url "$source_url" || fail 'Invalid HTTPS source URL; query strings, fragments and credentials are unsupported.'
|
||||
done < "$1"
|
||||
awk 'seen[$0]++ {exit 1}' "$1" || fail 'Duplicate source URL.'
|
||||
}
|
||||
load_local_config() {
|
||||
policy=off
|
||||
list_id=-
|
||||
pinned_fingerprint=-
|
||||
pin_mode=primary
|
||||
gpg_email=-
|
||||
keyservers="hkps://keys.openpgp.org
|
||||
hkps://keyserver.ubuntu.com"
|
||||
config_snapshot=absent
|
||||
new_temp "$state"; urls=$TEMP
|
||||
printf '%s/ssh.keys\n' "$BASE_URL" > "$urls"
|
||||
if [ -f "$local_config" ]; then
|
||||
new_temp "$state"; config_snapshot=$TEMP
|
||||
cp "$local_config" "$config_snapshot"
|
||||
[ "$(wc -c < "$config_snapshot" | tr -d ' ')" -le 40000 ] || fail 'Local configuration is too large.'
|
||||
strict_text "$config_snapshot"
|
||||
awk '
|
||||
NR==1 { if($0!="conf-sshd-local-v1") exit 1 }
|
||||
NR==2 { if($0!="policy off" && $0!="policy required") exit 1; p=$2 }
|
||||
NR==3 { if($0!="list-id " $2 || $2 ~ /[^A-Za-z0-9._-]/ || length($2)<1 || length($2)>64) exit 1; l=$2 }
|
||||
NR==4 { if($0!="fingerprint " $2) exit 1; f=$2
|
||||
if(p=="required" && (length(f)!=40 || f ~ /[^0-9A-F]/ || l=="-")) exit 1
|
||||
if(p=="off" && !((f=="-" && l=="-") || (length(f)==40 && f !~ /[^0-9A-F]/ && l!="-"))) exit 1 }
|
||||
NR==5 {if($0!="pin-mode primary" && $0!="pin-mode subkey") exit 1; if(f=="-" && $2!="primary") exit 1}
|
||||
NR==6 { if($0!="email " $2 || $2=="") exit 1 }
|
||||
NR>6 { if(substr($0,1,4)=="url ") {u++; if(k) exit 1} else if(substr($0,1,10)=="keyserver ") k++; else exit 1 }
|
||||
END { if(NR<8 || NR>16 || u<1 || u>6 || k<1 || k>4) exit 1 }
|
||||
' "$config_snapshot" || fail 'Malformed local configuration; refusing to guess or downgrade.'
|
||||
policy=$(sed -n '2s/^policy //p' "$config_snapshot")
|
||||
list_id=$(sed -n '3s/^list-id //p' "$config_snapshot")
|
||||
pinned_fingerprint=$(sed -n '4s/^fingerprint //p' "$config_snapshot")
|
||||
pin_mode=$(sed -n '5s/^pin-mode //p' "$config_snapshot")
|
||||
gpg_email=$(sed -n '6s/^email //p' "$config_snapshot")
|
||||
keyservers=$(sed -n '7,$s/^keyserver //p' "$config_snapshot")
|
||||
sed -n '7,$s/^url //p' "$config_snapshot" > "$urls"
|
||||
elif [ -e "$replay_state" ] || [ -e "$pending_state" ] || [ -e "$pending_bundle" ]; then
|
||||
fail 'Local policy is missing while security state exists; refusing an implicit downgrade.'
|
||||
fi
|
||||
validate_urls "$urls"
|
||||
validate_discovery_settings
|
||||
if [ "$policy" = required ] && [ "$mode" != uninstall ] && [ "$mode" != config ] && [ "$cron_value" != false ] && [ "$requested_verification" != off ]; then
|
||||
trust_key=$state/trust-$pinned_fingerprint-$pin_mode.asc
|
||||
check_path "$trust_key" file
|
||||
[ -f "$trust_key" ] || [ "$mode" = install ] || [ "$trust_options" = yes ] || fail 'Dedicated pinned certificate is missing; reinstall explicitly to recover it.'
|
||||
[ -f "$replay_state" ] || fail 'Rollback state is missing after enrollment; refusing silent bootstrap.'
|
||||
fi
|
||||
}
|
||||
new_gpg_home() {
|
||||
need gpg
|
||||
if [ -z "$gpg_home" ]; then
|
||||
gpg_home=$(mktemp -d "$state/.conf-sshd-gpg.XXXXXX") || fail 'Cannot create isolated GnuPG directory.'
|
||||
chmod 700 "$gpg_home"
|
||||
fi
|
||||
}
|
||||
gpg_local() {
|
||||
gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart \
|
||||
--no-auto-key-retrieve --auto-key-locate clear --no-default-keyring \
|
||||
--keyring "$gpg_home/pinned.gpg" "$@"
|
||||
}
|
||||
import_pinned_key() {
|
||||
new_gpg_home
|
||||
[ "$(wc -c < "$1" | tr -d ' ')" -le 1048576 ] || fail 'Public key file exceeds 1 MiB.'
|
||||
new_temp "$state"; key_description=$TEMP
|
||||
gpg_local --with-colons --show-keys "$1" > "$key_description" 2>/dev/null || fail 'Cannot inspect local OpenPGP public key.'
|
||||
current_time=$(date +%s)
|
||||
temps="$temps
|
||||
$key_description.primary"
|
||||
awk -F: -v pin="$pinned_fingerprint" -v mode="$pin_mode" -v now="$current_time" '
|
||||
$1=="sec" || $1=="ssb" { bad=1 }
|
||||
$1=="pub" || $1=="sub" {
|
||||
kind=$1; valid=($2 !~ /[redi]/ && ($7=="" || $7+0>now)); signing=($12 ~ /[sS]/)
|
||||
if(kind=="pub" && (++p!=1 || !valid)) bad=1
|
||||
want=1; next
|
||||
}
|
||||
$1=="fpr" && want {
|
||||
if(kind=="pub") primary=$10
|
||||
if($10==pin && ((mode=="primary" && kind=="pub") || (mode=="subkey" && kind=="sub"))) {matched++; if(!valid || !signing) bad=1}
|
||||
want=0
|
||||
}
|
||||
END {if(bad || p!=1 || matched!=1 || length(primary)!=40 || primary ~ /[^0-9A-F]/) exit 1; print primary}
|
||||
' "$key_description" > "$key_description.primary" || fail 'Certificate must contain exactly one current primary and the expected current primary/subkey fingerprint, with no secret keys.'
|
||||
certificate_primary=$(cat "$key_description.primary")
|
||||
gpg_local --yes --dearmor --output "$gpg_home/pinned.gpg" "$1" >/dev/null 2>&1 || fail 'Cannot prepare isolated public-only certificate keyring.'
|
||||
}
|
||||
validate_discovery_settings() {
|
||||
if [ "$gpg_email" != - ]; then
|
||||
[ "${#gpg_email}" -le 254 ] && printf '%s\n' "$gpg_email" | grep -Eq '^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}$' || fail 'Invalid WKD email address.'
|
||||
fi
|
||||
new_temp "$state"; server_list=$TEMP
|
||||
printf '%s\n' "$keyservers" > "$server_list"
|
||||
[ "$(wc -l < "$server_list" | tr -d ' ')" -le 4 ] || fail 'At most four keyservers are permitted.'
|
||||
while IFS= read -r server; do
|
||||
printf '%s\n' "$server" | grep -Eq '^hkps://[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?(:[0-9]{1,5})?$' || fail 'Keyservers must be explicit HKPS origins.'
|
||||
done < "$server_list"
|
||||
}
|
||||
reset_gpg_home() {
|
||||
if [ -n "$gpg_home" ]; then
|
||||
# Kill only services belonging to our private transient home, if any.
|
||||
if command -v gpgconf >/dev/null 2>&1; then gpgconf --homedir "$gpg_home" --kill all >/dev/null 2>&1 || :; fi
|
||||
rm -rf "$gpg_home"
|
||||
gpg_home=
|
||||
fi
|
||||
new_gpg_home
|
||||
}
|
||||
accept_certificate_candidate() {
|
||||
# A separate clean keyring per discovery candidate prevents unrelated keys
|
||||
# or a rejected certificate from contaminating the final verifier.
|
||||
reset_gpg_home
|
||||
new_temp "$state"; candidate_export=$TEMP
|
||||
if ( lock_owned=no; created_state=no; created_ssh=no; temps=;
|
||||
trap 'candidate_result=$?; gpg_home=; cleanup "$candidate_result"' 0
|
||||
import_pinned_key "$1"
|
||||
gpg_local --armor --export "$certificate_primary" > "$candidate_export" || fail 'Candidate certificate cannot be exported by this GnuPG version.'
|
||||
[ -s "$candidate_export" ] && [ "$(wc -c < "$candidate_export" | tr -d ' ')" -le 1048576 ] || fail 'Candidate public certificate export is empty or oversized.' ); then
|
||||
import_pinned_key "$candidate_export"
|
||||
staged_trust=$candidate_export
|
||||
trust_key=$state/trust-$pinned_fingerprint-$pin_mode.asc
|
||||
check_path "$trust_key" file
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
lookup_bounded() {
|
||||
now=$(date +%s)
|
||||
remaining=$((discovery_deadline - now))
|
||||
[ "$remaining" -gt 0 ] || return 1
|
||||
if [ "$remaining" -gt 15 ]; then remaining=15; fi
|
||||
if command -v timeout >/dev/null 2>&1; then timeout -k 2 "$remaining" "$@"
|
||||
elif command -v gtimeout >/dev/null 2>&1; then gtimeout -k 2 "$remaining" "$@"
|
||||
else say 'Skipping WKD/keyserver lookup: a timeout or gtimeout utility is required.' >&2; return 1; fi
|
||||
}
|
||||
discover_certificate() {
|
||||
discovery_deadline=$(($(date +%s) + 120))
|
||||
new_temp "$state"; candidate=$TEMP
|
||||
if [ -n "$public_key_file" ]; then
|
||||
check_path "$public_key_file" file
|
||||
[ -f "$public_key_file" ] || fail 'Local public key file does not exist.'
|
||||
accept_certificate_candidate "$public_key_file" || fail 'Explicit certificate failed validation; refusing to fall back to a possibly stale certificate.'
|
||||
return
|
||||
fi
|
||||
existing_trust=$state/trust-$pinned_fingerprint-$pin_mode.asc
|
||||
check_path "$existing_trust" file
|
||||
if [ -f "$existing_trust" ]; then
|
||||
accept_certificate_candidate "$existing_trust" || fail 'Existing dedicated certificate is expired, revoked or invalid; supply an independently verified replacement explicitly.'
|
||||
return
|
||||
fi
|
||||
ambient_home=${GNUPGHOME:-$HOME/.gnupg}
|
||||
if [ -d "$ambient_home" ]; then
|
||||
# Read/export only: no import, trust edits or remote lookup in this home.
|
||||
if gpg --batch --no-options --homedir "$ambient_home" --no-tty --no-autostart \
|
||||
--no-auto-key-retrieve --auto-key-locate clear --no-auto-check-trustdb \
|
||||
--lock-never --export "$pinned_fingerprint" > "$candidate" 2>/dev/null && [ -s "$candidate" ]; then
|
||||
if accept_certificate_candidate "$candidate"; then return; fi
|
||||
fi
|
||||
fi
|
||||
if download "$BASE_URL/public-key.gpg" "$candidate" 1048576; then
|
||||
if accept_certificate_candidate "$candidate"; then return; fi
|
||||
fi
|
||||
if [ "$gpg_email" != - ]; then
|
||||
reset_gpg_home
|
||||
if lookup_bounded gpg --batch --no-options --homedir "$gpg_home" --no-tty \
|
||||
--no-auto-key-retrieve --auto-key-locate clear,wkd --locate-external-keys -- "$gpg_email" >/dev/null 2>&1; then
|
||||
gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear --armor --export > "$candidate" 2>/dev/null || :
|
||||
if accept_certificate_candidate "$candidate"; then return; fi
|
||||
fi
|
||||
fi
|
||||
while IFS= read -r server; do
|
||||
reset_gpg_home
|
||||
if lookup_bounded gpg --batch --no-options --homedir "$gpg_home" --no-tty \
|
||||
--no-auto-key-retrieve --auto-key-locate clear --keyserver "$server" \
|
||||
--recv-keys "$pinned_fingerprint" >/dev/null 2>&1; then
|
||||
gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear --armor --export > "$candidate" 2>/dev/null || :
|
||||
if accept_certificate_candidate "$candidate"; then return; fi
|
||||
fi
|
||||
done < "$server_list"
|
||||
fail 'No local, Worker, WKD or configured keyserver certificate matched the complete trusted pin; nothing installed.'
|
||||
}
|
||||
read_replay_state() {
|
||||
strict_text "$1"
|
||||
[ "$(wc -c < "$1" | tr -d ' ')" -le 256 ] || fail 'Rollback state is oversized.'
|
||||
awk -v list="$list_id" '
|
||||
NR==1 { if($0!="conf-sshd-state-v1") exit 1 }
|
||||
NR==2 { if($0!="list-id " list) exit 1 }
|
||||
NR==3 { if($0!="sequence " $2 || $2 !~ /^(0|[1-9][0-9]*)$/ || length($2)>10 || $2+0>2147483647) exit 1 }
|
||||
NR==4 { if($0!="sha256 " $2 || ($2!="-" && (length($2)!=64 || $2 ~ /[^0-9a-f]/))) exit 1 }
|
||||
END { if(NR!=4) exit 1 }
|
||||
' "$1" || fail 'Malformed rollback state; refusing silent bootstrap.'
|
||||
recorded_sequence=$(sed -n '3s/^sequence //p' "$1")
|
||||
recorded_digest=$(sed -n '4s/^sha256 //p' "$1")
|
||||
}
|
||||
write_replay_record() {
|
||||
printf 'conf-sshd-state-v1\nlist-id %s\nsequence %s\nsha256 %s\n' "$list_id" "$1" "$2" > "$3"
|
||||
}
|
||||
confirm_policy_change() {
|
||||
say "Signature policy change: $1; fingerprint $2; pin mode $3; list $4." >&2
|
||||
if [ "$3" = primary ]; then say 'Primary pin trusts valid, bound signing subkeys of that primary.' >&2
|
||||
else say 'Subkey pin trusts only that exact signing subkey, not its siblings.' >&2; fi
|
||||
say 'If local/Worker discovery fails, optional WKD and configured keyservers may receive the email/fingerprint and your IP.' >&2
|
||||
if [ "$dry_run" = yes ]; then fail 'Trust-changing dry runs do not enroll, query certificates or prompt; rerun locally without --dry-run to review and consent.'; fi
|
||||
if ! ( : < /dev/tty ) 2>/dev/null; then fail 'Trust changes require confirmation in a local terminal (/dev/tty); no noninteractive bypass exists.'; fi
|
||||
printf 'To confirm %s, type the complete fingerprint %s: ' "$1" "$2" > /dev/tty
|
||||
IFS= read -r confirmation < /dev/tty || fail 'Trust confirmation was not received.'
|
||||
[ "$confirmation" = "$2" ] || fail 'Trust change was not confirmed.'
|
||||
}
|
||||
require_explicit_installer() {
|
||||
if [ "$mode" != install ] && [ -f "$target_script" ]; then
|
||||
[ "$(grep -Fxc '# conf-sshd-client-security-v1' "$target_script" || :)" = 1 ] || fail 'Existing scheduled script predates signature enforcement; use --install to upgrade it before changing trust.'
|
||||
fi
|
||||
# --install or explicit trust options are a user-triggered installation;
|
||||
# scheduled -o without options never enters this policy-change flow.
|
||||
say 'Installer bootstrap code is trusted by this invocation. Independently checking a local script hash is recommended.' >&2
|
||||
}
|
||||
prepare_install_config() {
|
||||
config_prepared=yes
|
||||
staged_replay=
|
||||
replay_snapshot=absent
|
||||
staged_trust=
|
||||
old_policy=$policy
|
||||
old_pin=$pinned_fingerprint
|
||||
old_pin_mode=$pin_mode
|
||||
old_list=$list_id
|
||||
if [ "$config_snapshot" = absent ]; then
|
||||
requested_verification=${requested_verification:-$DEFAULT_GPG_VERIFY}
|
||||
requested_fingerprint=${requested_fingerprint:-$DEFAULT_GPG_FINGERPRINT}
|
||||
requested_pin_mode=${requested_pin_mode:-$DEFAULT_GPG_PIN_MODE}
|
||||
requested_list_id=${requested_list_id:-$DEFAULT_LIST_ID}
|
||||
requested_email=${requested_email:-$DEFAULT_GPG_EMAIL}
|
||||
fi
|
||||
if [ -n "$requested_email" ]; then gpg_email=$requested_email; fi
|
||||
if [ -n "$requested_keyservers" ]; then keyservers=$(printf '%s' "$requested_keyservers"); fi
|
||||
validate_discovery_settings
|
||||
if [ "$requested_verification" = off ]; then
|
||||
if [ "$old_policy" = required ]; then
|
||||
require_explicit_installer
|
||||
confirm_policy_change disable "$old_pin" "$old_pin_mode" "$old_list"
|
||||
fi
|
||||
policy=off
|
||||
# Preserve the enrolled pin and rollback state for any future re-enable.
|
||||
if [ "$old_pin" = - ]; then pinned_fingerprint=-; list_id=-; pin_mode=primary; fi
|
||||
elif [ "$requested_verification" = on ] || [ -n "$public_key_file$requested_fingerprint$requested_list_id$requested_min_sequence$requested_pin_mode" ]; then
|
||||
require_explicit_installer
|
||||
if [ "$old_pin" != - ]; then
|
||||
requested_fingerprint=${requested_fingerprint:-$old_pin}
|
||||
requested_list_id=${requested_list_id:-$old_list}
|
||||
fi
|
||||
[ -n "$requested_fingerprint" ] && [ -n "$requested_list_id" ] || fail 'Enabling verification requires --gpg-fingerprint and --list-id (or configured defaults).'
|
||||
requested_pin_mode=${requested_pin_mode:-$pin_mode}
|
||||
case $requested_pin_mode in primary|subkey) : ;; *) fail '--gpg-pin-mode must be primary or subkey.' ;; esac
|
||||
requested_fingerprint=$(printf '%s' "$requested_fingerprint" | tr 'a-f' 'A-F')
|
||||
printf '%s\n' "$requested_fingerprint" | grep -Eq '^[0-9A-F]{40}$' || fail 'Expected a full 40-hex fingerprint.'
|
||||
printf '%s\n' "$requested_list_id" | grep -Eq '^[A-Za-z0-9._-]{1,64}$' || fail 'Invalid signed list ID.'
|
||||
[ "$requested_list_id" != - ] || fail 'List ID cannot be a dash.'
|
||||
if [ "$old_pin" != - ]; then
|
||||
[ "$requested_list_id" = "$old_list" ] || fail 'Reinstall cannot reset the enrolled list identity or rollback history.'
|
||||
[ -f "$replay_state" ] || fail 'Rollback state is missing after enrollment; refusing silent bootstrap.'
|
||||
fi
|
||||
confirm_policy_change enable/change "$requested_fingerprint" "$requested_pin_mode" "$requested_list_id"
|
||||
policy=required
|
||||
list_id=$requested_list_id
|
||||
pinned_fingerprint=$requested_fingerprint
|
||||
pin_mode=$requested_pin_mode
|
||||
need date
|
||||
discover_certificate
|
||||
if [ "$old_pin" != - ] && [ -n "$requested_min_sequence" ]; then
|
||||
floor=$requested_min_sequence
|
||||
printf '%s\n' "$floor" | grep -Eq '^[1-9][0-9]{0,9}$' && [ "$floor" -le 2147483647 ] || fail 'Minimum sequence must be 1..2147483647.'
|
||||
new_temp "$state"; replay_snapshot=$TEMP
|
||||
cp "$replay_state" "$replay_snapshot"
|
||||
read_replay_state "$replay_snapshot"
|
||||
[ "$floor" -ge "$recorded_sequence" ] || fail 'Explicit minimum sequence cannot lower the persisted rollback boundary.'
|
||||
new_temp "$state"; staged_replay=$TEMP
|
||||
if [ "$floor" -gt "$recorded_sequence" ]; then write_replay_record "$((floor - 1))" - "$staged_replay"
|
||||
else cp "$replay_snapshot" "$staged_replay"; fi
|
||||
fi
|
||||
if [ "$old_pin" = - ]; then
|
||||
[ ! -e "$replay_state" ] && [ ! -e "$pending_state" ] && [ ! -e "$pending_bundle" ] || fail 'Existing security state requires manual recovery; cannot silently enroll over it.'
|
||||
floor=${requested_min_sequence:-1}
|
||||
printf '%s\n' "$floor" | grep -Eq '^[1-9][0-9]{0,9}$' && [ "$floor" -le 2147483647 ] || fail 'Minimum sequence must be 1..2147483647.'
|
||||
new_temp "$state"; staged_replay=$TEMP
|
||||
write_replay_record "$((floor - 1))" - "$staged_replay"
|
||||
fi
|
||||
fi
|
||||
if [ "$policy" = required ] && [ -z "$staged_trust" ]; then
|
||||
require_explicit_installer
|
||||
confirm_policy_change reinstall/refresh "$pinned_fingerprint" "$pin_mode" "$list_id"
|
||||
discover_certificate
|
||||
fi
|
||||
if [ -n "$primary_url" ] || [ -n "$fallback_urls_file" ]; then
|
||||
new_temp "$state"; new_urls=$TEMP
|
||||
if [ -n "$primary_url" ]; then printf '%s\n' "$primary_url" > "$new_urls"
|
||||
else sed -n '1p' "$urls" > "$new_urls"; fi
|
||||
if [ -n "$fallback_urls_file" ]; then
|
||||
check_path "$fallback_urls_file" file
|
||||
[ -f "$fallback_urls_file" ] || fail 'Fallback URL file does not exist.'
|
||||
[ "$(wc -c < "$fallback_urls_file" | tr -d ' ')" -le 35000 ] || fail 'Fallback URL file is too large.'
|
||||
if [ -s "$fallback_urls_file" ]; then strict_text "$fallback_urls_file"; fi
|
||||
cat "$fallback_urls_file" >> "$new_urls"
|
||||
elif [ -n "$primary_url" ]; then sed -n '2,$p' "$urls" >> "$new_urls"; fi
|
||||
urls=$new_urls
|
||||
validate_urls "$urls"
|
||||
fi
|
||||
new_temp "$state"; staged_config=$TEMP
|
||||
printf 'conf-sshd-local-v1\npolicy %s\nlist-id %s\nfingerprint %s\npin-mode %s\nemail %s\n' "$policy" "$list_id" "$pinned_fingerprint" "$pin_mode" "$gpg_email" > "$staged_config"
|
||||
sed 's/^/url /' "$urls" >> "$staged_config"
|
||||
sed 's/^/keyserver /' "$server_list" >> "$staged_config"
|
||||
}
|
||||
commit_install_config() {
|
||||
if [ -n "$staged_trust" ]; then replace_file "$trust_key" "$staged_trust" 600; fi
|
||||
if [ -n "$staged_replay" ]; then replace_file "$replay_state" "$staged_replay" 600 "$replay_snapshot"; fi
|
||||
replace_file "$local_config" "$staged_config" 600 "$config_snapshot"
|
||||
}
|
||||
validate_signed_document() {
|
||||
last_lf "$response" || fail 'Signed document must end with LF.'
|
||||
[ "$(wc -c < "$response" | tr -d ' ')" -le 1048576 ] || fail 'Signed document exceeds 1 MiB.'
|
||||
new_temp "$state"; invalid_bytes=$TEMP
|
||||
tr -d '\012\040-\176' < "$response" > "$invalid_bytes"
|
||||
[ ! -s "$invalid_bytes" ] || fail 'Signed document contains noncanonical bytes.'
|
||||
new_temp "$state"; metadata=$TEMP
|
||||
awk '
|
||||
NR==1 { if($0!="# conf-sshd-signed-v1") exit 1 }
|
||||
NR==2 { if($0!="# list-id " $3 || $3 ~ /[^A-Za-z0-9._-]/ || length($3)<1 || length($3)>64) exit 1; print $3 }
|
||||
NR==3 { if($0!="# sequence " $3 || $3 !~ /^[1-9][0-9]*$/ || length($3)>10 || $3+0>2147483647) exit 1; print $3 }
|
||||
NR==4 || NR==5 { label=(NR==4 ? "issued-at" : "expires-at")
|
||||
if($0!="# " label " " $3 || $3 !~ /^(0|[1-9][0-9]*)$/ || length($3)>10) exit 1
|
||||
if(NR==4) issue=$3+0; else if($3+0<=issue) exit 1; print $3 }
|
||||
NR==6 { if($0!="# revoke yes" && $0!="# revoke no") exit 1; revoke=$3; print $3 }
|
||||
NR==7 { if($0!="# key-count " $3 || $3 !~ /^(0|[1-9][0-9]*)$/ || length($3)>4 || $3+0>1000) exit 1
|
||||
if(($3==0 && revoke!="yes") || ($3!=0 && revoke!="no")) exit 1; print $3 }
|
||||
NR==8 { if($0!="# end-metadata") exit 1 }
|
||||
END { if(NR<8) exit 1 }
|
||||
' "$response" > "$metadata" || fail 'Invalid signed-document schema or revocation metadata.'
|
||||
release_list=$(sed -n '1p' "$metadata")
|
||||
sequence=$(sed -n '2p' "$metadata")
|
||||
issued_at=$(sed -n '3p' "$metadata")
|
||||
expires_at=$(sed -n '4p' "$metadata")
|
||||
key_count=$(sed -n '6p' "$metadata")
|
||||
revision=$sequence
|
||||
new_temp "$state"; payload=$TEMP
|
||||
tail -n +9 "$response" > "$payload"
|
||||
[ "$(wc -l < "$payload" | tr -d ' ')" = "$key_count" ] || fail 'Signed payload key count mismatch.'
|
||||
# Signed documents are canonical even when signature verification is OFF.
|
||||
awk 'NF!=2 || $0!=$1 " " $2 {exit 1}' "$payload" || fail 'Signed document key lines must be comment-free and canonical.'
|
||||
if [ "$policy" = required ]; then
|
||||
[ "$release_list" = "$list_id" ] || fail 'Signed list identity does not match local enrollment.'
|
||||
now=$(date +%s)
|
||||
if [ "$enforce_freshness" = yes ]; then
|
||||
[ "$issued_at" -le "$((now + 300))" ] && [ "$expires_at" -gt "$now" ] || fail 'Signed release is expired or issued too far in the future.'
|
||||
fi
|
||||
fi
|
||||
digest=$(sha256 "$response")
|
||||
validate_payload
|
||||
}
|
||||
verify_signature() {
|
||||
last_lf "$signature" || fail 'Detached signature must end with LF.'
|
||||
[ "$(wc -c < "$signature" | tr -d ' ')" -le 65536 ] || fail 'Detached signature exceeds 64 KiB.'
|
||||
new_temp "$state"; bad_signature=$TEMP
|
||||
tr -d '\012\040-\176' < "$signature" > "$bad_signature"
|
||||
[ ! -s "$bad_signature" ] || fail 'Detached signature must be ASCII armor with LF line endings.'
|
||||
awk '
|
||||
NR==1 {if($0!="-----BEGIN PGP SIGNATURE-----") exit 1}
|
||||
{ if(ended) exit 1; if($0=="-----END PGP SIGNATURE-----") ended=1 }
|
||||
END {if(!ended) exit 1}
|
||||
' "$signature" || fail 'Malformed detached-signature armor.'
|
||||
new_temp "$state"; gpg_status=$TEMP
|
||||
gpg_local --status-fd 1 --verify "$signature" "$response" > "$gpg_status" 2>/dev/null || fail 'Detached signature verification failed.'
|
||||
awk -v pin="$pinned_fingerprint" -v mode="$pin_mode" -v expectedprimary="$certificate_primary" -v now="$(date +%s)" '
|
||||
$1!="[GNUPG:]" {bad=1}
|
||||
$2 ~ /^(BADSIG|ERRSIG|NO_PUBKEY|EXPSIG|EXPKEYSIG|REVKEYSIG|KEYEXPIRED|KEYREVOKED|SIGEXPIRED|BADARMOR|FAILURE|ERROR|NODATA|UNEXPECTED)$/ {bad=1}
|
||||
$2=="VALIDSIG" { good++; primary=$12
|
||||
if(NF!=12 || $7!=4 || $11!="00" || length(primary)!=40 || primary ~ /[^0-9A-F]/ || primary!=expectedprimary || (mode=="primary" && primary!=pin) || (mode=="subkey" && $3!=pin) || length($3)!=40 || $3 ~ /[^0-9A-F]/ || ($10!=8 && $10!=9 && $10!=10)) bad=1
|
||||
if($5 !~ /^(0|[1-9][0-9]*)$/ || length($5)>10 || $5+0>now+300 || $6 !~ /^(0|[1-9][0-9]*)$/ || length($6)>10 || ($6!=0 && $6+0<=now)) bad=1 }
|
||||
END {if(bad || good!=1) exit 1}
|
||||
' "$gpg_status" || fail 'Signature status lacks one valid, unexpired signature from the locally pinned primary/subkey.'
|
||||
}
|
||||
check_replay() {
|
||||
[ "$sequence" -ge "$recorded_sequence" ] || fail 'Signed sequence rollback rejected.'
|
||||
if [ "$sequence" = "$recorded_sequence" ]; then
|
||||
[ "$digest" = "$recorded_digest" ] || fail 'Signed sequence equivocation rejected (same sequence, different bytes).'
|
||||
fi
|
||||
}
|
||||
validate_response() {
|
||||
if [ "$policy" = required ]; then
|
||||
verify_signature
|
||||
validate_signed_document
|
||||
check_replay
|
||||
elif [ "$(sed -n '1p' "$response")" = '# conf-sshd-signed-v1' ]; then
|
||||
validate_signed_document
|
||||
else validate_legacy_response; fi
|
||||
}
|
||||
# Journal pairs are local only; transport is /ssh.keys plus /ssh.keys.sig.
|
||||
make_pending_bundle() {
|
||||
cat "$response" > "$1"
|
||||
printf '# detached-signature\n' >> "$1"
|
||||
cat "$signature" >> "$1"
|
||||
}
|
||||
read_pending_bundle() {
|
||||
[ "$(wc -c < "$pending_bundle" | tr -d ' ')" -le 1114133 ] || fail 'Pending package is oversized.'
|
||||
new_temp "$state"; response=$TEMP
|
||||
new_temp "$state"; signature=$TEMP
|
||||
# Marker is forbidden by the strict document schema and signature armor.
|
||||
awk -v sig="$signature" '
|
||||
$0=="# detached-signature" {if(found++) exit 1; next}
|
||||
{if(found) print > sig; else print}
|
||||
END {if(found!=1) exit 1}
|
||||
' "$pending_bundle" > "$response" || fail 'Malformed pending package.'
|
||||
# Enforce original bytes: awk must not normalize a malformed journal.
|
||||
new_temp "$state"; rebuilt=$TEMP
|
||||
make_pending_bundle "$rebuilt"
|
||||
cmp -s "$rebuilt" "$pending_bundle" || fail 'Noncanonical pending package.'
|
||||
}
|
||||
finish_verified_release() {
|
||||
# Commit a complete verified package before advancing any anti-rollback state
|
||||
# or replacing keys. Atomic renames survive process interruption, not every
|
||||
# power-loss/filesystem failure; no portable fsync promise is made here.
|
||||
if [ "$dry_run" = no ]; then
|
||||
if [ "$replace_pending" = yes ]; then
|
||||
# Preserve the authenticated old journal floor before superseding its
|
||||
# files. A crash at any step can only retain/raise this boundary.
|
||||
new_temp "$state"; promoted_state=$TEMP
|
||||
write_replay_record "$recorded_sequence" "$recorded_digest" "$promoted_state"
|
||||
replace_file "$replay_state" "$promoted_state" 600
|
||||
rm -f "$pending_state" "$pending_bundle"
|
||||
fi
|
||||
if [ ! -f "$pending_state" ]; then
|
||||
new_temp "$state"; pending_tmp=$TEMP
|
||||
make_pending_bundle "$pending_tmp"
|
||||
replace_file "$pending_bundle" "$pending_tmp" 600
|
||||
new_temp "$state"; pending_record=$TEMP
|
||||
write_replay_record "$sequence" "$digest" "$pending_record"
|
||||
replace_file "$pending_state" "$pending_record" 600 absent
|
||||
fi
|
||||
fi
|
||||
apply_payload
|
||||
if [ "$dry_run" = no ]; then
|
||||
new_temp "$state"; final_state=$TEMP
|
||||
write_replay_record "$sequence" "$digest" "$final_state"
|
||||
replace_file "$replay_state" "$final_state" 600
|
||||
rm -f "$pending_state" "$pending_bundle"
|
||||
fi
|
||||
}
|
||||
sync_keys() {
|
||||
need ssh-keygen
|
||||
validate_build
|
||||
if [ "$policy" = required ]; then
|
||||
need date
|
||||
if [ -n "${staged_replay:-}" ]; then read_replay_state "$staged_replay"
|
||||
else read_replay_state "$replay_state"; fi
|
||||
if [ -z "$gpg_home" ]; then import_pinned_key "$trust_key"; fi
|
||||
if [ -f "$pending_state" ] || [ -f "$pending_bundle" ]; then
|
||||
saved_sequence=$recorded_sequence
|
||||
saved_digest=$recorded_digest
|
||||
pending_sequence=
|
||||
pending_digest=
|
||||
if [ -f "$pending_state" ]; then
|
||||
read_replay_state "$pending_state"
|
||||
pending_sequence=$recorded_sequence
|
||||
pending_digest=$recorded_digest
|
||||
[ "$pending_digest" != - ] || fail 'Pending state must identify an already verified document.'
|
||||
[ "$pending_sequence" -ge "$saved_sequence" ] || fail 'Pending rollback record is below the committed boundary.'
|
||||
if [ "$pending_sequence" = "$saved_sequence" ]; then
|
||||
[ "$pending_digest" = "$saved_digest" ] || fail 'Pending rollback record conflicts with committed history.'
|
||||
fi
|
||||
fi
|
||||
recorded_sequence=$saved_sequence
|
||||
recorded_digest=$saved_digest
|
||||
if [ -f "$pending_bundle" ]; then
|
||||
read_pending_bundle
|
||||
enforce_freshness=no
|
||||
validate_signed_document
|
||||
enforce_freshness=yes
|
||||
check_replay
|
||||
if [ -n "$pending_sequence" ]; then
|
||||
[ "$sequence" = "$pending_sequence" ] && [ "$digest" = "$pending_digest" ] || fail 'Pending package does not match its rollback record.'
|
||||
elif [ "$sequence" = "$recorded_sequence" ] && [ "$digest" = "$recorded_digest" ]; then
|
||||
# Crash while removing an old journal after promoting its
|
||||
# floor: committed state already authenticates these bytes.
|
||||
pending_sequence=$sequence
|
||||
pending_digest=$digest
|
||||
fi
|
||||
if ( lock_owned=no; created_state=no; created_ssh=no; temps=;
|
||||
trap 'child_result=$?; gpg_home=; cleanup "$child_result"' 0
|
||||
validate_response ); then
|
||||
if [ "$validation_only" = no ]; then
|
||||
finish_verified_release
|
||||
say 'Recovered the same verified pending release; no fallback was fetched.'
|
||||
fi
|
||||
return
|
||||
fi
|
||||
[ -n "$pending_sequence" ] || fail 'Uncommitted pending package is no longer verifiable; manual recovery is required.'
|
||||
else
|
||||
[ -n "$pending_sequence" ] || fail 'Pending package/state is incomplete.'
|
||||
fi
|
||||
# The protected committed journal records a previously verified
|
||||
# release. Its current expiry/revocation never authorizes installing
|
||||
# it, but its sequence/digest still prevent rollback while fetching
|
||||
# a fresh valid release under the currently enrolled pin.
|
||||
recorded_sequence=$pending_sequence
|
||||
recorded_digest=$pending_digest
|
||||
replace_pending=yes
|
||||
say 'Pending release cannot currently be applied; retaining its rollback floor while fetching a fresh valid release.' >&2
|
||||
fi
|
||||
fi
|
||||
new_temp "$state"; response=$TEMP
|
||||
new_temp "$state"; signature=$TEMP
|
||||
accepted=no
|
||||
# Full validation occurs per source. A failed mirror never permits a policy
|
||||
# downgrade; candidate-local temporaries are cleaned even when fail() exits.
|
||||
while IFS= read -r source_url; do
|
||||
if download "$source_url" "$response" 1048576; then
|
||||
if [ "$policy" = required ] && ! download "$source_url.sig" "$signature" 65536; then
|
||||
say "Signature unavailable from $source_url; trying next locally configured source." >&2
|
||||
continue
|
||||
fi
|
||||
if ( lock_owned=no; created_state=no; created_ssh=no; gpg_home_saved=$gpg_home; gpg_home=; temps=;
|
||||
# Preserve the caller keyring but never delete it in this subshell.
|
||||
gpg_home=$gpg_home_saved
|
||||
trap 'child_result=$?; gpg_home=; cleanup "$child_result"' 0
|
||||
validate_response ); then accepted=yes; break; fi
|
||||
fi
|
||||
say "Rejected source $source_url; trying next locally configured source." >&2
|
||||
done < "$urls"
|
||||
[ "$accepted" = yes ] || fail 'No locally configured source passed the required policy; existing keys are unchanged.'
|
||||
validate_response
|
||||
if [ "$validation_only" = no ]; then
|
||||
if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi
|
||||
fi
|
||||
}
|
||||
|
||||
if [ "$mode" = uninstall ] || [ "$mode" = config ] || { [ "$mode" = sync ] && [ "$cron_requested" = yes ] && [ "$cron_value" = false ]; }; then
|
||||
policy=off
|
||||
config_snapshot=absent
|
||||
else load_local_config; fi
|
||||
case $mode in
|
||||
update)
|
||||
install)
|
||||
validate_build
|
||||
[ -f "$target_script" ] || fail 'No installed script. Install scheduling with -c first.'
|
||||
new_temp "$state"; updated_script=$TEMP
|
||||
download "$BASE_URL/script.sh" "$updated_script"
|
||||
validate_script "$updated_script"
|
||||
replace_file "$target_script" "$updated_script" 700
|
||||
say 'Script update validated. Keys, cron and sshd configuration were not changed.' ;;
|
||||
prepare_install_config
|
||||
prepare_script
|
||||
if [ "$cron_requested" = yes ]; then
|
||||
prepare_cron
|
||||
if [ -z "$cron_value" ]; then cron_value=${existing_schedule:-$DEFAULT_CRON}; fi
|
||||
fi
|
||||
validation_only=yes
|
||||
sync_keys
|
||||
# Activate policy only after replacing any legacy scheduled executable.
|
||||
install_script
|
||||
commit_install_config
|
||||
if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi
|
||||
if [ "$cron_requested" = yes ]; then apply_cron "$cron_value"; fi ;;
|
||||
uninstall)
|
||||
if command -v crontab >/dev/null 2>&1; then prepare_cron; apply_cron false; fi
|
||||
for uninstall_file in "$target_script" "$target_script.conf-sshd.bak"; do
|
||||
check_path "$uninstall_file" file
|
||||
if [ "$dry_run" = yes ]; then say "Would remove $uninstall_file"; else rm -f "$uninstall_file"; fi
|
||||
done
|
||||
say 'Uninstalled managed scheduling/script. Authorized keys and sshd configuration are preserved.' ;;
|
||||
say 'Uninstalled managed scheduling/script. Authorized keys, trust and rollback state are preserved.' ;;
|
||||
config) edit_sshd_config ;;
|
||||
sync|keys)
|
||||
script_tmp=
|
||||
if [ "$cron_requested" = yes ]; then
|
||||
prepare_cron
|
||||
if [ "$cron_value" = false ]; then apply_cron false; exit 0; fi
|
||||
validate_build
|
||||
if [ -z "$cron_value" ]; then cron_value=${existing_schedule:-$DEFAULT_CRON}; fi
|
||||
fi
|
||||
if [ "$trust_options" = yes ] || { [ "$config_snapshot" = absent ] && [ "$DEFAULT_GPG_VERIFY" = on ]; }; then
|
||||
validate_build
|
||||
prepare_install_config
|
||||
validation_only=yes
|
||||
fi
|
||||
if [ "$cron_requested" = yes ] && [ ! -f "$target_script" ]; then prepare_script; fi
|
||||
sync_keys
|
||||
if [ "$cron_requested" = yes ]; then install_script; apply_cron "$cron_value"; fi ;;
|
||||
if [ "$config_prepared" = yes ]; then
|
||||
if [ -n "$script_tmp" ]; then install_script; script_tmp=; fi
|
||||
commit_install_config
|
||||
if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi
|
||||
fi
|
||||
if [ "$cron_requested" = yes ]; then
|
||||
if [ -n "$script_tmp" ]; then install_script; fi
|
||||
apply_cron "$cron_value"
|
||||
fi ;;
|
||||
esac
|
||||
|
||||
+11
-1
@@ -3,5 +3,15 @@
|
||||
"repositoryUrl": "https://github.com/LamGC/quickly-conf-sshd",
|
||||
"defaultCron": "*/15 * * * *",
|
||||
"allowEmpty": false,
|
||||
"fallbackSources": []
|
||||
"fallbackSources": [],
|
||||
"keySource": {
|
||||
"type": "git"
|
||||
},
|
||||
"clientDefaults": {
|
||||
"gpgVerification": "off",
|
||||
"fingerprint": "",
|
||||
"pinMode": "primary",
|
||||
"listId": "",
|
||||
"email": ""
|
||||
}
|
||||
}
|
||||
|
||||
+67
-13
@@ -7,20 +7,25 @@ import { execFileSync } from 'node:child_process';
|
||||
|
||||
export const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
|
||||
export const digest = data => createHash('sha256').update(data).digest('hex');
|
||||
import { escapeHTML, commandsFor, renderKeys, renderCommands, renderPage } from '../cf-worker/src/view.js';
|
||||
export { escapeHTML, commandsFor, renderKeys, renderCommands };
|
||||
import { validateFallbackSources, parsePublicKeys } from '../cf-worker/src/key-source.js';
|
||||
import { escapeHTML, commandsFor, renderCommands, renderPage } from '../cf-worker/src/view.js';
|
||||
export { escapeHTML, commandsFor, renderCommands };
|
||||
import { validateFallbackSources, parsePublicKeys, validateKeySource, validateSignedReleaseConfig } from '../cf-worker/src/key-source.js';
|
||||
import {withoutKeyComments, parsePublishedSignedRelease, SIGNATURE_SEPARATOR} from '../cf-worker/src/signed-release.js';
|
||||
import {checkSigningCertificate, validatePublicCertificate} from './signature-tools.mjs';
|
||||
|
||||
|
||||
export function validateConfig(config) {
|
||||
if (!config || typeof config !== 'object' || Array.isArray(config)) throw Error('Deployment configuration must be an object.');
|
||||
for (const key of Object.keys(config)) if (!['baseUrl','repositoryUrl','defaultCron','allowEmpty','fallbackSources'].includes(key)) throw Error(`Unknown configuration: ${key}`);
|
||||
for (const key of Object.keys(config)) if (!['baseUrl','repositoryUrl','defaultCron','allowEmpty','fallbackSources','keySource','signedRelease','clientDefaults'].includes(key)) throw Error(`Unknown configuration: ${key}`);
|
||||
if (typeof config.baseUrl !== 'string' || !/^https:\/\/[a-zA-Z0-9.-]+(?::[0-9]+)?$/.test(config.baseUrl)) throw Error('baseUrl must be an HTTPS origin without paths, credentials, or shell metacharacters.');
|
||||
const url = new URL(config.baseUrl);
|
||||
if (url.origin !== config.baseUrl || !url.hostname.includes('.') || url.hostname.includes('..')) throw Error('baseUrl must be a canonical HTTPS origin.');
|
||||
if (typeof config.repositoryUrl !== 'string' || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(config.repositoryUrl)) throw Error('repositoryUrl must identify a GitHub repository.');
|
||||
if (typeof config.allowEmpty !== 'boolean') throw Error('allowEmpty must be an explicit boolean.');
|
||||
validateFallbackSources(Object.hasOwn(config, 'fallbackSources') ? config.fallbackSources : []);
|
||||
validateKeySource(config.keySource);
|
||||
validateSignedReleaseConfig(config.signedRelease);
|
||||
validateClientDefaults(config.clientDefaults);
|
||||
const cron = config.defaultCron;
|
||||
if (typeof cron !== 'string' || cron.trim() !== cron || !/^[0-9*,/ -]+$/.test(cron) || cron.split(/ +/).length !== 5) throw Error('defaultCron must contain five numeric cron fields.');
|
||||
const bounds = [[0,59],[0,23],[1,31],[1,12],[0,7]];
|
||||
@@ -37,6 +42,18 @@ export function validateConfig(config) {
|
||||
return config;
|
||||
}
|
||||
|
||||
export function validateClientDefaults(value = {}) {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !['gpgVerification', 'fingerprint', 'pinMode', 'listId', 'email'].includes(key))) throw Error('Invalid clientDefaults configuration.');
|
||||
const result = {gpgVerification: value.gpgVerification ?? 'off', fingerprint: value.fingerprint ?? '', pinMode: value.pinMode ?? 'primary', listId: value.listId ?? '', email: value.email ?? ''};
|
||||
if (!['off', 'on'].includes(result.gpgVerification) || !['primary', 'subkey'].includes(result.pinMode)) throw Error('Invalid client verification defaults.');
|
||||
if (typeof result.fingerprint !== 'string' || (result.fingerprint !== '' && !/^[A-Fa-f0-9]{40}$/.test(result.fingerprint))) throw Error('Client fingerprint must be empty or a full 40-character fingerprint.');
|
||||
if (typeof result.listId !== 'string' || result.listId === '-' || (result.listId !== '' && !/^[A-Za-z0-9._-]{1,64}$/.test(result.listId))) throw Error('Invalid client list ID.');
|
||||
if (result.gpgVerification === 'on' && (!result.fingerprint || !result.listId)) throw Error('Enabled verification defaults require a full fingerprint and list ID.');
|
||||
if (typeof result.email !== 'string' || (result.email !== '' && (!/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}$/.test(result.email) || result.email.length > 254))) throw Error('Client email must be empty or a safe public email address.');
|
||||
result.fingerprint = result.fingerprint.toUpperCase();
|
||||
return result;
|
||||
}
|
||||
|
||||
export async function parseKeys(input) {
|
||||
// Use the exact runtime parser, then additionally verify against the build's OpenSSH tools.
|
||||
const keys = await parsePublicKeys(input);
|
||||
@@ -54,8 +71,9 @@ export async function parseKeys(input) {
|
||||
|
||||
export function makeKeysText(keys, revision, allowEmpty) {
|
||||
if (!/^[0-9a-f]{40}$/.test(revision)) throw Error('Release revision must be a 40-character Git commit SHA.');
|
||||
if (typeof allowEmpty !== 'boolean') throw Error('allowEmpty must be an explicit boolean.');
|
||||
if (!keys.length && !allowEmpty) throw Error('No server public keys configured. Add keys/authorized_keys, or explicitly allow an empty revocation release.');
|
||||
const payload = keys.map(key => key.text + '\n').join('');
|
||||
const payload = withoutKeyComments(keys).map(key => key.text + '\n').join('');
|
||||
const sha256 = digest(payload);
|
||||
const text = `# conf-sshd-v1\n# revision ${revision}\n# key-count ${keys.length}\n# allow-empty ${allowEmpty ? 'yes' : 'no'}\n# sha256 ${sha256}\n# end-metadata\n${payload}`;
|
||||
if (Buffer.byteLength(text) > 1024 * 1024) throw Error('Serialized key release exceeds client response limit.');
|
||||
@@ -65,26 +83,62 @@ export function makeKeysText(keys, revision, allowEmpty) {
|
||||
|
||||
export async function build({directory = root, outDirectory = join(directory,'cf-worker'), testFixture = false, revision, publishedAt} = {}) {
|
||||
const config = validateConfig(JSON.parse(await readFile(join(directory,'deployment.json'),'utf8')));
|
||||
const input = await readFile(join(directory,testFixture ? 'tests/fixtures/keys.pub' : 'keys/authorized_keys'),'utf8');
|
||||
const keys = await parseKeys(input);
|
||||
const input = config.keySource?.type === 'gist' && !testFixture ? '' : await readFile(join(directory,testFixture ? 'tests/fixtures/keys.pub' : 'keys/authorized_keys'),'utf8').catch(error => {if (error.code === 'ENOENT' && !testFixture) return ''; throw error;});
|
||||
let keys = [];
|
||||
revision ||= process.env.GITHUB_SHA || execFileSync('git',['rev-parse','HEAD'],{cwd:directory,encoding:'utf8'}).trim();
|
||||
if (!/^[0-9a-f]{40}$/.test(revision)) throw Error('Release revision must be a 40-character Git commit SHA.');
|
||||
publishedAt ||= new Date().toISOString();
|
||||
const fallbackSources = validateFallbackSources(config.fallbackSources ?? []);
|
||||
const needsFallback = keys.length === 0 && !config.allowEmpty && fallbackSources.length > 0;
|
||||
const bundle = needsFallback ? {sha256:null,text:null} : makeKeysText(keys,revision,config.allowEmpty);
|
||||
const keySource = validateKeySource(config.keySource), signedRelease = validateSignedReleaseConfig(config.signedRelease);
|
||||
const optional = async path => { try { return await readFile(join(directory, path), 'utf8'); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } };
|
||||
let signed = null, publicCertificate = null;
|
||||
if (keySource.type === 'git' && !testFixture) {
|
||||
const documentFile = await optional('keys/ssh.keys'), bundleFile = await optional('keys/release.bundle');
|
||||
if (documentFile !== null && bundleFile !== null) throw Error('Use keys/ssh.keys plus its optional signature OR keys/release.bundle, not both.');
|
||||
if (documentFile !== null || bundleFile !== null) {
|
||||
const separator = bundleFile?.indexOf(SIGNATURE_SEPARATOR) ?? -1;
|
||||
if (bundleFile !== null && separator < 0) throw Error('release.bundle lacks its detached-signature separator.');
|
||||
const document = documentFile ?? bundleFile.slice(0, separator);
|
||||
const signature = documentFile !== null ? await optional('keys/ssh.keys.sig') : bundleFile.slice(separator + SIGNATURE_SEPARATOR.length);
|
||||
signed = await parsePublishedSignedRelease(document, signature, {listId: signedRelease?.listId, checkFreshness: false});
|
||||
keys = signed.keys;
|
||||
}
|
||||
}
|
||||
if (!signed) keys = withoutKeyComments(await parseKeys(input));
|
||||
if (signedRelease?.publicKeyFile) {
|
||||
publicCertificate = validatePublicCertificate(await readFile(join(directory, signedRelease.publicKeyFile), 'utf8'));
|
||||
if (signed && !signed.bundle) throw Error('Configured build signature verification requires a valid detached signature.');
|
||||
await checkSigningCertificate(publicCertificate, signedRelease.fingerprint, signed?.bundle);
|
||||
}
|
||||
const allowEmpty = signed ? signed.metadata.revoke : config.allowEmpty;
|
||||
const needsFallback = keySource.type === 'git' && keys.length === 0 && !allowEmpty && fallbackSources.length > 0;
|
||||
const needsSource = keySource.type === 'gist' || needsFallback;
|
||||
if (keySource.type === 'gist') keys = [];
|
||||
const bundle = needsSource ? {sha256:null,text:null} : signed ? {sha256:digest(keys.map(key=>key.text+'\n').join('')),text:signed.document} : makeKeysText(keys,revision,allowEmpty);
|
||||
const clientDefaults = validateClientDefaults(config.clientDefaults);
|
||||
if (!testFixture && !needsSource && clientDefaults.gpgVerification === 'on') {
|
||||
if (!signed?.signature) throw Error('Verification-enabled static Git releases require a signed document and detached signature.');
|
||||
if (signed.metadata.listId !== clientDefaults.listId) throw Error('Client default list ID differs from the static signed document.');
|
||||
if (signedRelease?.fingerprint && clientDefaults.pinMode === 'primary' && clientDefaults.fingerprint !== signedRelease.fingerprint) throw Error('Client primary fingerprint differs from the configured signing certificate.');
|
||||
}
|
||||
let script = await readFile(join(directory,'conf-sshd.sh'),'utf8');
|
||||
for (const [name,value] of Object.entries({'BASE_URL':config.baseUrl,'DEFAULT_CRON':config.defaultCron})) {
|
||||
if (!script.includes(`@@${name}@@`)) throw Error(`Script is missing @@${name}@@.`);
|
||||
script = script.replaceAll(`@@${name}@@`,value);
|
||||
}
|
||||
for (const [name, value] of Object.entries({DEFAULT_GPG_VERIFY:clientDefaults.gpgVerification,DEFAULT_GPG_FINGERPRINT:clientDefaults.fingerprint,DEFAULT_GPG_PIN_MODE:clientDefaults.pinMode,DEFAULT_LIST_ID:clientDefaults.listId,DEFAULT_GPG_EMAIL:clientDefaults.email})) script = script.replaceAll(`@@${name}@@`, value);
|
||||
if (/@@[A-Z_]+@@/.test(script)) throw Error('Unresolved script template token.');
|
||||
if (!script.includes('# conf-sshd-script-v2')) throw Error('Missing script format marker.');
|
||||
execFileSync('sh',['-n'],{input:script,stdio:['pipe','pipe','pipe']});
|
||||
const release = {schema:1,revision,publishedAt,keyCount:keys.length,allowEmpty:config.allowEmpty,sha256:bundle.sha256,testFixture,baseUrl:config.baseUrl,repositoryUrl:config.repositoryUrl,fallbackSources,needsFallback,keys,commands:commandsFor(config)};
|
||||
const release = {schema:1,revision,publishedAt,keyCount:keys.length,allowEmpty,sha256:bundle.sha256,keyRevision:signed?.metadata.documentSha256 ?? bundle.sha256,testFixture,baseUrl:config.baseUrl,repositoryUrl:config.repositoryUrl,fallbackSources,keySource,signedRelease,clientDefaults,publicCertificate,signedDocument:signed?.document ?? null,signature:signed?.signature ?? null,signatureAvailable:Boolean(signed?.signature),publicCertificateAvailable:Boolean(publicCertificate),signedBundle:signed?.bundle ?? null,signedMetadata:signed?.metadata ?? null,needsFallback,needsSource,keys,commands:commandsFor(config)};
|
||||
let html = await readFile(join(directory,'site/index.html'),'utf8');
|
||||
const publicDir = join(outDirectory,'public'), generatedDir = join(outDirectory,'generated');
|
||||
await rm(publicDir,{recursive:true,force:true});
|
||||
await mkdir(join(publicDir,'assets'),{recursive:true}); await mkdir(generatedDir,{recursive:true});
|
||||
// Git files are true Worker Static Assets as well as exact router response bytes (never Pages).
|
||||
if (!needsSource) await writeFile(join(publicDir,'ssh.keys'), signed?.document ?? bundle.text);
|
||||
if (signed?.signature) await writeFile(join(publicDir,'ssh.keys.sig'), signed.signature);
|
||||
if (publicCertificate) await writeFile(join(publicDir,'public-key.gpg'), publicCertificate);
|
||||
for (const [file,ext] of [['style','css'],['app','js']]) {
|
||||
const body = await readFile(join(directory,`site/assets/${file}.${ext}`));
|
||||
const name = `${file}.${digest(body).slice(0,12)}.${ext}`;
|
||||
@@ -92,9 +146,9 @@ export async function build({directory = root, outDirectory = join(directory,'cf
|
||||
html = html.replaceAll(`/assets/${file}.${ext}`,`/assets/${name}`);
|
||||
}
|
||||
release.pageTemplate = html;
|
||||
await writeFile(join(publicDir,'index.html'),renderPage(html,{...release,source:{type:needsFallback ? 'pending' : keys.length ? 'repository' : 'explicit-empty'}}));
|
||||
await writeFile(join(generatedDir,'release.js'),`// Generated release; do not edit.\nexport default ${JSON.stringify({...release,script,keysText:bundle.text})};\n`);
|
||||
await writeFile(join(generatedDir,'manifest.json'),JSON.stringify({...release,keys:undefined,commands:undefined,pageTemplate:undefined},null,2)+'\n');
|
||||
await writeFile(join(publicDir,'index.html'),renderPage(html,{...release,source:{type:needsSource ? 'pending' : keys.length ? 'repository' : 'explicit-empty'}}));
|
||||
await writeFile(join(generatedDir,'release.js'),`// Generated release; do not edit.\nexport default ${JSON.stringify({...release,script,keysText:signed?.document ?? bundle.text})};\n`);
|
||||
await writeFile(join(generatedDir,'manifest.json'),JSON.stringify({...release,keys:undefined,commands:undefined,pageTemplate:undefined,publicCertificate:undefined,signedDocument:undefined,signature:undefined,signedBundle:undefined},null,2)+'\n');
|
||||
return release;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
// Optional JSON webhook for a separately configured email delivery service.
|
||||
// This sends deployment configuration, not observed server/fleet state.
|
||||
import {readFile} from 'node:fs/promises';
|
||||
import {resolve} from 'node:path';
|
||||
import {fileURLToPath} from 'node:url';
|
||||
|
||||
export function notificationEnabled(value) {
|
||||
if (value === undefined || value === '' || value === 'false') return false;
|
||||
if (value === 'true') return true;
|
||||
throw Error('ENABLE_MAIL_NOTIFICATION must be unset, false, or exactly true.');
|
||||
}
|
||||
|
||||
function httpsUrl(value, name) {
|
||||
let url;
|
||||
try { url = new URL(value); } catch { throw Error(`${name} must be an HTTPS URL.`); }
|
||||
if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw Error(`${name} must be HTTPS without URL credentials or fragments.`);
|
||||
return url.href;
|
||||
}
|
||||
|
||||
export function deploymentPayload(config, env) {
|
||||
if (!config || typeof config !== 'object' || Array.isArray(config)) throw Error('Deployment configuration must be an object.');
|
||||
const status = env.DEPLOYMENT_STATUS;
|
||||
if (!['success','failure','cancelled'].includes(status)) throw Error('DEPLOYMENT_STATUS must be success, failure, or cancelled.');
|
||||
const phase = env.DEPLOYMENT_PHASE;
|
||||
if (!['deployment','remote-verification','complete'].includes(phase)) throw Error('DEPLOYMENT_PHASE must identify the attempted deployment phase.');
|
||||
if (!/^[0-9a-f]{40}$/.test(env.GITHUB_SHA || '')) throw Error('GITHUB_SHA must be an exact 40-hex commit SHA.');
|
||||
if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(env.GITHUB_REPOSITORY || '') || !/^\d+$/.test(env.GITHUB_RUN_ID || '')) throw Error('A valid GitHub repository and run ID are required.');
|
||||
const mode = config.keySource?.type ?? 'git';
|
||||
if (!['git','gist'].includes(mode)) throw Error('Unsupported deployment key source mode.');
|
||||
const listId = config.signedRelease?.listId ?? null;
|
||||
if (listId !== null && (typeof listId !== 'string' || !/^[A-Za-z0-9._-]{1,64}$/.test(listId))) throw Error('Invalid deployment list identity.');
|
||||
const fallbackSources = config.fallbackSources ?? [];
|
||||
if (!Array.isArray(fallbackSources) || fallbackSources.length > 5) throw Error('Invalid deployment fallback sources.');
|
||||
const to = env.MAIL_NOTIFICATION_TO || null;
|
||||
if (to !== null && (to.length > 254 || !/^[^\s@,<>]+@[^\s@,<>]+\.[^\s@,<>]+$/.test(to))) throw Error('MAIL_NOTIFICATION_TO must be one email address.');
|
||||
return {
|
||||
schema:1,
|
||||
event:'worker-deployment',
|
||||
status,
|
||||
phase,
|
||||
repository:env.GITHUB_REPOSITORY,
|
||||
revision:env.GITHUB_SHA,
|
||||
workflowRunUrl:`https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
|
||||
to,
|
||||
configuration:{
|
||||
baseUrl:httpsUrl(config.baseUrl, 'Deployment baseUrl'),
|
||||
mode,
|
||||
listId,
|
||||
signedRelease:Boolean(config.signedRelease),
|
||||
fallbackSources:fallbackSources.map(value => httpsUrl(value,'Deployment fallback source')),
|
||||
},
|
||||
configurationScope:'deployment configuration only; not measured server state',
|
||||
};
|
||||
}
|
||||
|
||||
export async function notifyDeployment({env = process.env, config, fetchImpl = globalThis.fetch} = {}) {
|
||||
if (!notificationEnabled(env.ENABLE_MAIL_NOTIFICATION)) return {sent:false,reason:'disabled'};
|
||||
if (env.GITHUB_ACTIONS !== 'true' || env.CI !== 'true') throw Error('Deployment notification sending is allowed only in GitHub Actions CI.');
|
||||
if (!env.MAIL_NOTIFICATION_WEBHOOK) throw Error('MAIL_NOTIFICATION_WEBHOOK is required when notifications are enabled.');
|
||||
const endpoint = httpsUrl(env.MAIL_NOTIFICATION_WEBHOOK,'Notification webhook');
|
||||
const payload = deploymentPayload(config,env);
|
||||
let response;
|
||||
try {
|
||||
response = await fetchImpl(endpoint, {
|
||||
method:'POST',
|
||||
headers:{'content-type':'application/json'},
|
||||
body:JSON.stringify(payload),
|
||||
redirect:'error',
|
||||
signal:AbortSignal.timeout(10_000),
|
||||
});
|
||||
} catch {
|
||||
// Provider errors may contain secret URL tokens. Do not print them or retry
|
||||
// automatically: a timed-out request may already have sent the email.
|
||||
throw Error('Deployment notification request failed; check the webhook service.');
|
||||
}
|
||||
if (!response.ok) throw Error(`Deployment notification was rejected (HTTP ${response.status}).`);
|
||||
// Do not log response bodies, the recipient, or the secret webhook URL.
|
||||
return {sent:true};
|
||||
}
|
||||
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
try {
|
||||
if (process.argv.length !== 2) throw Error('Usage: node scripts/notify-deployment.mjs');
|
||||
let config;
|
||||
if (notificationEnabled(process.env.ENABLE_MAIL_NOTIFICATION)) {
|
||||
try { config = JSON.parse(await readFile(new URL('../deployment.json',import.meta.url),'utf8')); }
|
||||
catch { throw Error('Cannot read deployment notification configuration.'); }
|
||||
}
|
||||
const result = await notifyDeployment({config});
|
||||
console.log(result.sent ? 'Deployment notification webhook accepted the request.' : 'Deployment notification disabled.');
|
||||
} catch (error) { console.error(error.message); process.exitCode = 1; }
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env node
|
||||
// This preparation tool only reads PUBLIC SSH keys and writes the exact bytes to sign offline.
|
||||
// It never reads a signing private key, invokes gpg signing, or uploads anything.
|
||||
import {readFile, writeFile} from 'node:fs/promises';
|
||||
import {resolve} from 'node:path';
|
||||
import {fileURLToPath} from 'node:url';
|
||||
import {makeSignedDocument, parseSignedDocument, SIGNATURE_SEPARATOR, validateSignature} from '../cf-worker/src/signed-release.js';
|
||||
|
||||
export async function prepare(argv) {
|
||||
const options = {};
|
||||
for (let i = 0; i < argv.length; i++) {
|
||||
const key = argv[i];
|
||||
if (key === '--revoke') { options.revoke = true; continue; }
|
||||
if (!['--input', '--output', '--list-id', '--sequence', '--issued-at', '--expires-at', '--signature', '--bundle'].includes(key) || i + 1 >= argv.length || Object.hasOwn(options, key)) throw Error('Usage: node scripts/prepare-key-release.mjs --input PUBLIC_KEYS --output DOCUMENT --list-id ID --sequence N --issued-at EPOCH --expires-at EPOCH [--revoke]\nOr: --input DOCUMENT --signature SIGNATURE --bundle BUNDLE (pack only after offline signing).');
|
||||
options[key] = argv[++i];
|
||||
}
|
||||
if (options['--bundle']) {
|
||||
if (!options['--input'] || !options['--signature'] || Object.keys(options).some(key => !['--input', '--signature', '--bundle'].includes(key))) throw Error('Packing accepts only --input DOCUMENT --signature SIGNATURE --bundle BUNDLE.');
|
||||
const document = await readFile(options['--input'], 'utf8'), signature = await readFile(options['--signature'], 'utf8');
|
||||
await parseSignedDocument(document, {checkFreshness: false});
|
||||
validateSignature(signature);
|
||||
await writeFile(options['--bundle'], document + SIGNATURE_SEPARATOR + signature, {flag: 'wx', mode: 0o600});
|
||||
return 'Packed exact document and detached signature. Cryptographic verification is still required.';
|
||||
}
|
||||
if (!options['--input'] || !options['--output'] || !options['--list-id'] || options['--signature']) throw Error('Preparation requires --input, --output, --list-id, --sequence, --issued-at and --expires-at.');
|
||||
const numbers = {};
|
||||
for (const [key, field] of [['--sequence','sequence'], ['--issued-at','issuedAt'], ['--expires-at','expiresAt']]) {
|
||||
if (!/^(?:0|[1-9][0-9]{0,9})$/.test(options[key] ?? '')) throw Error(`${key} must be a canonical decimal integer.`);
|
||||
numbers[field] = Number(options[key]);
|
||||
}
|
||||
const document = await makeSignedDocument(await readFile(options['--input'], 'utf8'), {listId: options['--list-id'], ...numbers, revoke: Boolean(options.revoke)});
|
||||
await writeFile(options['--output'], document, {flag: 'wx', mode: 0o600});
|
||||
return 'Prepared comment-free bytes. Sign this exact file offline with an armored detached signature; never rewrite it afterward.';
|
||||
}
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
try { console.log(await prepare(process.argv.slice(2))); } catch (error) { console.error(error.message); process.exitCode = 1; }
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
import {mkdtemp, writeFile, rm} from 'node:fs/promises';
|
||||
import {tmpdir} from 'node:os';
|
||||
import {join} from 'node:path';
|
||||
import {execFileSync} from 'node:child_process';
|
||||
import {SIGNED_RELEASE_LIMITS, parseSignedBundle} from '../cf-worker/src/signed-release.js';
|
||||
|
||||
export function validatePublicCertificate(certificate) {
|
||||
if (typeof certificate !== 'string' || Buffer.byteLength(certificate) > SIGNED_RELEASE_LIMITS.publicKeyBytes || !/^-----BEGIN PGP PUBLIC KEY BLOCK-----\r?\n[\s\S]+\r?\n-----END PGP PUBLIC KEY BLOCK-----\r?\n?$/.test(certificate) || /[^\x09\x0a\x0d\x20-\x7e]/.test(certificate) || (certificate.match(/-----BEGIN /g) || []).length !== 1) throw Error('Expected one bounded ASCII-armored PUBLIC OpenPGP certificate, never private material.');
|
||||
return certificate;
|
||||
}
|
||||
|
||||
/** Uses an ephemeral public-only keyring. Never loads the operator's keyring, signs, or retrieves keys. */
|
||||
export async function checkSigningCertificate(certificate, fingerprint, signed = null) {
|
||||
validatePublicCertificate(certificate);
|
||||
if (typeof fingerprint !== 'string' || !/^[A-Fa-f0-9]{40}$/.test(fingerprint)) throw Error('A full primary signing fingerprint is required.');
|
||||
fingerprint = fingerprint.toUpperCase();
|
||||
const home = await mkdtemp(join(tmpdir(), 'conf-sshd-public-verify-'));
|
||||
const args = ['--no-options', '--homedir', home, '--batch', '--no-tty', '--no-autostart', '--no-auto-key-retrieve', '--auto-key-locate', 'clear'];
|
||||
const gpg = more => {try {return execFileSync('gpg', [...args, ...more], {encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15000, maxBuffer: 4 * 1024 * 1024});} catch {throw Error('GPG public verification command failed.');}};
|
||||
try {
|
||||
const certPath = join(home, 'certificate.asc');
|
||||
await writeFile(certPath, certificate, {mode: 0o600});
|
||||
const packets = gpg(['--list-packets', certPath]);
|
||||
if (/:secret (?:sub )?key packet:/.test(packets)) throw Error('Secret key packets are not accepted.');
|
||||
const listing = gpg(['--with-colons', '--show-keys', certPath]);
|
||||
const records = listing.split('\n').map(line => line.split(':'));
|
||||
const primaries = records.filter(record => record[0] === 'pub');
|
||||
if (primaries.length !== 1 || records.some(record => record[0] === 'sec' || record[0] === 'ssb')) throw Error('The public certificate must contain exactly one primary identity.');
|
||||
if (['r', 'e', 'd'].includes(primaries[0][1]) || (primaries[0][6] && Number(primaries[0][6]) <= Math.floor(Date.now()/1000))) throw Error('Signing public certificate is expired, revoked, or disabled.');
|
||||
const primaryIndex = records.findIndex(record => record[0] === 'pub');
|
||||
const actual = records.slice(primaryIndex + 1).find(record => record[0] === 'fpr')?.[9];
|
||||
if (actual !== fingerprint) throw Error('Signing public certificate fingerprint mismatch.');
|
||||
if (!signed) return fingerprint;
|
||||
const parsed = await parseSignedBundle(signed, {checkFreshness: false});
|
||||
const keyring = join(home, 'public.gpg');
|
||||
gpg(['--output', keyring, '--dearmor', certPath]);
|
||||
const documentPath = join(home, 'document'), signaturePath = join(home, 'signature.asc');
|
||||
await writeFile(documentPath, parsed.document, {mode: 0o600});
|
||||
await writeFile(signaturePath, parsed.signature, {mode: 0o600});
|
||||
let status;
|
||||
try { status = gpg(['--no-default-keyring', '--keyring', keyring, '--status-fd', '1', '--verify', signaturePath, documentPath]); }
|
||||
catch { throw Error('Detached OpenPGP signature verification failed.'); }
|
||||
validatePayloadSignatureStatus(status, fingerprint);
|
||||
return fingerprint;
|
||||
} finally { await rm(home, {recursive: true, force: true}); }
|
||||
}
|
||||
|
||||
export function validatePayloadSignatureStatus(output, fingerprint, now = Math.floor(Date.now() / 1000)) {
|
||||
const records = output.split(/\r?\n/).filter(line => line.startsWith('[GNUPG:] ')).map(line => line.slice(9).split(/ +/));
|
||||
const rejected = new Set(['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']);
|
||||
if (records.some(record => rejected.has(record[0]))) throw Error('Detached signature is invalid, expired, revoked, or unverifiable.');
|
||||
const valid = records.filter(record => record[0] === 'VALIDSIG');
|
||||
if (valid.length !== 1) throw Error('Expected exactly one valid detached signature.');
|
||||
const [, signer, , timestamp, expires, version, , , hash, signatureClass, primary] = valid[0];
|
||||
if (valid[0].length !== 11 || !/^[A-Fa-f0-9]{40}$/.test(signer) || !/^[A-Fa-f0-9]{40}$/.test(primary || '') || version !== '4' || !['8','9','10'].includes(hash) || signatureClass !== '00') throw Error('Payload requires an OpenPGP v4 binary SHA-256/384/512 signature with a full primary fingerprint.');
|
||||
if (!/^\d+$/.test(timestamp) || !/^\d+$/.test(expires) || (Number(expires) !== 0 && Number(expires) <= now)) throw Error('Detached signature has expired or invalid timestamps.');
|
||||
if (primary.toUpperCase() !== fingerprint.toUpperCase()) throw Error('Detached signature primary identity is not pinned.');
|
||||
return {signerFingerprint:signer.toUpperCase(), primaryFingerprint:primary.toUpperCase()};
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
// This verifier and the workflow are trusted repository code, not an immutable
|
||||
// security boundary. Protect changes to both; trusted keys/pins live in Actions
|
||||
// variables outside this commit. No npm packages or repository imports are used.
|
||||
import {spawnSync} from 'node:child_process';
|
||||
import {mkdtemp, writeFile, rm} from 'node:fs/promises';
|
||||
import {tmpdir} from 'node:os';
|
||||
import {join, resolve} from 'node:path';
|
||||
import {fileURLToPath} from 'node:url';
|
||||
|
||||
export function enabledFlag(value, name = 'REQUIRE_GPG_SIGNATURE') {
|
||||
if (value === undefined || value === '' || value === 'false') return false;
|
||||
if (value === 'true') return true;
|
||||
throw Error(`${name} must be unset, false, or exactly true.`);
|
||||
}
|
||||
|
||||
export function parseFingerprints(value) {
|
||||
const values = typeof value === 'string' ? value.trim().split(/[\s,]+/).filter(Boolean) : [];
|
||||
if (!values.length || values.some(value => !/^[0-9a-fA-F]{40}$/.test(value))) {
|
||||
throw Error('GPG_ALLOWED_PRIMARY_FINGERPRINTS must contain full 40-hex OpenPGP v4 primary fingerprints.');
|
||||
}
|
||||
return new Set(values.map(value => value.toUpperCase()));
|
||||
}
|
||||
|
||||
export function verifySignatureStatus(output, allowed, now = Math.floor(Date.now() / 1000)) {
|
||||
const records = output.split(/\r?\n/).filter(line => line.startsWith('[GNUPG:] ')).map(line => line.slice(9).split(/ +/));
|
||||
const rejected = new Set(['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']);
|
||||
if (records.some(record => rejected.has(record[0]))) throw Error('Commit signature is invalid, expired, revoked, or unverifiable.');
|
||||
const valid = records.filter(record => record[0] === 'VALIDSIG');
|
||||
if (valid.length !== 1) throw Error('Expected exactly one valid OpenPGP commit signature.');
|
||||
const [, signer, , timestamp, expires, version, , , hash, signatureClass, primary] = valid[0];
|
||||
if (valid[0].length !== 11 || !/^[A-Fa-f0-9]{40}$/.test(signer) || !/^[A-Fa-f0-9]{40}$/.test(primary || '') || version !== '4' || !['8','9','10'].includes(hash) || signatureClass !== '00') {
|
||||
throw Error('Commit requires an OpenPGP v4 SHA-256/384/512 signature with full primary fingerprint.');
|
||||
}
|
||||
if (!/^\d+$/.test(timestamp) || !/^\d+$/.test(expires) || (Number(expires) !== 0 && Number(expires) <= now)) throw Error('Commit signature has expired or invalid timestamps.');
|
||||
if (!allowed.has(primary.toUpperCase())) throw Error('Commit signer primary fingerprint is not pinned.');
|
||||
return {signerFingerprint:signer.toUpperCase(), primaryFingerprint:primary.toUpperCase()};
|
||||
}
|
||||
|
||||
function run(command, args, {cwd, env, input} = {}) {
|
||||
const result = spawnSync(command, args, {cwd, env, input, encoding:'utf8', timeout:30_000, maxBuffer:4 * 1024 * 1024});
|
||||
// Never relay GPG key text/UIDs or arbitrary subprocess errors into CI logs.
|
||||
if (result.error || result.status !== 0 || result.signal) throw Error(`${command === 'git' ? 'Git' : 'GPG'} verification command failed.`);
|
||||
return result;
|
||||
}
|
||||
|
||||
export async function verifyCommitSignature({env = process.env, directory = process.cwd()} = {}) {
|
||||
const required = enabledFlag(env.REQUIRE_GPG_SIGNATURE);
|
||||
const revision = env.GITHUB_SHA;
|
||||
if (!/^[0-9a-f]{40}$/.test(revision || '')) throw Error('GITHUB_SHA must be the exact 40-hex commit SHA.');
|
||||
const cleanEnv = {...env, GIT_CONFIG_NOSYSTEM:'1', GIT_CONFIG_GLOBAL:'/dev/null', GIT_NO_REPLACE_OBJECTS:'1'};
|
||||
const head = run('git', ['-c','core.fsmonitor=false','rev-parse','--verify','HEAD'], {cwd:directory,env:cleanEnv}).stdout.trim();
|
||||
if (head !== revision) throw Error('Checked-out HEAD does not match GITHUB_SHA.');
|
||||
if (!required) return {required:false,revision};
|
||||
const allowed = parseFingerprints(env.GPG_ALLOWED_PRIMARY_FINGERPRINTS);
|
||||
const publicKeys = env.GPG_PUBLIC_KEYS;
|
||||
if (typeof publicKeys !== 'string' || !publicKeys.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----') || publicKeys.includes('PRIVATE KEY')) throw Error('GPG_PUBLIC_KEYS must contain externally configured armored public keys only.');
|
||||
const home = await mkdtemp(join(tmpdir(), 'conf-sshd-gpg-'));
|
||||
try {
|
||||
const gpgEnv = {...cleanEnv, GNUPGHOME:home};
|
||||
const options = ['--no-options','--homedir',home,'--batch','--no-tty','--no-autostart','--no-auto-key-retrieve','--auto-key-locate','clear'];
|
||||
// Decode into an isolated legacy public keyring without importing keys or
|
||||
// contacting gpg-agent. This also avoids starting secret-key services in CI.
|
||||
const listing = run('gpg', [...options,'--with-colons','--show-keys'], {env:gpgEnv,input:publicKeys}).stdout;
|
||||
if (!/^pub:/m.test(listing) || /^(?:sec|ssb):/m.test(listing)) throw Error('Only public verification keys are allowed.');
|
||||
run('gpg', [...options,'--output',join(home,'public.gpg'),'--dearmor'], {env:gpgEnv,input:publicKeys});
|
||||
const wrapper = join(home,'verify-gpg');
|
||||
await writeFile(wrapper, '#!/bin/sh\nexec gpg --no-options --homedir "$GNUPGHOME" --no-default-keyring --keyring "$GNUPGHOME/public.gpg" --batch --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear "$@"\n', {mode:0o700});
|
||||
const result = run('git', ['-c','core.fsmonitor=false','-c','gpg.format=openpgp','-c',`gpg.program=${wrapper}`,'-c',`gpg.openpgp.program=${wrapper}`,'verify-commit','--raw',revision], {cwd:directory,env:gpgEnv});
|
||||
return {required:true,revision,...verifySignatureStatus(result.stderr,allowed)};
|
||||
} finally {
|
||||
await rm(home,{recursive:true,force:true});
|
||||
}
|
||||
}
|
||||
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
try {
|
||||
if (process.argv.length !== 2) throw Error('Usage: node scripts/verify-commit-signature.mjs');
|
||||
const result = await verifyCommitSignature();
|
||||
console.log(result.required ? `Verified commit ${result.revision} with pinned primary ${result.primaryFingerprint}.` : `GPG commit gate disabled; checked exact commit ${result.revision}.`);
|
||||
} catch (error) { console.error(error.message); process.exitCode = 1; }
|
||||
}
|
||||
+78
-25
@@ -1,29 +1,82 @@
|
||||
import {readFile} from 'node:fs/promises';
|
||||
import {resolve} from 'node:path';
|
||||
import {fileURLToPath} from 'node:url';
|
||||
import {createHash} from 'node:crypto';
|
||||
import {parsePublicKeys} from '../cf-worker/src/key-source.js';
|
||||
const manifest=JSON.parse(await readFile(new URL('../cf-worker/generated/manifest.json',import.meta.url),'utf8'));
|
||||
if (manifest.testFixture) throw Error('Refusing to deploy a test-fixture build. Run the production build with real server public keys.');
|
||||
if (!process.argv.includes('--remote')) { console.log(`Production release verified: ${manifest.revision}`); }
|
||||
else {
|
||||
const timeout=()=>AbortSignal.timeout(20000);
|
||||
const metadataResponse=await fetch(manifest.baseUrl+'/release.json',{cache:'no-store',signal:timeout()});
|
||||
if(!metadataResponse.ok) throw Error(`Metadata endpoint returned ${metadataResponse.status}`);
|
||||
const metadata=await metadataResponse.json();
|
||||
if(metadata.revision!==manifest.revision||metadata.testFixture) throw Error('Remote release does not match this build.');
|
||||
if(!/^[0-9a-f]{64}$/.test(metadata.sha256)) throw Error('Remote key digest is invalid.');
|
||||
if(manifest.needsFallback) {
|
||||
if(metadata.source?.type!=='fallback'||!manifest.fallbackSources.includes(metadata.source.url)||metadata.keyCount<1)throw Error('Unexpected effective fallback source.');
|
||||
} else if(metadata.sha256!==manifest.sha256) throw Error('Remote repository keys differ from this build.');
|
||||
const keysResponse=await fetch(manifest.baseUrl+'/ssh.keys',{cache:'no-store',signal:timeout()});
|
||||
if(!keysResponse.ok) throw Error(`Keys endpoint returned ${keysResponse.status}`);
|
||||
const keysText=await keysResponse.text();
|
||||
const match=/^# conf-sshd-v1\n# revision ([0-9a-f]{40})\n# key-count (0|[1-9][0-9]*)\n# allow-empty (yes|no)\n# sha256 ([0-9a-f]{64})\n# end-metadata\n([\s\S]*)$/.exec(keysText);
|
||||
if(!match||match[1]!==manifest.revision)throw Error('Remote key manifest invalid.');
|
||||
const [, , count, empty, hash, payload]=match;
|
||||
if(createHash('sha256').update(payload).digest('hex')!==hash) throw Error('Remote key body does not match its response digest.');
|
||||
const keys=await parsePublicKeys(payload);
|
||||
if(keys.length!==Number(count)||(!keys.length&&(!manifest.allowEmpty||empty!=='yes')))throw Error('Remote key count/empty policy invalid.');
|
||||
if(!manifest.needsFallback&&hash!==manifest.sha256)throw Error('Remote repository key payload differs from this build.');
|
||||
// Dynamic fallback may legitimately change between the two requests; each response is checked independently.
|
||||
console.log(`Remote code release verified: ${metadata.revision}; key payload ${hash} (${count} keys).`);
|
||||
import {parseSignedDocument, SIGNATURE_SEPARATOR, SIGNED_RELEASE_LIMITS, withoutKeyComments, validateSignature} from '../cf-worker/src/signed-release.js';
|
||||
import {checkSigningCertificate} from './signature-tools.mjs';
|
||||
const hash = text => createHash('sha256').update(text).digest('hex');
|
||||
const root = new URL('../', import.meta.url);
|
||||
|
||||
async function remoteText(url, maxBytes, {allowMissing = false, fetchImpl = fetch} = {}) {
|
||||
const signal = AbortSignal.timeout(20000);
|
||||
const response = await fetchImpl(url, {cache: 'no-store', redirect: 'error', signal});
|
||||
if (allowMissing && response.status === 404) { await response.body?.cancel(); return null; }
|
||||
if (response.status !== 200) { await response.body?.cancel(); throw Error(`Endpoint returned HTTP ${response.status}.`); }
|
||||
const reader = response.body?.getReader();
|
||||
if (!reader) return '';
|
||||
let bytes = new Uint8Array(Math.min(16384,maxBytes)), size = 0;
|
||||
try {
|
||||
while (true) {
|
||||
const {value, done} = await reader.read();
|
||||
if (done) break;
|
||||
size += value.byteLength;
|
||||
if (size > maxBytes) throw Error('Remote response exceeds its size limit.');
|
||||
if (size > bytes.length) { const grown = new Uint8Array(Math.min(maxBytes, Math.max(size, bytes.length * 2))); grown.set(bytes); bytes = grown; }
|
||||
bytes.set(value,size-value.byteLength);
|
||||
}
|
||||
return new TextDecoder('utf-8', {fatal: true}).decode(bytes.subarray(0,size));
|
||||
} finally { await reader.cancel().catch(() => {}); reader.releaseLock(); }
|
||||
}
|
||||
|
||||
export async function verifyRemote(manifest, fetchImpl = fetch) {
|
||||
const read = (path, maxBytes, allowMissing = false) => remoteText(manifest.baseUrl + path, maxBytes, {allowMissing, fetchImpl});
|
||||
const metadata = JSON.parse(await read('/release.json', 64 * 1024));
|
||||
if (metadata.revision !== manifest.revision || metadata.testFixture) throw Error('Remote release does not match this build.');
|
||||
if (!/^[0-9a-f]{64}$/.test(metadata.sha256)) throw Error('Remote key digest is invalid.');
|
||||
const dynamic = manifest.needsSource || manifest.needsFallback || manifest.keySource?.type === 'gist';
|
||||
if (dynamic) {
|
||||
const source = metadata.source;
|
||||
const acceptedFallback = source?.type === 'fallback' && manifest.fallbackSources.includes(source.url);
|
||||
const acceptedGist = manifest.keySource?.type === 'gist' && source?.type === 'gist' && source.id === manifest.keySource.id && source.ownerId === manifest.keySource.ownerId && /^[0-9a-f]{40}$/.test(source.gistRevision);
|
||||
if (!acceptedFallback && !acceptedGist) throw Error('Unexpected effective dynamic source.');
|
||||
} else if (metadata.sha256 !== manifest.sha256) throw Error('Remote repository keys differ from this build.');
|
||||
const document = await read('/ssh.keys', SIGNED_RELEASE_LIMITS.documentBytes);
|
||||
let count, payloadHash, cryptoNote = "";
|
||||
if (document.startsWith('# conf-sshd-signed-v1\n')) {
|
||||
const parsed = await parseSignedDocument(document, {listId: manifest.signedRelease?.listId, checkFreshness: false});
|
||||
count = parsed.keys.length;
|
||||
payloadHash = hash(parsed.keys.map(key => key.text + '\n').join(''));
|
||||
if (!dynamic && parsed.metadata.documentSha256 !== manifest.signedMetadata?.documentSha256) throw Error('Remote signed document differs from this build.');
|
||||
// Each detached signature must validate THIS exact document; an update race fails safely and can be retried.
|
||||
const signature = await read('/ssh.keys.sig', SIGNED_RELEASE_LIMITS.signatureBytes, true);
|
||||
if (manifest.signedRelease?.publicKeyFile) {
|
||||
if (signature === null) throw Error('Remote signature is missing.');
|
||||
const certificate = await read('/public-key.gpg', SIGNED_RELEASE_LIMITS.publicKeyBytes);
|
||||
await checkSigningCertificate(certificate, manifest.signedRelease.fingerprint, document + SIGNATURE_SEPARATOR + signature);
|
||||
} else {
|
||||
if ((manifest.signatureAvailable || manifest.clientDefaults?.gpgVerification === 'on') && signature === null) throw Error('Expected remote signature is missing.');
|
||||
if (signature !== null) validateSignature(signature);
|
||||
cryptoNote = ' OpenPGP not checked: no build verification certificate configured.';
|
||||
}
|
||||
} else {
|
||||
const match = /^# conf-sshd-v1\n# revision ([0-9a-f]{40})\n# key-count (0|[1-9][0-9]*)\n# allow-empty (yes|no)\n# sha256 ([0-9a-f]{64})\n# end-metadata\n([\s\S]*)$/.exec(document);
|
||||
if (!match || match[1] !== manifest.revision) throw Error('Remote key manifest invalid.');
|
||||
const [, , countText, empty, digest, payload] = match;
|
||||
if (hash(payload) !== digest) throw Error('Remote key body does not match its response digest.');
|
||||
const keys = await parsePublicKeys(payload);
|
||||
count = keys.length; payloadHash = digest;
|
||||
if (keys.length !== Number(countText) || (!keys.length && (!manifest.allowEmpty || empty !== 'yes')) || withoutKeyComments(keys).map(key => key.text + '\n').join('') !== payload) throw Error('Remote key count/empty/canonical policy invalid.');
|
||||
if (manifest.clientDefaults?.gpgVerification === 'on') throw Error('Verification-enabled clients require a signed-format document.');
|
||||
}
|
||||
if (!dynamic && payloadHash !== manifest.sha256) throw Error('Remote repository payload differs from this build.');
|
||||
// Dynamic sources may change between requests; build revision is independent of key sequence/digest.
|
||||
return `Remote code release checked: ${metadata.revision}; key payload ${payloadHash} (${count} keys).${cryptoNote}`;
|
||||
}
|
||||
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
const manifest = JSON.parse(await readFile(new URL('cf-worker/generated/manifest.json', root), 'utf8'));
|
||||
if (manifest.testFixture) throw Error('Refusing to deploy a test-fixture build. Run the production build with real server public keys.');
|
||||
if (!process.argv.includes('--remote')) console.log(`Production release checked: ${manifest.revision}`);
|
||||
else console.log(await verifyRemote(manifest));
|
||||
}
|
||||
|
||||
@@ -8,7 +8,6 @@
|
||||
const dialog = document.getElementById("copy-fallback");
|
||||
const fallbackText = document.getElementById("fallback-text");
|
||||
const closeFallback = document.getElementById("close-copy-fallback");
|
||||
const allKeysButton = document.getElementById("copy-all-keys");
|
||||
const validThemes = new Set(["system", "light", "dark"]);
|
||||
const resetTimers = new WeakMap();
|
||||
let fallbackTrigger = null;
|
||||
@@ -115,23 +114,5 @@
|
||||
button.addEventListener("click", () => copy(target.textContent, button));
|
||||
});
|
||||
|
||||
let keys = [];
|
||||
try {
|
||||
const release = JSON.parse(document.getElementById("release-data")?.textContent || "{}");
|
||||
if (Array.isArray(release.keys) && release.keys.every((key) => typeof key.text === "string" && key.text.length > 0)) {
|
||||
keys = release.keys.map((key) => key.text);
|
||||
}
|
||||
} catch {
|
||||
// Prerendered content remains usable if release metadata is unavailable.
|
||||
}
|
||||
if (keys.length === 0) {
|
||||
keys = Array.from(document.querySelectorAll(".key-card pre code"), (code) => code.textContent).filter(Boolean);
|
||||
}
|
||||
if (allKeysButton) {
|
||||
allKeysButton.disabled = keys.length === 0;
|
||||
if (keys.length === 0) allKeysButton.setAttribute("title", "暂无可复制的公钥");
|
||||
allKeysButton.addEventListener("click", () => copy(`${keys.join("\n")}\n`, allKeysButton));
|
||||
}
|
||||
|
||||
root.classList.add("enhanced");
|
||||
})();
|
||||
|
||||
+8
-12
@@ -103,19 +103,16 @@ h1 { margin: 0; font-size: clamp(30px, 3.4vw, 42px); font-weight: 650; letter-sp
|
||||
.section-index { color: var(--subtle); font-size: 10px; margin: 0 0 8px; }
|
||||
.section-heading h2 { font-size: 23px; font-weight: 650; letter-spacing: -0.45px; line-height: 1.4; margin: 0; }
|
||||
.section-heading p:not(.section-index) { color: var(--muted); font-size: 12px; margin: 7px 0 0; max-width: 690px; }
|
||||
.section-actions { display: flex; align-items: center; gap: 18px; flex-shrink: 0; padding-bottom: 2px; }
|
||||
.section-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 18px; flex-shrink: 0; padding-bottom: 2px; }
|
||||
.text-link { white-space: nowrap; color: var(--muted); font-size: 12px; }
|
||||
.text-link span { margin-left: 4px; }
|
||||
.keys-notice { margin: 0 0 15px; padding: 12px 15px; border: 1px solid var(--line); border-radius: 8px; background: var(--surface-soft); color: var(--muted); font-size: 12px; }
|
||||
.keys-notice:empty { display: none; }
|
||||
.key-list, .command-list { display: grid; gap: 14px; min-width: 0; }
|
||||
.command-list { display: grid; gap: 14px; min-width: 0; }
|
||||
.command-list { grid-template-columns: repeat(2, minmax(0, 1fr)); }
|
||||
.key-card, .command-card { min-width: 0; border: 1px solid var(--line); border-radius: 12px; background: var(--surface); overflow: hidden; }
|
||||
.key-card { padding: 18px; }
|
||||
.command-card { min-width: 0; border: 1px solid var(--line); border-radius: 12px; background: var(--surface); overflow: hidden; }
|
||||
.card-heading { display: flex; align-items: flex-start; gap: 12px; justify-content: space-between; min-width: 0; }
|
||||
.card-heading h3 { min-width: 0; overflow-wrap: anywhere; font-size: 13px; font-weight: 600; margin: 0; line-height: 1.65; }
|
||||
.key-type { flex-shrink: 0; max-width: 40%; overflow-wrap: anywhere; border: 1px solid var(--line); background: var(--surface-soft); border-radius: 4px; padding: 1px 7px; color: var(--muted); font: 10px/1.6 ui-monospace, SFMono-Regular, Consolas, monospace; }
|
||||
.fingerprint { color: var(--subtle); font: 11px/1.65 ui-monospace, SFMono-Regular, Consolas, monospace; margin: 6px 0 12px; overflow-wrap: anywhere; }
|
||||
.code-block { position: relative; min-width: 0; border: 1px solid var(--line); border-radius: 7px; background: var(--code); }
|
||||
pre { overflow-x: auto; margin: 0; padding: 14px 62px 14px 14px; white-space: pre; scrollbar-width: thin; scrollbar-color: var(--line) transparent; }
|
||||
code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace; font-size: 11px; line-height: 1.8; }
|
||||
@@ -129,8 +126,6 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Libe
|
||||
.copy-button[data-state="success"] { color: var(--accent); background: var(--accent-soft); border-color: var(--accent-line); }
|
||||
.copy-button[data-state="success"]::before { width: 7px; height: 13px; left: calc(var(--icon-center) - 4px); top: 8px; border: solid currentColor; border-width: 0 2px 2px 0; border-radius: 0; transform: rotate(45deg); }
|
||||
.copy-button[data-state="success"]::after { display: none; }
|
||||
.copy-all { --icon-center: 19px; width: auto; gap: 8px; padding: 0 12px 0 38px; color: var(--accent); font-size: 12px; font-weight: 600; }
|
||||
.copy-all:disabled { opacity: 0.55; }
|
||||
.public-notice { display: flex; align-items: flex-start; gap: 9px; margin-top: 15px; color: var(--subtle); font-size: 11px; }
|
||||
.public-notice p { margin: 0; }
|
||||
.notice-icon { display: grid; place-items: center; flex: 0 0 14px; height: 14px; margin-top: 2px; border: 1px solid var(--subtle); border-radius: 50%; font: 10px/1 serif; }
|
||||
@@ -143,6 +138,9 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Libe
|
||||
.advanced-commands summary::marker { color: var(--subtle); }
|
||||
.advanced-commands[open] summary { border-bottom: 1px solid var(--line); }
|
||||
.advanced-commands > .command-list { padding: 15px; }
|
||||
.trust-steps { margin: 0; padding-left: 22px; color: var(--muted); font-size: 12px; }
|
||||
.trust-steps li { padding-left: 4px; margin-block: 10px; }
|
||||
.trust-steps a { color: var(--accent); }
|
||||
.command-note { font-size: 11px; color: var(--subtle); margin: 14px 0 0; }
|
||||
.empty-state { padding: 26px; border: 1px dashed var(--line); border-radius: 10px; color: var(--muted); text-align: center; }
|
||||
.preview-notice { margin: 24px 0 0; padding: 12px 16px; border: 1px solid var(--accent-line); border-radius: 8px; background: var(--accent-soft); color: var(--accent); font-size: 12px; }
|
||||
@@ -204,16 +202,14 @@ dialog::backdrop { background: rgb(10 22 15 / 52%); }
|
||||
.section-heading h2 { font-size: 21px; }
|
||||
.section-actions { width: 100%; justify-content: space-between; }
|
||||
.commands-section > .section-heading > .text-link { margin-top: -3px; }
|
||||
.key-card, .command-card { padding: 14px; }
|
||||
.command-card { padding: 14px; }
|
||||
.command-list { grid-template-columns: minmax(0, 1fr); gap: 12px; }
|
||||
.card-heading { gap: 8px; }
|
||||
.fingerprint { font-size: 10px; }
|
||||
pre { padding-left: 12px; padding-block: 16px; }
|
||||
.copy-button { width: 40px; height: 40px; }
|
||||
.copy-button::before { top: 11px; }
|
||||
.copy-button::after { top: 15px; }
|
||||
.copy-button[data-state="success"]::before { top: 10px; }
|
||||
.copy-all { width: auto; }
|
||||
.public-notice { font-size: 11px; }
|
||||
.site-footer { flex-direction: column; align-items: flex-start; gap: 12px; padding: 22px 0 26px; }
|
||||
dialog { padding: 20px; }
|
||||
@@ -224,5 +220,5 @@ dialog::backdrop { background: rgb(10 22 15 / 52%); }
|
||||
.page-shell { width: 100%; }
|
||||
.hero { padding-block: 24px; }
|
||||
pre { white-space: pre-wrap; overflow-wrap: anywhere; }
|
||||
.key-card, .command-card { break-inside: avoid; }
|
||||
.command-card { break-inside: avoid; }
|
||||
}
|
||||
|
||||
+24
-15
@@ -4,13 +4,13 @@
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="color-scheme" content="light dark">
|
||||
<meta name="description" content="查看当前已发布的 SSH 公钥，复制服务器配置命令。Quickly Configuring SSH Server。">
|
||||
<title>SSH 公钥与快速部署 · Quickly Configuring SSH Server</title>
|
||||
<meta name="description" content="查看 SSH 公钥发布状态，复制服务器配置命令。Quickly Configuring SSH Server。">
|
||||
<title>SSH 发布状态与快速部署 · Quickly Configuring SSH Server</title>
|
||||
<link rel="stylesheet" href="/assets/style.css">
|
||||
<script src="/assets/app.js" defer></script>
|
||||
</head>
|
||||
<body>
|
||||
<a class="skip-link" href="#public-keys">跳到 SSH 公钥</a>
|
||||
<a class="skip-link" href="#key-status">跳到发布状态</a>
|
||||
<div class="page-shell">
|
||||
<header class="site-header">
|
||||
<a class="brand" href="/" aria-label="Quickly Configuring SSH Server 首页">
|
||||
@@ -36,8 +36,8 @@
|
||||
<div class="hero-copy">
|
||||
<p class="eyebrow"><span class="status-dot" aria-hidden="true"></span> SSH KEY DISTRIBUTION</p>
|
||||
<h1 id="page-title">公钥集中管理，<br>服务器快速就绪。</h1>
|
||||
<p class="hero-description">核对公钥，选择命令，配置 SSH。<br class="wide-only">查看当前公钥来源与内容版本，按需部署。</p>
|
||||
<div class="hero-links"><a href="#public-keys">查看公钥 <span aria-hidden="true">↓</span></a><a href="#quick-start">快速开始 <span aria-hidden="true">↓</span></a></div>
|
||||
<p class="hero-description">查看发布状态，选择命令，配置 SSH。<br class="wide-only">查看当前公钥来源与内容版本，按需部署。</p>
|
||||
<div class="hero-links"><a href="#key-status">发布状态 <span aria-hidden="true">↓</span></a><a href="#quick-start">快速开始 <span aria-hidden="true">↓</span></a></div>
|
||||
</div>
|
||||
<aside class="release-card" aria-labelledby="release-title">
|
||||
<div class="release-heading"><h2 id="release-title">版本与公钥来源</h2><span class="release-badge">@@RELEASE_LABEL@@</span></div>
|
||||
@@ -46,32 +46,41 @@
|
||||
<div><dt>公钥版本</dt><dd><code class="release-revision">@@CONTENT_REVISION@@</code></dd></div>
|
||||
<div><dt>公钥来源</dt><dd class="source-label">@@SOURCE_LABEL@@</dd></div>
|
||||
<div><dt>来源状态</dt><dd class="source-status">@@SOURCE_STATUS@@</dd></div>
|
||||
<div><dt>签名状态</dt><dd class="signature-status">@@SIGNATURE_STATUS@@</dd></div>
|
||||
<div><dt>证书状态</dt><dd class="certificate-status">@@CERTIFICATE_STATUS@@</dd></div>
|
||||
<div><dt>发布时间</dt><dd><time datetime="@@PUBLISHED_AT@@">@@PUBLISHED_AT@@</time></dd></div>
|
||||
<div><dt>公开密钥</dt><dd><strong class="key-count">@@KEY_COUNT@@</strong><span class="count-unit"> 个</span></dd></div>
|
||||
<div><dt>公钥数量</dt><dd><strong class="key-count">@@KEY_COUNT@@</strong><span class="count-unit"> 个</span></dd></div>
|
||||
</dl>
|
||||
<p class="release-note">此处展示代码发布与当前公钥来源，不代表所有服务器均已同步。</p>
|
||||
</aside>
|
||||
</section>
|
||||
|
||||
<section id="public-keys" class="content-section" aria-labelledby="keys-title">
|
||||
<section id="key-status" class="content-section" aria-labelledby="keys-title">
|
||||
<div class="section-heading">
|
||||
<div><p class="section-index">01 / PUBLIC KEYS</p><h2 id="keys-title">SSH 公钥</h2><p>部署前，请核对指纹及密钥归属。</p></div>
|
||||
<div class="section-actions"><a class="text-link" href="/ssh.keys">原始文件 <span aria-hidden="true">↗</span></a><button id="copy-all-keys" class="copy-button copy-all" type="button" aria-label="复制全部公钥" title="复制全部公钥" data-enhance><span>复制全部</span></button></div>
|
||||
<div><p class="section-index">01 / RELEASE STATUS</p><h2 id="keys-title">公钥发布状态</h2><p>首页仅展示来源、状态、数量与内容摘要，不展示公钥列表、指纹或注释。</p></div>
|
||||
<div class="section-actions"><a class="text-link" href="/ssh.keys.sig">独立签名接口 <span aria-hidden="true">↗</span></a><a class="text-link" href="/ssh.keys">公钥原始接口 <span aria-hidden="true">↗</span></a>@@CERTIFICATE_LINK@@</div>
|
||||
</div>
|
||||
<p class="keys-notice" role="note">@@KEYS_NOTICE@@</p>
|
||||
<div class="key-list">@@KEYS_HTML@@</div>
|
||||
<div class="public-notice"><span class="notice-icon" aria-hidden="true">i</span><p>这里展示的是公开密钥。私钥应始终由你保管，本页面不会要求上传或输入私钥。</p></div>
|
||||
<div class="public-notice"><span class="notice-icon" aria-hidden="true">i</span><p>公钥不是秘密：原始 API 与公开 Git / Gist 仍可能提供公钥内容。私钥应留在离线环境，本页面不会要求上传或输入私钥。</p></div>
|
||||
</section>
|
||||
|
||||
<section id="quick-start" class="content-section commands-section" aria-labelledby="commands-title">
|
||||
<div class="section-heading"><div><p class="section-index">02 / QUICK START</p><h2 id="commands-title">按需选择，复制即用</h2><p>以下命令会在你执行后修改服务器配置。请先检查脚本，并保留当前 SSH 会话以验证新连接。</p></div><a class="text-link" href="/script.sh">查看脚本 <span aria-hidden="true">↗</span></a></div>
|
||||
<div class="section-heading"><div><p class="section-index">02 / QUICK START</p><h2 id="commands-title">按需选择，复制即用</h2><p>首次安装的快捷命令会立即执行下载脚本。推荐先检查并独立核验安装脚本；高信任安装可按下方指引操作。修改 SSH 配置时保留当前会话以验证新连接。</p></div><a class="text-link" href="/script.sh">查看脚本 <span aria-hidden="true">↗</span></a></div>
|
||||
<div class="command-list">@@COMMANDS_HTML@@</div>
|
||||
<p class="command-note">每条命令独立使用。高级选项涉及 SSH 登录策略或卸载，请阅读说明后操作。</p>
|
||||
<p class="command-note">每条命令独立使用。同步、预览及高级命令须先安装。脚本一旦落盘，日常同步不会替换可执行代码或本地信任指纹；更新脚本须在服务器重新安装。</p>
|
||||
</section>
|
||||
<noscript><p class="noscript-notice">JavaScript 已关闭，公钥与命令仍可查看并手动选择复制。启用 JavaScript 后可使用复制按钮与外观设置。</p></noscript>
|
||||
<section id="trust-guidance" class="content-section" aria-labelledby="trust-title">
|
||||
<div class="section-heading"><div><p class="section-index">03 / LOCAL TRUST</p><h2 id="trust-title">先核验，再建立本地信任</h2><p>签名文件存在，不代表 Worker 已验证签名。客户端验签默认关闭，须在服务器本地明确启用。</p></div><a class="text-link" href="@@REPOSITORY_URL@@#readme" target="_blank" rel="noopener noreferrer">完整安装说明 <span aria-hidden="true">↗</span></a></div>
|
||||
<ol class="trust-steps">
|
||||
<li>推荐从独立可信渠道取得安装脚本预期 SHA-256，下载、检查脚本并比对摘要后再执行。首次安装或明确重装都会信任你执行的脚本；与脚本同源取得的摘要无法建立独立信任。签名证书 pin 仍须独立核验。</li>
|
||||
<li>可使用安装参数 --install --gpg-verification on，以 --gpg-fingerprint 固定独立核验的完整指纹，并指定 --list-id。--gpg-pin-mode 默认 primary，信任主钥及其有效绑定的签名子钥，也可选 subkey 固定签名子钥；安装或更换信任时须在服务器本地终端确认完整指纹，不能跳过确认；远端发布内容不能关闭本地验签。</li>
|
||||
<li>关闭验签时，客户端仅获取 <a class="text-link" href="/ssh.keys">/ssh.keys</a>，不请求签名或证书；启用后还须取得 <a class="text-link" href="/ssh.keys.sig">/ssh.keys.sig</a>，两者均返回 200，客户端使用已验证并保存的本地证书核验公钥文档原始字节，全部通过才接受。证书仅在本地安装流程中发现并固定，日常同步不联网刷新证书；获取或验证失败保留已有公钥。签名私钥始终离线保管。</li>
|
||||
</ol>
|
||||
</section>
|
||||
<noscript><p class="noscript-notice">JavaScript 已关闭，发布状态与命令仍可查看并手动选择复制。启用 JavaScript 后可使用复制按钮与外观设置。</p></noscript>
|
||||
</main>
|
||||
|
||||
<footer class="site-footer"><span>Quickly Configuring SSH Server</span><div><a href="/ssh.keys">ssh.keys</a><a href="/script.sh">script.sh</a><a href="@@REPOSITORY_URL@@" target="_blank" rel="noopener noreferrer">源代码<span class="sr-only">（新窗口打开）</span></a></div></footer>
|
||||
<footer class="site-footer"><span>Quickly Configuring SSH Server</span><div><a href="/ssh.keys.sig">ssh.keys.sig</a><a href="/ssh.keys">ssh.keys</a><a href="/script.sh">script.sh</a><a href="@@REPOSITORY_URL@@" target="_blank" rel="noopener noreferrer">源代码<span class="sr-only">（新窗口打开）</span></a></div></footer>
|
||||
</div>
|
||||
|
||||
<p id="copy-status" class="sr-only" role="status" aria-live="polite" aria-atomic="true"></p>
|
||||
|
||||
@@ -12,7 +12,7 @@ export async function startBrowserFixture() {
|
||||
readFile(new URL("./fixtures/keys.pub", import.meta.url), "utf8"),
|
||||
]);
|
||||
const [type, encoded] = fixtureKey.trim().split(/\s+/);
|
||||
const comment = 'CI test <img src=x onerror="window.__injected=true"> & "quoted" 中文 ' + "long-comment-".repeat(90);
|
||||
const comment = 'HOMEPAGE-MUST-NOT-LEAK-COMMENT CI test <img src=x onerror="window.__injected=true"> & "quoted" 中文 ' + "long-comment-".repeat(90);
|
||||
const text = `${type} ${encoded} ${comment}`;
|
||||
const key = {
|
||||
type,
|
||||
@@ -32,13 +32,15 @@ export async function startBrowserFixture() {
|
||||
...config,
|
||||
commands: commandsFor(config),
|
||||
keys: [key],
|
||||
signedMetadata: null,
|
||||
};
|
||||
const snapshots = {
|
||||
repository: { ...base, source: { type: "repository" } },
|
||||
repository: { ...base, publicCertificate: "HOMEPAGE-MUST-NOT-LEAK-CERTIFICATE", source: { type: "repository" } },
|
||||
gist: { ...base, keyRevision: "d".repeat(64), signedMetadata: {listId: "fixture-signing-list", sequence: 42, documentSha256: "d".repeat(64)}, keysText: text, signedDocument: text, signature: "-----BEGIN PGP SIGNATURE-----\nComment: HOMEPAGE-MUST-NOT-LEAK-SIGNATURE\n\nAQID\n-----END PGP SIGNATURE-----\n", signedBundle: text, source: {type: "gist", id: "f".repeat(32), gistRevision: "e".repeat(40), url: "https://gist.github.com/example/" + "f".repeat(32) + "/" + "e".repeat(40), extraPrivateComment: comment} },
|
||||
fallback: { ...base, source: { type: "fallback", url: "https://keys.example.test/team.keys?comment=<script>window.__injected=true</script>" } },
|
||||
unavailable: { ...base, keys: [], keyCount: 0, sha256: null, source: { type: "unavailable" } },
|
||||
pending: { ...base, keys: [], keyCount: 0, sha256: null, source: { type: "pending" } },
|
||||
"explicit-empty": { ...base, allowEmpty: true, keys: [], keyCount: 0, sha256: createHash("sha256").update("").digest("hex"), source: { type: "explicit-empty" } },
|
||||
"explicit-empty": { ...base, allowEmpty: true, signedMetadata: {listId: "fixture-signing-list", sequence: 43, revoke: true}, keys: [], keyCount: 0, sha256: createHash("sha256").update("").digest("hex"), source: { type: "explicit-empty" } },
|
||||
};
|
||||
const pages = new Map(Object.entries(snapshots).map(([name, snapshot]) => ["/" + name, renderPage(template, snapshot)]));
|
||||
const requests = [];
|
||||
|
||||
+52
-41
@@ -81,10 +81,15 @@ test("real browser homepage integration", { skip: process.env.BROWSER_TESTS !==
|
||||
await page.goto(fixture.origin + "/repository");
|
||||
await page.waitForSelector("html.enhanced");
|
||||
await noPageOverflow(page, width);
|
||||
assert.equal(await page.locator("#key-0").textContent(), fixture.snapshots.repository.keys[0].text);
|
||||
assert.equal(await page.locator(".key-card img").count(), 0, "key comments must remain text");
|
||||
const install = fixture.snapshots.repository.commands.find((command) => command.id === "install").command;
|
||||
assert.equal(await page.locator("#command-install").textContent(), install);
|
||||
assert.equal(await page.locator(".key-card, [data-copy-target^='key-'], #copy-all-keys, #copy-all-commands").count(), 0);
|
||||
const contents = await page.content();
|
||||
assert.ok(!contents.includes(fixture.snapshots.repository.keys[0].text));
|
||||
assert.ok(!contents.includes(fixture.snapshots.repository.keys[0].fingerprint));
|
||||
assert.doesNotMatch(contents, /HOMEPAGE-MUST-NOT-LEAK|ssh-ed25519|SHA256:/);
|
||||
assert.equal(await page.evaluate(() => window.__injected), undefined);
|
||||
assert.equal(await page.locator(".key-card pre").evaluate((pre) => pre.scrollWidth > pre.clientWidth), true);
|
||||
assert.equal(await page.locator("#command-install").locator("xpath=..").evaluate((pre) => pre.scrollWidth > pre.clientWidth), true);
|
||||
assert.equal(await page.locator("#theme-picker").inputValue(), "system");
|
||||
assert.equal(await page.locator("html").getAttribute("data-theme"), null);
|
||||
const lightBackground = await page.locator("body").evaluate((body) => getComputedStyle(body).backgroundColor);
|
||||
@@ -108,103 +113,108 @@ test("real browser homepage integration", { skip: process.env.BROWSER_TESTS !==
|
||||
assert.equal(await page.locator("body").evaluate((body) => getComputedStyle(body).backgroundColor), lightBackground);
|
||||
assert.equal(await page.evaluate(() => localStorage.getItem("quickly-conf-sshd-theme")), "system");
|
||||
|
||||
const keyButton = page.locator('[data-copy-target="key-0"]');
|
||||
const commandButton = page.locator('[data-copy-target="command-install"]');
|
||||
if (width < 600) {
|
||||
assert.equal(await keyButton.evaluate((button) => getComputedStyle(button).opacity), "1", "touch copy buttons stay visible");
|
||||
assert.equal(await commandButton.evaluate((button) => getComputedStyle(button).opacity), "1", "touch copy buttons stay visible");
|
||||
} else {
|
||||
await page.locator("#page-title").hover();
|
||||
await page.waitForFunction(() => getComputedStyle(document.querySelector('[data-copy-target="key-0"]')).opacity === "0");
|
||||
await page.waitForFunction(() => getComputedStyle(document.querySelector('[data-copy-target="command-install"]')).opacity === "0");
|
||||
}
|
||||
await keyButton.focus();
|
||||
await page.waitForFunction(() => getComputedStyle(document.querySelector('[data-copy-target="key-0"]')).opacity === "1");
|
||||
await commandButton.focus();
|
||||
await page.waitForFunction(() => getComputedStyle(document.querySelector('[data-copy-target="command-install"]')).opacity === "1");
|
||||
await page.keyboard.press("Enter");
|
||||
await page.waitForFunction(() => document.querySelector('[data-copy-target="key-0"]').dataset.state === "success");
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values[0]), fixture.snapshots.repository.keys[0].text);
|
||||
assert.match(await keyButton.getAttribute("aria-label"), /已复制/);
|
||||
await page.waitForFunction(() => document.querySelector('[data-copy-target="command-install"]').dataset.state === "success");
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values[0]), install);
|
||||
assert.match(await commandButton.getAttribute("aria-label"), /已复制/);
|
||||
await page.waitForFunction(() => document.getElementById("copy-status").textContent.includes("已复制"));
|
||||
|
||||
await page.locator("#copy-all-keys").click();
|
||||
const allKeys = fixture.snapshots.repository.keys.map((key) => key.text).join("\n") + "\n";
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values[1]), allKeys);
|
||||
assert.equal(await page.locator("#copy-all-commands").count(), 0);
|
||||
await page.locator("details summary").click();
|
||||
await page.locator('[data-copy-target="command-uninstall"]').focus();
|
||||
await page.keyboard.press("Enter");
|
||||
const uninstall = fixture.snapshots.repository.commands.find((command) => command.id === "uninstall").command;
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values.at(-1)), uninstall);
|
||||
for (const command of fixture.snapshots.repository.commands.filter((entry) => entry.id !== "install")) {
|
||||
const button = page.locator(`[data-copy-target="command-${command.id}"]`);
|
||||
await button.focus();
|
||||
await page.keyboard.press("Enter");
|
||||
await page.waitForFunction((id) => document.querySelector(`[data-copy-target="command-${id}"]`).dataset.state === "success", command.id);
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values.at(-1)), command.command);
|
||||
}
|
||||
await noPageOverflow(page, width);
|
||||
|
||||
await page.evaluate(() => { window.__clipboardTest.reject = true; });
|
||||
await keyButton.focus();
|
||||
await commandButton.focus();
|
||||
await page.keyboard.press("Enter");
|
||||
await page.waitForSelector("#copy-fallback[open]");
|
||||
assert.equal(await page.locator("#fallback-text").inputValue(), fixture.snapshots.repository.keys[0].text);
|
||||
assert.equal(await page.locator("#fallback-text").inputValue(), install);
|
||||
assert.deepEqual(await page.locator("#fallback-text").evaluate((textarea) => ({
|
||||
start: textarea.selectionStart, end: textarea.selectionEnd, focused: document.activeElement === textarea,
|
||||
})), { start: 0, end: fixture.snapshots.repository.keys[0].text.length, focused: true });
|
||||
assert.equal(await keyButton.getAttribute("data-state"), null, "failed copy must not show success");
|
||||
})), { start: 0, end: install.length, focused: true });
|
||||
assert.equal(await commandButton.getAttribute("data-state"), null, "failed copy must not show success");
|
||||
await capture(page, `homepage-${width}-manual-copy`);
|
||||
await page.keyboard.press("Escape");
|
||||
assert.equal(await page.locator("#copy-fallback").evaluate((dialog) => dialog.open), false);
|
||||
assert.equal(await keyButton.evaluate((button) => document.activeElement === button), true);
|
||||
assert.equal(await commandButton.evaluate((button) => document.activeElement === button), true);
|
||||
await page.keyboard.press("Enter");
|
||||
await page.waitForSelector("#copy-fallback[open]");
|
||||
await page.locator("#close-copy-fallback").click();
|
||||
assert.equal(await keyButton.evaluate((button) => document.activeElement === button), true);
|
||||
assert.equal(await commandButton.evaluate((button) => document.activeElement === button), true);
|
||||
assert.deepEqual(errors, []);
|
||||
assert.deepEqual(externalRequests, []);
|
||||
} finally { await context.close(); }
|
||||
});
|
||||
}
|
||||
|
||||
await t.test("all source states render the same snapshot into metadata, keys and copy data", async () => {
|
||||
await t.test("source states expose metadata only and never fetch key or certificate APIs", async () => {
|
||||
const { context, externalRequests } = await guardedContext(browser, fixture, { viewport: { width: 390, height: 844 } });
|
||||
try {
|
||||
await installClipboardMock(context);
|
||||
const page = await context.newPage();
|
||||
for (const [state, sourceText] of [["repository", "可用"], ["fallback", "备用源可用"], ["unavailable", "暂不可用"], ["pending", "暂不可用"], ["explicit-empty", "明确撤销"]]) {
|
||||
for (const [state, sourceText] of [["repository", "可用"], ["gist", "可用"], ["fallback", "备用源可用"], ["unavailable", "暂不可用"], ["pending", "待获取"], ["explicit-empty", "明确撤销"]]) {
|
||||
const response = await page.goto(fixture.origin + "/" + state);
|
||||
assert.equal(response.status(), state === "unavailable" ? 503 : 200);
|
||||
await page.waitForSelector("html.enhanced");
|
||||
assert.equal(await page.locator(".source-status").textContent(), sourceText);
|
||||
const snapshot = fixture.snapshots[state];
|
||||
assert.equal(await page.locator(".key-count").textContent(), String(snapshot.keys.length));
|
||||
assert.equal(await page.locator("#copy-all-keys").isDisabled(), snapshot.keys.length === 0);
|
||||
assert.equal(await page.locator(".key-count").textContent(), String(snapshot.keyCount));
|
||||
assert.equal(await page.locator(".key-card, #copy-all-keys, [data-copy-target^='key-']").count(), 0);
|
||||
const embedded = await page.locator("#release-data").evaluate((element) => JSON.parse(element.textContent));
|
||||
assert.equal(embedded.source.type, state);
|
||||
assert.deepEqual(embedded.keys, snapshot.keys);
|
||||
assert.equal(embedded.keyRevision, snapshot.sha256);
|
||||
assert.equal(embedded.keys, undefined);
|
||||
assert.equal(embedded.keyRevision, snapshot.keyRevision || snapshot.sha256);
|
||||
assert.equal(embedded.signaturePresent, Boolean(snapshot.signature && snapshot.signedDocument === snapshot.keysText));
|
||||
assert.equal(embedded.certificatePresent, Boolean(snapshot.publicCertificate));
|
||||
assert.equal(await page.locator(".signature-status").textContent(), snapshot.signature ? "签名包已提供（待客户端验证）" : "未提供签名包");
|
||||
assert.equal(await page.locator(".certificate-status").textContent(), snapshot.publicCertificate ? "公开证书已提供（安装时核验）" : "未提供公开证书");
|
||||
assert.equal(await page.locator('a[href="/public-key.gpg"]').count(), snapshot.publicCertificate ? 1 : 0);
|
||||
assert.equal(await page.locator(".release-revision").first().textContent(), snapshot.revision.slice(0, 12));
|
||||
assert.equal(await page.locator(".release-revision").nth(1).textContent(), snapshot.sha256?.slice(0, 12) || "—");
|
||||
assert.equal(await page.locator(".release-revision").nth(1).textContent(), (snapshot.keyRevision || snapshot.sha256)?.slice(0, 12) || "—");
|
||||
const content = await page.content();
|
||||
assert.doesNotMatch(content, /HOMEPAGE-MUST-NOT-LEAK|ssh-ed25519|SHA256:|\"keys\"\s*:/);
|
||||
if (state === "fallback") {
|
||||
assert.equal(await page.locator(".source-label").textContent(), "备用源：" + snapshot.source.url);
|
||||
assert.equal(await page.locator(".source-label script").count(), 0);
|
||||
await page.locator("#copy-all-keys").click();
|
||||
assert.equal(await page.evaluate(() => window.__clipboardTest.values[0]), snapshot.keys.map((key) => key.text).join("\n") + "\n");
|
||||
}
|
||||
if (state === "unavailable" || state === "pending") {
|
||||
assert.match(await page.locator(".keys-notice").textContent(), /未发布撤销指令.*保留上次成功密钥/);
|
||||
assert.equal(await page.locator(".key-card").count(), 0);
|
||||
}
|
||||
if (state === "gist") assert.equal(await page.locator(".source-label").textContent(), "Gist：" + snapshot.source.url);
|
||||
if (state === "unavailable" || state === "pending") assert.match(await page.locator(".keys-notice").textContent(), /未发布撤销指令.*保留上次成功密钥/);
|
||||
if (state === "explicit-empty") assert.match(await page.locator(".keys-notice").textContent(), /明确撤销全部受管理公钥/);
|
||||
assert.equal(await page.evaluate(() => window.__injected), undefined);
|
||||
await noPageOverflow(page, 390);
|
||||
await capture(page, "source-" + state);
|
||||
// Repository appearance is already captured in both viewports above: 12 screenshots in total.
|
||||
if (state !== "repository") await capture(page, "source-" + state);
|
||||
}
|
||||
assert.deepEqual(externalRequests, []);
|
||||
} finally { await context.close(); }
|
||||
});
|
||||
|
||||
await t.test("no-JavaScript page retains keys, commands, source states and system theme", async () => {
|
||||
await t.test("no-JavaScript page retains metadata, commands, source states and system theme", async () => {
|
||||
const { context, externalRequests } = await guardedContext(browser, fixture, {
|
||||
viewport: { width: 390, height: 844 }, javaScriptEnabled: false, colorScheme: "dark",
|
||||
});
|
||||
try {
|
||||
const page = await context.newPage();
|
||||
await page.goto(fixture.origin + "/repository");
|
||||
assert.equal(await page.locator("#key-0").isVisible(), true);
|
||||
assert.equal(await page.locator("#key-status").isVisible(), true);
|
||||
assert.equal(await page.locator(".key-card, [data-copy-target^='key-'], #copy-all-keys").count(), 0);
|
||||
assert.equal(await page.locator("#command-install").isVisible(), true);
|
||||
assert.equal(await page.locator("#copy-all-keys").isVisible(), false);
|
||||
assert.equal(await page.locator('[data-copy-target="command-install"]').isVisible(), false);
|
||||
assert.equal(await page.locator("#theme-picker").isVisible(), false);
|
||||
assert.match(await page.locator("noscript").textContent(), /手动选择复制/);
|
||||
await page.locator("details summary").click();
|
||||
@@ -217,6 +227,7 @@ test("real browser homepage integration", { skip: process.env.BROWSER_TESTS !==
|
||||
assert.deepEqual(externalRequests, []);
|
||||
} finally { await context.close(); }
|
||||
});
|
||||
assert.ok(fixture.requests.every((path) => !["/ssh.keys", "/ssh.keys.sig", "/public-key.gpg", "/key-release", "/release.json"].includes(path)), "homepage must not fetch public-key or certificate material");
|
||||
} finally {
|
||||
await browser?.close();
|
||||
await fixture.close();
|
||||
|
||||
+15
-11
@@ -4,9 +4,10 @@ import {readFile,mkdtemp,cp,writeFile,rm,mkdir} from 'node:fs/promises';
|
||||
import {tmpdir} from 'node:os';
|
||||
import {join} from 'node:path';
|
||||
import {renderPage} from '../cf-worker/src/view.js';
|
||||
import {validateConfig,parseKeys,makeKeysText,commandsFor,renderKeys,build,root,digest} from '../scripts/build.mjs';
|
||||
import {validateConfig,parseKeys,makeKeysText,commandsFor,build,root,digest} from '../scripts/build.mjs';
|
||||
const config = {baseUrl:'https://ssh.example.com',repositoryUrl:'https://github.com/example/keys',defaultCron:'*/15 * * * *',allowEmpty:false};
|
||||
const fixture = await readFile(new URL('./fixtures/keys.pub',import.meta.url),'utf8');
|
||||
const canonicalFixture=fixture.trim().split(/ +/).slice(0,2).join(' ')+'\n';
|
||||
|
||||
test('deployment configuration rejects shell injection and ambiguous origins',()=>{
|
||||
assert.deepEqual(validateConfig(config),config);
|
||||
@@ -30,15 +31,18 @@ test('empty revocation must be explicit; protocol is deterministic',async()=>{
|
||||
const empty = makeKeysText([], 'a'.repeat(40),true);
|
||||
assert.match(empty.text,/# key-count 0\n# allow-empty yes\n/);assert.equal(empty.sha256,digest(''));
|
||||
const keys=await parseKeys(fixture);const bundle=makeKeysText(keys,'b'.repeat(40),false);
|
||||
assert.ok(bundle.text.endsWith(fixture));assert.equal(bundle.sha256,digest(fixture));
|
||||
assert.ok(bundle.text.endsWith(canonicalFixture));assert.equal(bundle.sha256,digest(canonicalFixture));
|
||||
assert.throws(()=>makeKeysText(keys,'main',false),/commit SHA/);
|
||||
});
|
||||
test('HTML escapes comments; commands use explicit script endpoint and separate actions',async()=>{
|
||||
const keys=await parseKeys(fixture.trim()+' <script>alert(1)</script>');
|
||||
const html=renderKeys(keys);assert.ok(html.includes('<script>'));assert.ok(!html.includes('<script>'));
|
||||
const commands=commandsFor(config);assert.ok(commands.find(x=>x.id==='install').command.endsWith(' -c'));
|
||||
assert.ok(commands.find(x=>x.id==='root-on').advanced);assert.ok(commandsFor({...config,defaultCron:'0 */6 * * *'})[0].description.includes('0 */6 * * *'));assert.ok(commands.find(x=>x.id==='uninstall').advanced);
|
||||
assert.ok(commands.every(x=>!x.command.includes('github.io')&&!x.command.includes('.keys')));
|
||||
test('homepage excludes keys and commands use explicit install and fixed local sync',async()=>{
|
||||
const commands=commandsFor(config);
|
||||
assert.ok(commands.find(x=>x.id==='install').command.includes('--install'));
|
||||
assert.ok(commands.find(x=>x.id==='root-on').advanced);
|
||||
assert.ok(commandsFor({...config,defaultCron:'0 */6 * * *'})[0].description.includes('0 */6 * * *'));
|
||||
assert.ok(commands.find(x=>x.id==='uninstall').advanced);
|
||||
assert.ok(commands.every(x=>!x.command.includes('github.io')));
|
||||
assert.ok(!commands.some(x=>/ -u$/.test(x.command)));
|
||||
assert.ok(commands.find(x=>x.id==='once').command.includes('$HOME/.conf-sshd/conf-sshd.sh'));
|
||||
});
|
||||
test('build creates consistent assets/release; production empty is blocked',async()=>{
|
||||
const directory=await mkdtemp(join(tmpdir(),'conf-sshd-build-'));
|
||||
@@ -73,12 +77,12 @@ test('fallback configuration allows an empty primary only with explicit bounded
|
||||
} finally {await rm(directory,{recursive:true,force:true});}
|
||||
});
|
||||
|
||||
test('template rendering preserves literal dollar replacements and token-like key comments',async()=>{
|
||||
test('template rendering excludes even adversarial key comments from HTML and JSON',async()=>{
|
||||
const tricky=fixture.trim()+" $& $` $' $$ @@REVISION@@ @@KEYS_HTML@@";
|
||||
const keys=await parseKeys(tricky);
|
||||
const template='<div>@@KEYS_HTML@@</div><script type="application/json">@@RELEASE_JSON@@</script>';
|
||||
const template='<div>@@SOURCE_LABEL@@</div><script type="application/json">@@RELEASE_JSON@@</script>';
|
||||
const html=renderPage(template,{revision:'e'.repeat(40),publishedAt:'2026-10-12',keys,commands:[],repositoryUrl:config.repositoryUrl,sha256:'f'.repeat(64)});
|
||||
const json=JSON.parse(html.match(/<script type="application\/json">([\s\S]*?)<\/script>/)[1]);
|
||||
assert.equal(json.keys[0].text,tricky);assert.ok(html.includes('@@KEYS_HTML@@'));assert.ok(html.includes('$&'));
|
||||
assert.equal(json.keys,undefined);assert.ok(!html.includes(keys[0].text));assert.ok(!html.includes(keys[0].fingerprint));
|
||||
assert.throws(()=>renderPage('@@UNKNOWN@@',{revision:'e'.repeat(40),keys:[]}),/Unresolved/);
|
||||
});
|
||||
|
||||
@@ -0,0 +1,172 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import {spawnSync} from 'node:child_process';
|
||||
import {readFile, mkdtemp, mkdir, rm} from 'node:fs/promises';
|
||||
import {tmpdir} from 'node:os';
|
||||
import {join} from 'node:path';
|
||||
import {verifyCommitSignature, enabledFlag, parseFingerprints, verifySignatureStatus} from '../scripts/verify-commit-signature.mjs';
|
||||
import {notifyDeployment, deploymentPayload} from '../scripts/notify-deployment.mjs';
|
||||
import {openPgpFixture} from './helpers/openpgp-fixture.mjs';
|
||||
|
||||
const primary = 'A'.repeat(40), subkey = 'B'.repeat(40);
|
||||
const validStatus = (fingerprint = primary, signer = fingerprint) => `[GNUPG:] GOODSIG 1234567890ABCDEF Test fixture\n[GNUPG:] VALIDSIG ${signer} 2026-01-01 1767225600 0 4 0 22 8 00 ${fingerprint}\n`;
|
||||
|
||||
test('GPG opt-in is strict and only accepts complete primary fingerprint pins', () => {
|
||||
for (const value of [undefined,'','false']) assert.equal(enabledFlag(value),false);
|
||||
assert.equal(enabledFlag('true'),true);
|
||||
for (const value of ['TRUE','yes','1',' false ','False',null]) assert.throws(() => enabledFlag(value));
|
||||
assert.deepEqual(parseFingerprints(primary.toLowerCase()+',\n'+subkey),new Set([primary,subkey]));
|
||||
for (const value of ['',undefined,'1234ABCD','A'.repeat(64),primary+' invalid']) assert.throws(() => parseFingerprints(value));
|
||||
});
|
||||
|
||||
test('machine status requires a pinned primary and rejects bad, expired and revoked signatures', () => {
|
||||
const pins = new Set([primary]);
|
||||
assert.deepEqual(verifySignatureStatus(validStatus(primary,subkey),pins),{signerFingerprint:subkey,primaryFingerprint:primary});
|
||||
assert.throws(() => verifySignatureStatus(validStatus(subkey),pins),/not pinned/);
|
||||
assert.throws(() => verifySignatureStatus('[GNUPG:] GOODSIG 123 Test fixture\n',pins),/exactly one/);
|
||||
assert.throws(() => verifySignatureStatus(validStatus()+validStatus(),pins),/exactly one/);
|
||||
for (const code of ['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']) {
|
||||
assert.throws(() => verifySignatureStatus(validStatus()+`[GNUPG:] ${code} rejected\n`,pins),/invalid, expired, revoked/);
|
||||
}
|
||||
assert.throws(() => verifySignatureStatus(validStatus().replace('1767225600 0 4','1767225600 1767225601 4'),pins,1767225602),/expired/);
|
||||
assert.throws(() => verifySignatureStatus(validStatus().replace('22 8 00','22 2 00'),pins),/SHA-256/);
|
||||
assert.throws(() => verifySignatureStatus(validStatus().replace(' 4 0 22',' 5 0 22'),pins),/v4/);
|
||||
assert.throws(() => verifySignatureStatus(validStatus().replace(` 00 ${primary}`,' 00'),pins),/primary fingerprint/);
|
||||
});
|
||||
|
||||
function command(bin,args,options = {}) {
|
||||
const result = spawnSync(bin,args,{encoding:'utf8',timeout:30_000,...options});
|
||||
assert.equal(result.error,undefined,`${bin} failed to execute`);
|
||||
assert.equal(result.status,0,`${bin} failed: ${result.stderr}`);
|
||||
return result.stdout;
|
||||
}
|
||||
|
||||
test('GPG gate verifies real ephemeral Git commits in an isolated keyring', {timeout:120_000}, async t => {
|
||||
const directory = await mkdtemp(join(tmpdir(),'conf-sshd-signature-test-'));
|
||||
const repo = join(directory,'repo');await mkdir(repo);
|
||||
const env = {...process.env,GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:'/dev/null'};
|
||||
const git = (args,options = {}) => command('git',args,{cwd:repo,env,...options});
|
||||
const commit = (name,fixture) => {
|
||||
const tree = git(['hash-object','-t','tree','-w','--stdin'],{input:''}).trim();
|
||||
const headers = `tree ${tree}\nauthor Security fixture <[email protected]> 1767225600 +0000\ncommitter Security fixture <[email protected]> 1767225600 +0000`;
|
||||
const body = `${headers}\n\n${name}\n`;
|
||||
const signed = fixture ? `${headers}\ngpgsig ${fixture.sign(body).trimEnd().replaceAll('\n','\n ')}\n\n${name}\n` : body;
|
||||
const sha = git(['hash-object','-t','commit','-w','--stdin'],{input:signed}).trim();
|
||||
git(['update-ref','HEAD',sha]);return sha;
|
||||
};
|
||||
const gateEnv = (sha,pin,key) => ({...env,GITHUB_SHA:sha,REQUIRE_GPG_SIGNATURE:'true',GPG_ALLOWED_PRIMARY_FINGERPRINTS:pin,GPG_PUBLIC_KEYS:key});
|
||||
try {
|
||||
git(['init','-q']);
|
||||
const good = openPgpFixture(), other = openPgpFixture(), sub = openPgpFixture({subkeys:2});
|
||||
let sha = commit('unsigned fixture');
|
||||
await t.test('disabled still pins HEAD; enabled unsigned/missing config/incorrect SHA fail',async () => {
|
||||
assert.equal((await verifyCommitSignature({env:{...env,GITHUB_SHA:sha},directory:repo})).required,false);
|
||||
await assert.rejects(verifyCommitSignature({env:{...env,GITHUB_SHA:'0'.repeat(40)},directory:repo}),/does not match/);
|
||||
await assert.rejects(verifyCommitSignature({env:{...env,GITHUB_SHA:sha,REQUIRE_GPG_SIGNATURE:'invalid'},directory:repo}),/exactly true/);
|
||||
await assert.rejects(verifyCommitSignature({env:{...env,GITHUB_SHA:sha,REQUIRE_GPG_SIGNATURE:'true'},directory:repo}),/FINGERPRINTS/);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,''),directory:repo}),/public keys/);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,good.publicKey),directory:repo}),/Git verification command failed/);
|
||||
});
|
||||
sha = commit('approved signature fixture',good);
|
||||
await t.test('approved primary passes; wrong pin, missing public signer and Git nonzero fail',async () => {
|
||||
assert.equal((await verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,good.publicKey),directory:repo})).primaryFingerprint,good.primaryFingerprint);
|
||||
assert.equal((await verifyCommitSignature({env:gateEnv(sha,`${other.primaryFingerprint},${good.primaryFingerprint}`,other.publicKey+good.publicKey),directory:repo})).primaryFingerprint,good.primaryFingerprint);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,other.primaryFingerprint,good.publicKey),directory:repo}),/not pinned/);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,other.publicKey),directory:repo}),/Git verification command failed/);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,good.publicKey),directory}),/Git verification command failed/);
|
||||
});
|
||||
sha = commit('tampered commit fixture',{sign:data=>good.sign(data.replace('tampered commit fixture','original commit fixture'))});
|
||||
await t.test('a valid signature on different commit bytes is rejected',async () => {
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,good.publicKey),directory:repo}),/Git verification command failed/);
|
||||
});
|
||||
sha = commit('signing subkey fixture',sub);
|
||||
await t.test('signing subkey is accepted only through the pinned primary fingerprint',async () => {
|
||||
const result = await verifyCommitSignature({env:gateEnv(sha,sub.primaryFingerprint,sub.publicKey),directory:repo});
|
||||
assert.equal(result.primaryFingerprint,sub.primaryFingerprint);assert.equal(result.signerFingerprint,sub.signerFingerprint);assert.notEqual(result.signerFingerprint,sub.primaryFingerprint);
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,sub.signerFingerprint,sub.publicKey),directory:repo}),/not pinned/);
|
||||
const secondSha = commit('second signing subkey fixture',{sign:data=>sub.sign(data,1)});
|
||||
const second = await verifyCommitSignature({env:gateEnv(secondSha,sub.primaryFingerprint,sub.publicKey),directory:repo});
|
||||
assert.equal(second.primaryFingerprint,sub.primaryFingerprint);assert.equal(second.signerFingerprint,sub.signerFingerprints[1]);
|
||||
});
|
||||
const revoked = openPgpFixture({revoked:true});sha = commit('revoked fixture',revoked);
|
||||
await t.test('real primary revocation rejects a previously created signature',async () => {
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,revoked.primaryFingerprint,revoked.publicKey),directory:repo}),/Git verification command failed|revoked/);
|
||||
});
|
||||
const expired = openPgpFixture({expired:true});sha = commit('expired key fixture',expired);
|
||||
await t.test('expired signing key is rejected using current verifier time',async () => {
|
||||
await assert.rejects(verifyCommitSignature({env:gateEnv(sha,expired.primaryFingerprint,expired.publicKey),directory:repo}),/Git verification command failed|expired/);
|
||||
});
|
||||
sha = commit('forced verifier fixture',good);
|
||||
await t.test('Git configuration cannot substitute another signature format or verifier',async () => {
|
||||
git(['config','gpg.format','ssh']);git(['config','gpg.openpgp.program','/bin/true']);git(['config','gpg.program','/bin/true']);
|
||||
assert.equal((await verifyCommitSignature({env:gateEnv(sha,good.primaryFingerprint,good.publicKey),directory:repo})).primaryFingerprint,good.primaryFingerprint);
|
||||
});
|
||||
} finally {await rm(directory,{recursive:true,force:true});}
|
||||
});
|
||||
|
||||
const notificationEnv = {
|
||||
ENABLE_MAIL_NOTIFICATION:'true',CI:'true',GITHUB_ACTIONS:'true',
|
||||
MAIL_NOTIFICATION_WEBHOOK:'https://mailer.example.invalid/hook?token=DO_NOT_LOG',
|
||||
MAIL_NOTIFICATION_TO:'[email protected]',DEPLOYMENT_STATUS:'success',DEPLOYMENT_PHASE:'complete',
|
||||
GITHUB_SHA:'c'.repeat(40),GITHUB_REPOSITORY:'example/server-keys',GITHUB_RUN_ID:'123',
|
||||
};
|
||||
const deploymentConfig = {
|
||||
baseUrl:'https://ssh.example.invalid',keySource:{type:'gist'},
|
||||
signedRelease:{listId:'server-keys-production'},fallbackSources:['https://backup.example.invalid/server.keys'],
|
||||
};
|
||||
|
||||
test('notification stays network-free unless explicitly enabled in CI with complete configuration',async () => {
|
||||
let calls = 0;const fetchImpl = async () => {calls++;return {ok:true,status:200};};
|
||||
for (const ENABLE_MAIL_NOTIFICATION of [undefined,'','false']) {
|
||||
assert.deepEqual(await notifyDeployment({env:{ENABLE_MAIL_NOTIFICATION},fetchImpl}),{sent:false,reason:'disabled'});
|
||||
}
|
||||
for (const value of ['yes','TRUE','1']) await assert.rejects(notifyDeployment({env:{...notificationEnv,ENABLE_MAIL_NOTIFICATION:value},config:deploymentConfig,fetchImpl}),/exactly true/);
|
||||
await assert.rejects(notifyDeployment({env:{...notificationEnv,CI:'false'},config:deploymentConfig,fetchImpl}),/only in GitHub Actions/);
|
||||
await assert.rejects(notifyDeployment({env:{...notificationEnv,MAIL_NOTIFICATION_WEBHOOK:''},config:deploymentConfig,fetchImpl}),/required/);
|
||||
for (const endpoint of ['http://mailer.example.invalid','https://user:[email protected]','https://mailer.example.invalid/#secret']) {
|
||||
await assert.rejects(notifyDeployment({env:{...notificationEnv,MAIL_NOTIFICATION_WEBHOOK:endpoint},config:deploymentConfig,fetchImpl}),/HTTPS/);
|
||||
}
|
||||
assert.equal(calls,0);
|
||||
});
|
||||
|
||||
test('notification JSON identifies deployment, configured mode/list/fallbacks and uses a bounded nonredirecting POST',async () => {
|
||||
for (const [status,phase] of [['success','complete'],['failure','deployment'],['failure','remote-verification']]) {
|
||||
const result = await notifyDeployment({env:{...notificationEnv,DEPLOYMENT_STATUS:status,DEPLOYMENT_PHASE:phase},config:deploymentConfig,fetchImpl:async (url,options) => {
|
||||
assert.equal(url,notificationEnv.MAIL_NOTIFICATION_WEBHOOK);assert.equal(options.method,'POST');assert.equal(options.redirect,'error');
|
||||
assert.equal(options.headers['content-type'],'application/json');assert.ok(options.signal instanceof AbortSignal);
|
||||
const payload = JSON.parse(options.body);
|
||||
assert.equal(payload.status,status);assert.equal(payload.phase,phase);assert.equal(payload.revision,notificationEnv.GITHUB_SHA);
|
||||
assert.equal(payload.configuration.mode,'gist');assert.equal(payload.configuration.listId,'server-keys-production');
|
||||
assert.deepEqual(payload.configuration.fallbackSources,deploymentConfig.fallbackSources);assert.match(payload.configurationScope,/not measured server state/);
|
||||
assert.equal(payload.to,'[email protected]');assert.ok(!options.body.includes('DO_NOT_LOG'));
|
||||
return {ok:true,status:202};
|
||||
}});
|
||||
assert.deepEqual(result,{sent:true});
|
||||
}
|
||||
const defaults = deploymentPayload({baseUrl:'https://ssh.example.invalid'}, {...notificationEnv,MAIL_NOTIFICATION_TO:''});
|
||||
assert.equal(defaults.configuration.mode,'git');assert.equal(defaults.configuration.listId,null);assert.equal(defaults.to,null);
|
||||
assert.deepEqual(defaults.configuration.fallbackSources,[]);
|
||||
});
|
||||
|
||||
test('notification rejects ambiguous metadata and never exposes webhook tokens or retries failures',async () => {
|
||||
for (const patch of [{DEPLOYMENT_STATUS:'unknown'},{DEPLOYMENT_PHASE:'unknown'},{GITHUB_SHA:'main'},{GITHUB_REPOSITORY:'evil\nrepo'},{GITHUB_RUN_ID:'$((1))'},{MAIL_NOTIFICATION_TO:'[email protected]\nBcc:[email protected]'}]) {
|
||||
assert.throws(() => deploymentPayload(deploymentConfig,{...notificationEnv,...patch}));
|
||||
}
|
||||
let calls = 0;
|
||||
await assert.rejects(notifyDeployment({env:notificationEnv,config:deploymentConfig,fetchImpl:async () => {calls++;throw Error(notificationEnv.MAIL_NOTIFICATION_WEBHOOK);}}),error=>!error.message.includes('DO_NOT_LOG') && /request failed/.test(error.message));
|
||||
assert.equal(calls,1);
|
||||
await assert.rejects(notifyDeployment({env:notificationEnv,config:deploymentConfig,fetchImpl:async () => ({ok:false,status:503})}),/HTTP 503/);
|
||||
});
|
||||
|
||||
test('deployment workflow gates both entry points before repository execution and separates secret scopes',async () => {
|
||||
const workflow = await readFile(new URL('../.github/workflows/deploy.yml',import.meta.url),'utf8');
|
||||
const verify = workflow.split('\n verify:\n')[1].split('\n deploy:\n')[0];
|
||||
const deploy = workflow.split('\n deploy:\n')[1].split('\n notify:\n')[0];
|
||||
const notify = workflow.split('\n notify:\n')[1];
|
||||
assert.match(workflow,/workflow_dispatch:/);assert.match(verify,/refs\/heads\/main/);assert.match(verify,/verify-commit-signature\.mjs/);
|
||||
assert.ok(!verify.includes('${{ secrets.'));assert.ok(!verify.includes('environment: production'));assert.ok(!verify.includes('npm '));
|
||||
assert.match(deploy,/needs: verify/);assert.match(deploy,/environment: production/);
|
||||
assert.equal((workflow.match(/ref: \$\{\{ github.sha \}\}/g)||[]).length,3);
|
||||
assert.match(notify,/needs\.deploy\.outputs\.attempted == 'true'/);assert.ok(!notify.includes('CLOUDFLARE_'));
|
||||
assert.match(notify,/DEPLOYMENT_PHASE:/);assert.match(notify,/MAIL_NOTIFICATION_WEBHOOK/);
|
||||
});
|
||||
@@ -0,0 +1,74 @@
|
||||
// Test-only OpenPGP v4 fixture encoder. Private keys are generated in memory,
|
||||
// never saved; production verification uses GnuPG, never this implementation.
|
||||
// This keeps integration tests runnable when gpg-agent sockets are unavailable.
|
||||
import {generateKeyPairSync, createHash, sign} from 'node:crypto';
|
||||
|
||||
const bytes = (...values) => Buffer.concat(values.map(value => Buffer.isBuffer(value) ? value : Buffer.from(value)));
|
||||
const u16 = value => {const out = Buffer.alloc(2);out.writeUInt16BE(value);return out;};
|
||||
const u32 = value => {const out = Buffer.alloc(4);out.writeUInt32BE(value);return out;};
|
||||
const sha = (algorithm,value) => createHash(algorithm).update(value).digest();
|
||||
function mpi(input) {
|
||||
const first = input.findIndex(value => value !== 0), data = first < 0 ? Buffer.alloc(0) : input.subarray(first);
|
||||
return bytes(u16(data.length ? (data.length-1)*8 + 32-Math.clz32(data[0]) : 0),data);
|
||||
}
|
||||
function length(size) {
|
||||
if (size < 192) return Buffer.from([size]);
|
||||
if (size <= 8383) return Buffer.from([((size-192)>>8)+192,(size-192)&255]);
|
||||
return bytes([255],u32(size));
|
||||
}
|
||||
const packet = (type,body) => bytes([0xc0|type],length(body.length),body);
|
||||
const subpacket = (type,body) => bytes(length(body.length+1),[type],body);
|
||||
const keyPrefix = body => bytes([0x99],u16(body.length),body);
|
||||
function armor(type,data) {
|
||||
let crc = 0xb704ce;
|
||||
for (const byte of data) {crc ^= byte<<16;for(let bit=0;bit<8;bit++) {crc <<= 1;if(crc&0x1000000) crc ^= 0x1864cfb;}}
|
||||
const checksum = Buffer.from([(crc>>16)&255,(crc>>8)&255,crc&255]).toString('base64');
|
||||
return `-----BEGIN PGP ${type}-----\n\n${data.toString('base64').match(/.{1,64}/g).join('\n')}\n=${checksum}\n-----END PGP ${type}-----\n`;
|
||||
}
|
||||
function key(created) {
|
||||
const {publicKey,privateKey} = generateKeyPairSync('rsa',{modulusLength:2048});
|
||||
const jwk = publicKey.export({format:'jwk'});
|
||||
const body = bytes([4],u32(created),[1],mpi(Buffer.from(jwk.n,'base64url')),mpi(Buffer.from(jwk.e,'base64url')));
|
||||
return {body,privateKey,fingerprint:sha('sha1',keyPrefix(body)),created};
|
||||
}
|
||||
function signature(signer,type,data,{created = signer.created,extra = []} = {}) {
|
||||
const hashed = bytes(subpacket(2,u32(created)),subpacket(33,bytes([4],signer.fingerprint)),...extra);
|
||||
const head = bytes([4,type,1,8],u16(hashed.length),hashed);
|
||||
const toSign = bytes(data,head,[4,255],u32(head.length));
|
||||
const unhashed = subpacket(16,signer.fingerprint.subarray(-8));
|
||||
return bytes(head,u16(unhashed.length),unhashed,sha('sha256',toSign).subarray(0,2),mpi(sign('RSA-SHA256',toSign,signer.privateKey)));
|
||||
}
|
||||
|
||||
export function openPgpFixture({subkey = false,subkeys = subkey ? 1 : 0,expired = false,revoked = false} = {}) {
|
||||
if (!Number.isInteger(subkeys) || subkeys < 0 || subkeys > 4) throw Error('Fixture supports zero through four signing subkeys.');
|
||||
const now = Math.floor(Date.now()/1000), created = now - (expired ? 5*86400 : 60);
|
||||
const primary = key(created);
|
||||
const uid = Buffer.from('Ephemeral security fixture <[email protected]>');
|
||||
const certification = signature(primary,0x13,bytes(keyPrefix(primary.body),[0xb4],u32(uid.length),uid),{
|
||||
extra:[subpacket(27,[subkeys ? 1 : 3]),...(expired ? [subpacket(9,u32(86400))] : [])],
|
||||
});
|
||||
const revocation = revoked ? packet(2,signature(primary,0x20,keyPrefix(primary.body),{created:created+10})) : Buffer.alloc(0);
|
||||
let publicPackets = bytes(packet(6,primary.body),revocation,packet(13,uid),packet(2,certification));
|
||||
const signers = [];
|
||||
for (let index = 0; index < subkeys; index++) {
|
||||
const signingKey = key(created);signers.push(signingKey);
|
||||
const bound = bytes(keyPrefix(primary.body),keyPrefix(signingKey.body));
|
||||
const crossCertification = signature(signingKey,0x19,bound);
|
||||
const binding = signature(primary,0x18,bound,{extra:[subpacket(27,[2]),subpacket(32,crossCertification)]});
|
||||
publicPackets = bytes(publicPackets,packet(14,signingKey.body),packet(2,binding));
|
||||
}
|
||||
if (!signers.length) signers.push(primary);
|
||||
const signData = (signer,data) => armor('SIGNATURE',packet(2,signature(signer,0x00,Buffer.from(data),{created:created+5})));
|
||||
return {
|
||||
primaryFingerprint:primary.fingerprint.toString('hex').toUpperCase(),
|
||||
signerFingerprint:signers[0].fingerprint.toString('hex').toUpperCase(),
|
||||
signerFingerprints:signers.map(signer=>signer.fingerprint.toString('hex').toUpperCase()),
|
||||
publicKey:armor('PUBLIC KEY BLOCK',publicPackets),
|
||||
// Sign in the key's valid past lifetime, so verification must notice expiry
|
||||
// or revocation now rather than merely reject an impossible creation date.
|
||||
sign:(data,index = 0) => {if(!signers[index]) throw Error('Unknown fixture signer.');return signData(signers[index],data);},
|
||||
// Deliberately valid text-mode signature for exact-byte policy rejection tests.
|
||||
signText:(data,index = 0) => {if(!signers[index]) throw Error('Unknown fixture signer.');return armor('SIGNATURE',packet(2,signature(signers[index],0x01,Buffer.from(String(data).replace(/\r?\n/g,'\r\n')),{created:created+5})));},
|
||||
signWithPrimary:data => signData(primary,data),
|
||||
};
|
||||
}
|
||||
+181
-11
@@ -3,8 +3,10 @@ import assert from 'node:assert/strict';
|
||||
import {readFile} from 'node:fs/promises';
|
||||
import {createHash, generateKeyPairSync} from 'node:crypto';
|
||||
import {FallbackUnavailableError, KEY_SOURCE_LIMITS, makeKeyBundle, parsePublicKeys, resolveKeys, validateFallbackSources} from '../cf-worker/src/key-source.js';
|
||||
import {SIGNED_BUNDLE_MAX_BYTES, makeSignedDocument, SIGNATURE_SEPARATOR} from '../cf-worker/src/signed-release.js';
|
||||
|
||||
const fixture = await readFile(new URL('./fixtures/keys.pub', import.meta.url), 'utf8');
|
||||
const canonical = fixture.trim().split(/\s+/).slice(0, 2).join(' ') + '\n';
|
||||
const revision = 'a'.repeat(40);
|
||||
const urls = ['https://keys.example.org/first.keys', 'https://keys.example.org/second.keys', 'https://keys.example.org/third.keys'];
|
||||
const emptyRelease = {keys: [], allowEmpty: false, revision, fallbackSources: urls};
|
||||
@@ -33,9 +35,9 @@ test('repository keys win without any upstream request and have complete protoco
|
||||
assert.deepEqual(result.source, {type: 'repository'});
|
||||
assert.equal(result.revision, revision);
|
||||
assert.equal(result.keyCount, 1);
|
||||
assert.equal(result.sha256, hash(fixture));
|
||||
assert.equal(result.sha256, hash(canonical));
|
||||
assert.equal(result.keyRevision, result.sha256);
|
||||
assert.equal(result.keysText, `# conf-sshd-v1\n# revision ${revision}\n# key-count 1\n# allow-empty no\n# sha256 ${hash(fixture)}\n# end-metadata\n${fixture}`);
|
||||
assert.equal(result.keysText, `# conf-sshd-v1\n# revision ${revision}\n# key-count 1\n# allow-empty no\n# sha256 ${hash(canonical)}\n# end-metadata\n${canonical}`);
|
||||
assert.ok(Number.isFinite(Date.parse(result.fetchedAt)));
|
||||
});
|
||||
|
||||
@@ -61,7 +63,7 @@ test('first valid nonempty source wins in order, without aggregation or redirect
|
||||
assert.deepEqual(visited, [urls[0]]);
|
||||
assert.deepEqual(result.source, {type: 'fallback', url: urls[0]});
|
||||
assert.equal(result.keyCount, 1);
|
||||
assert.equal(result.sha256, hash(fixture));
|
||||
assert.equal(result.sha256, hash(canonical));
|
||||
});
|
||||
|
||||
test('malformed and empty sources are skipped before the next valid source', async () => {
|
||||
@@ -91,7 +93,7 @@ test('a response reported as redirected is rejected even when status is 200', as
|
||||
Object.defineProperty(redirected, 'redirected', {value: true});
|
||||
const result = await resolveKeys(emptyRelease, async url => url === urls[0] ? redirected : response(secondFixture));
|
||||
assert.equal(result.source.url, urls[1]);
|
||||
assert.equal(result.sha256, hash(secondFixture));
|
||||
assert.equal(result.sha256, hash(secondFixture.trim().split(/\s+/).slice(0, 2).join(' ') + '\n'));
|
||||
});
|
||||
|
||||
test('fetch timeout is bounded even when an upstream ignores AbortSignal', async () => {
|
||||
@@ -139,7 +141,7 @@ test('streamed size is enforced even without or with a misleading Content-Length
|
||||
});
|
||||
|
||||
test('oversized declared length is rejected without reading the body', async () => {
|
||||
const error = await unavailable(async () => new Response(fixture, {headers: {'Content-Length': String(KEY_SOURCE_LIMITS.maxBytes + 1)}}), {}, {...emptyRelease, fallbackSources: [urls[0]]});
|
||||
const error = await unavailable(async () => new Response(fixture, {headers: {'Content-Length': String(SIGNED_BUNDLE_MAX_BYTES + 1)}}), {}, {...emptyRelease, fallbackSources: [urls[0]]});
|
||||
assert.equal(error.diagnostics[0].code, 'too-large');
|
||||
});
|
||||
|
||||
@@ -179,7 +181,7 @@ test('Unicode comments and CRLF are canonicalized, with a known SHA256 fingerpri
|
||||
assert.equal(key.fingerprint, 'SHA256:bbXpuKG6zhzdmnxq256TlqzFBzRl2f6OOg722cYNbU8');
|
||||
assert.equal(key.text, `${fixture.trim().split(/\s+/).slice(0, 2).join(' ')} 家用服务器 🔐 张三`);
|
||||
const bundle = await makeKeyBundle([key], revision, false);
|
||||
assert.equal(bundle.sha256, hash(key.text + '\n'));
|
||||
assert.equal(bundle.sha256, hash(canonical));
|
||||
});
|
||||
|
||||
test('duplicates, options, certificates, private keys, invalid controls, and junk are rejected', async () => {
|
||||
@@ -276,7 +278,7 @@ test('whole serialized protocol, including metadata, is limited to the client re
|
||||
assert.ok(Buffer.byteLength(bundle.text) <= KEY_SOURCE_LIMITS.maxBytes);
|
||||
});
|
||||
|
||||
test('an upstream fitting the input cap but exceeding the serialized output cap is skipped', async () => {
|
||||
test('large upstream comments are stripped before publication without leaking labels', async () => {
|
||||
const publicBytes = keyData.subarray(keyData.length - 32);
|
||||
const lines = Array.from({length: 128}, (_, index) => {
|
||||
const bytes = Buffer.from(publicBytes); bytes[31] ^= index;
|
||||
@@ -284,11 +286,13 @@ test('an upstream fitting the input cap but exceeding the serialized output cap
|
||||
return prefix + 'x'.repeat(8190 - prefix.length) + '\n';
|
||||
}).join('');
|
||||
assert.ok(Buffer.byteLength(lines) <= KEY_SOURCE_LIMITS.maxBytes);
|
||||
const error = await unavailable(async () => response(lines), {}, {...emptyRelease, fallbackSources: [urls[0]]});
|
||||
assert.equal(error.diagnostics[0].code, 'too-large');
|
||||
const output = await resolveKeys({...emptyRelease, fallbackSources: [urls[0]]}, async () => response(lines));
|
||||
assert.equal(output.keyCount, 128);
|
||||
assert.ok(output.keysText.length < 20000);
|
||||
assert.equal(output.keys[0].label, 'Server key 1');
|
||||
const result = await resolveKeys(emptyRelease, async url => response(url === urls[0] ? lines : fixture));
|
||||
assert.equal(result.source.url, urls[1]);
|
||||
assert.equal(result.sha256, hash(fixture));
|
||||
assert.equal(result.source.url, urls[0]);
|
||||
assert.equal(result.keyCount, 128);
|
||||
});
|
||||
|
||||
test('ordinary private-key advice in comments is allowed, while real private formats are rejected anywhere', async () => {
|
||||
@@ -301,3 +305,169 @@ test('ordinary private-key advice in comments is allowed, while real private for
|
||||
await assert.rejects(parsePublicKeys(publicWithComment.trim() + ' ' + marker + '\n'), /Private keys are never accepted/);
|
||||
}
|
||||
});
|
||||
|
||||
const gistSource = {type:'gist',id:'a'.repeat(32),ownerId:12345,ownerLogin:'original-login',file:'ssh.keys',signatureFile:'ssh.keys.sig',bundleFile:'release.bundle'};
|
||||
const gistRevision = 'b'.repeat(40);
|
||||
const gistRelease = {...emptyRelease,keySource:gistSource};
|
||||
const signedPolicy = {listId:'production',sequence:9,issuedAt:100,expiresAt:300};
|
||||
const signedDocument = await makeSignedDocument(fixture,signedPolicy);
|
||||
// Syntactic fixture only, deliberately NOT a valid cryptographic signature. Worker never makes that claim.
|
||||
const signatureFixture = '-----BEGIN PGP SIGNATURE-----\n\nYWJj\n-----END PGP SIGNATURE-----\n';
|
||||
const signedBundleFixture = signedDocument + SIGNATURE_SEPARATOR + signatureFixture;
|
||||
const gistFile = (filename,content) => ({filename,content,size:Buffer.byteLength(content),truncated:false,encoding:'utf-8',raw_url:'https://untrusted.invalid/ignored'});
|
||||
const gistData = (files={}) => ({id:gistSource.id,owner:{id:gistSource.ownerId,login:'renamed-login'},public:true,truncated:false,history:[{version:gistRevision}],files});
|
||||
const jsonResponse = data => response(JSON.stringify(data));
|
||||
const gistUrl = `https://api.github.com/gists/${gistSource.id}`;
|
||||
|
||||
for (const status of [201,204,206]) test(`non-200 success HTTP ${status} is not a key release`, async () => {
|
||||
const result=await resolveKeys(emptyRelease,async url=>url===urls[0]?new Response(status===204?null:fixture,{status}):response(fixture));
|
||||
assert.equal(result.source.url,urls[1]);
|
||||
});
|
||||
|
||||
test('Git signed document is authoritative and exact, while missing/bad signature does not block OFF', async () => {
|
||||
for (const signature of [null,'bad armor',signatureFixture]) {
|
||||
const result=await resolveKeys({...emptyRelease,keys:fixtureKeys,signedDocument,signature},()=>assert.fail('No network'));
|
||||
assert.equal(result.keysText,signedDocument); assert.equal(result.signedDocument,signedDocument);
|
||||
assert.equal(result.signature,signature===signatureFixture?signatureFixture:null);
|
||||
assert.equal(result.keyRevision,hash(signedDocument)); assert.equal(result.sha256,hash(canonical));
|
||||
assert.equal(result.signedMetadata.sequence,9);
|
||||
}
|
||||
});
|
||||
|
||||
test('signed empty revocation suppresses fallback even when legacy allowEmpty is false', async () => {
|
||||
const document=await makeSignedDocument('',{...signedPolicy,revoke:true});
|
||||
const result=await resolveKeys({...emptyRelease,signedDocument:document,signature:signatureFixture},()=>assert.fail('Revocation must not fetch'));
|
||||
assert.equal(result.keyCount,0);assert.equal(result.allowEmpty,true);assert.equal(result.source.type,'explicit-empty');
|
||||
assert.equal(result.keysText,document);
|
||||
});
|
||||
|
||||
test('strict sources never downgrade to raw keys; ordered signed fallback chooses one entire bundle', async () => {
|
||||
const visited=[];
|
||||
const result=await resolveKeys({...emptyRelease,keys:fixtureKeys},async url=>{visited.push(url);return response(url===urls[0]?fixture:signedBundleFixture);},{requireSigned:true,now:200});
|
||||
assert.deepEqual(visited,urls.slice(0,2));assert.equal(result.source.url,urls[1]);assert.equal(result.signature,signatureFixture);
|
||||
assert.equal(result.keysText,signedDocument);assert.equal(result.signedBundle,signedBundleFixture);
|
||||
});
|
||||
|
||||
test('fallback standalone signed document gets only its same-source detached signature', async () => {
|
||||
const visited=[];
|
||||
const result=await resolveKeys(emptyRelease,async url=>{visited.push(url);return response(url.endsWith('.sig')?signatureFixture:signedDocument);},{requireSigned:true,now:200});
|
||||
assert.deepEqual(visited,[urls[0],urls[0]+'.sig']);assert.equal(result.signature,signatureFixture);assert.equal(result.keysText,signedDocument);
|
||||
});
|
||||
|
||||
test('missing, non200, malformed or hung optional signature still serves the valid OFF document', async () => {
|
||||
for (const mode of ['missing','non200','bad','fetch-timeout','body-timeout']) {
|
||||
let cancelled=false;
|
||||
const body=new ReadableStream({start(c){c.enqueue(new TextEncoder().encode('part'));},cancel(){cancelled=true;}});
|
||||
const fetcher=async url=> {
|
||||
if (!url.endsWith('.sig')) return response(signedDocument);
|
||||
if(mode==='missing')return new Response('missing',{status:404});
|
||||
if(mode==='non200')return new Response(signatureFixture,{status:206});
|
||||
if(mode==='bad')return response('bad');
|
||||
if(mode==='fetch-timeout')return new Promise(()=>{});
|
||||
return new Response(body);
|
||||
};
|
||||
const result=await resolveKeys(emptyRelease,fetcher,{timeoutMs:20});
|
||||
assert.equal(result.keysText,signedDocument,mode);assert.equal(result.signature,null,mode);
|
||||
if(mode==='body-timeout')assert.equal(cancelled,true);
|
||||
}
|
||||
});
|
||||
|
||||
test('strict signature failure stays with its source before trying next whole signed release', async () => {
|
||||
const result=await resolveKeys(emptyRelease,async url=>url===urls[0]?response(signedDocument):url===urls[0]+'.sig'?new Response('',{status:404}):response(signedBundleFixture),{requireSigned:true,now:200});
|
||||
assert.equal(result.source.url,urls[1]);assert.equal(result.signedBundle,signedBundleFixture);
|
||||
});
|
||||
|
||||
test('Gist fetch uses numeric-owner pin and immutable revision, never latest contents or raw_url', async () => {
|
||||
const visited=[];
|
||||
const result=await resolveKeys(gistRelease,async (url,init)=>{
|
||||
visited.push(url);assert.equal(init.headers['User-Agent'],'conf-sshd-key-source');assert.equal(init.redirect,'manual');assert.equal(init.cache,'no-store');
|
||||
if(url===gistUrl)return jsonResponse(gistData({'ssh.keys':gistFile('ssh.keys',secondFixture)}));
|
||||
assert.equal(url,gistUrl+'/'+gistRevision);
|
||||
return jsonResponse(gistData({'ssh.keys':gistFile('ssh.keys',fixture)}));
|
||||
});
|
||||
assert.deepEqual(visited,[gistUrl,gistUrl+'/'+gistRevision]);
|
||||
assert.equal(result.sha256,hash(canonical));assert.equal(result.source.type,'gist');assert.equal(result.source.ownerId,12345);
|
||||
assert.equal(result.source.ownerLogin,'original-login');assert.equal(result.source.gistRevision,gistRevision);
|
||||
assert.equal(result.signature,null);
|
||||
});
|
||||
|
||||
test('Gist signed document and signature are extracted from one pinned revision without transforms', async () => {
|
||||
let calls=0;
|
||||
const result=await resolveKeys(gistRelease,async url=>{calls++;return jsonResponse(gistData(url===gistUrl?{}:{'ssh.keys':gistFile('ssh.keys',signedDocument),'ssh.keys.sig':gistFile('ssh.keys.sig',signatureFixture)}));},{requireSigned:true,now:200});
|
||||
assert.equal(calls,2);assert.equal(result.keysText,signedDocument);assert.equal(result.signature,signatureFixture);assert.equal(result.keyRevision,hash(signedDocument));
|
||||
});
|
||||
|
||||
test('Gist bundle has one authoritative document and explicit revocation cannot be refilled', async () => {
|
||||
const revoke=await makeSignedDocument('',{...signedPolicy,revoke:true});
|
||||
const bundle=revoke+SIGNATURE_SEPARATOR+signatureFixture;
|
||||
const result=await resolveKeys(gistRelease,async url=>{assert.ok(url.startsWith(gistUrl));return jsonResponse(gistData({'release.bundle':gistFile('release.bundle',bundle),'ssh.keys':gistFile('ssh.keys',fixture)}));});
|
||||
assert.equal(result.keyCount,0);assert.equal(result.allowEmpty,true);assert.equal(result.keysText,revoke);assert.equal(result.source.file,'release.bundle');
|
||||
});
|
||||
|
||||
test('missing/truncated/malformed Gist signature does not prevent an OFF document response', async () => {
|
||||
for(const optional of [null,gistFile('ssh.keys.sig','bad'),{...gistFile('ssh.keys.sig',signatureFixture),truncated:true}]) {
|
||||
const result=await resolveKeys(gistRelease,async()=>jsonResponse(gistData({'ssh.keys':gistFile('ssh.keys',signedDocument),...(optional?{'ssh.keys.sig':optional}:{})})));
|
||||
assert.equal(result.keysText,signedDocument);assert.equal(result.signature,null);
|
||||
}
|
||||
});
|
||||
|
||||
for (const when of ['latest','revision']) test(`Gist owner mismatch in ${when} fails closed before ordered fallback`, async () => {
|
||||
const visited=[];
|
||||
const result=await resolveKeys(gistRelease,async url=>{
|
||||
visited.push(url);
|
||||
if(url===urls[0])return response(fixture);
|
||||
const data=gistData({'ssh.keys':gistFile('ssh.keys',fixture)});
|
||||
if((when==='latest')===(url===gistUrl))data.owner.id=99999;
|
||||
return jsonResponse(data);
|
||||
});
|
||||
assert.equal(result.source.type,'fallback');assert.equal(visited.length,when==='latest'?2:3);
|
||||
});
|
||||
|
||||
test('Gist rejects top-level truncation, private sources, invalid revision, selected-file truncation and byte mismatches', async () => {
|
||||
const mutations=[data=>{data.truncated=true;},data=>{data.public=false;},data=>{data.history[0].version='../latest';},data=>{data.files['ssh.keys'].truncated=true;},data=>{data.files['ssh.keys'].size++;},data=>{data.files['ssh.keys'].filename='different';},data=>{data.files['ssh.keys'].encoding='base64';},data=>{data.id='b'.repeat(32);}];
|
||||
for(const mutate of mutations){
|
||||
const result=await resolveKeys(gistRelease,async url=>{if(url===urls[0])return response(fixture);const data=gistData({'ssh.keys':gistFile('ssh.keys',fixture)});mutate(data);return jsonResponse(data);});
|
||||
assert.equal(result.source.type,'fallback');
|
||||
}
|
||||
});
|
||||
|
||||
test('Gist combined metadata/revision HTTP/body timeout is bounded and falls back without stale keys', async () => {
|
||||
for(const mode of ['http','json','fetch','body']) {
|
||||
let cancelled=false;
|
||||
const body=new ReadableStream({start(c){c.enqueue(new TextEncoder().encode('{'));},cancel(){cancelled=true;}});
|
||||
const result=await resolveKeys(gistRelease,async url=>{
|
||||
if(url===urls[0])return response(fixture);
|
||||
if(url===gistUrl)return jsonResponse(gistData());
|
||||
if(mode==='http')return new Response('',{status:503});
|
||||
if(mode==='json')return response('{');
|
||||
if(mode==='fetch')return new Promise(()=>{});
|
||||
return new Response(body);
|
||||
},{timeoutMs:20});
|
||||
assert.equal(result.source.type,'fallback');if(mode==='body')assert.equal(cancelled,true);
|
||||
}
|
||||
});
|
||||
|
||||
test('Gist dynamic revision changes content digest while code revision stays fixed', async () => {
|
||||
let current=gistRevision, text=fixture;
|
||||
const fetcher=async url=>{const data=gistData({'ssh.keys':gistFile('ssh.keys',text)});data.history[0].version=current;assert.ok(url===gistUrl||url===gistUrl+'/'+current);return jsonResponse(data);};
|
||||
const first=await resolveKeys(gistRelease,fetcher);
|
||||
current='c'.repeat(40);text=secondFixture;
|
||||
const second=await resolveKeys(gistRelease,fetcher);
|
||||
assert.notEqual(first.sha256,second.sha256);assert.notEqual(first.source.gistRevision,second.source.gistRevision);assert.equal(first.revision,second.revision);
|
||||
});
|
||||
|
||||
test('invalid Gist and signing config is rejected before any network request', async () => {
|
||||
for(const keySource of [null,{type:'other'},{type:'git',url:'https://evil.example'}, {...gistSource,ownerId:'12345'}, {...gistSource,ownerId:0}, {...gistSource,id:'../escape'}, {...gistSource,ownerLogin:'bad/login'}, {...gistSource,file:'../key'}, {...gistSource,signatureFile:'ssh.keys'}, {...gistSource,token:'secret'}]) await assert.rejects(resolveKeys({...gistRelease,keySource},()=>assert.fail('Invalid config must not fetch')));
|
||||
});
|
||||
|
||||
test('Gist response bytes are bounded and no fallback response inherits upstream text or private data', async () => {
|
||||
const result=await resolveKeys(gistRelease,async url=>url===urls[0]?response(fixture):new Response('{}',{headers:{'Content-Length':String(2*SIGNED_BUNDLE_MAX_BYTES+1)}}));
|
||||
assert.equal(result.source.type,'fallback');assert.doesNotMatch(JSON.stringify(result),/TEST-ONLY/);
|
||||
});
|
||||
|
||||
test('named Gist bundles cannot silently downgrade to raw key files', async () => {
|
||||
for(const contents of [fixture,signedDocument]) {
|
||||
const result=await resolveKeys(gistRelease,async url=>url===urls[0]?response(fixture):jsonResponse(gistData({'release.bundle':gistFile('release.bundle',contents)})));
|
||||
assert.equal(result.source.type,'fallback');
|
||||
}
|
||||
});
|
||||
|
||||
+589
-10
@@ -15,12 +15,16 @@ import subprocess
|
||||
import tempfile
|
||||
import time
|
||||
import unittest
|
||||
import json
|
||||
import pty
|
||||
import select
|
||||
import errno
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
SOURCE = (ROOT / 'conf-sshd.sh').read_text()
|
||||
SHELL = shlex.split(os.environ.get('CONF_SSHD_TEST_SHELL', '/bin/sh'))
|
||||
ORIGIN = 'https://keys.example.test'
|
||||
SCRIPT = SOURCE.replace('@@BASE_URL@@', ORIGIN).replace('@@DEFAULT_CRON@@', '*/15 * * * *')
|
||||
SCRIPT = SOURCE.replace('@@BASE_URL@@', ORIGIN).replace('@@DEFAULT_CRON@@', '*/15 * * * *').replace('@@DEFAULT_GPG_VERIFY@@', 'off').replace('@@DEFAULT_GPG_FINGERPRINT@@', '').replace('@@DEFAULT_GPG_PIN_MODE@@', 'primary').replace('@@DEFAULT_LIST_ID@@', '').replace('@@DEFAULT_GPG_EMAIL@@', '')
|
||||
KEY = (ROOT / 'tests/fixtures/keys.pub').read_bytes().strip() + b'\n'
|
||||
BEGIN = b'# --- BEGIN MANAGED BY CONF-SSHD SCRIPT ---\n'
|
||||
END = b'# --- END MANAGED BY CONF-SSHD SCRIPT ---\n'
|
||||
@@ -72,7 +76,17 @@ while [ "$#" -gt 0 ]; do
|
||||
case "$1" in --output) shift; out=$1 ;; https://*) url=$1 ;; esac
|
||||
shift
|
||||
done
|
||||
case $url in */ssh.keys) cp "$TEST_RESPONSE" "$out" ;; */script.sh) cp "$TEST_UPDATE" "$out" ;; *) exit 99 ;; esac
|
||||
status=${TEST_HTTP_STATUS:-200}
|
||||
case $url in
|
||||
*/script.sh) cp "$TEST_UPDATE" "$out" ;;
|
||||
*/public-key.gpg) cp "${TEST_CERTIFICATE:-/nonexistent}" "$out" || exit 22; status=${TEST_CERT_STATUS:-$status} ;;
|
||||
*/mirror/ssh.keys.sig) cp "${TEST_FALLBACK_SIGNATURE:-$TEST_SIGNATURE}" "$out"; status=${TEST_FALLBACK_SIG_STATUS:-$status} ;;
|
||||
*/mirror/ssh.keys) cp "${TEST_FALLBACK_RESPONSE:-$TEST_RESPONSE}" "$out"; status=${TEST_FALLBACK_KEY_STATUS:-$status} ;;
|
||||
*/ssh.keys.sig) cp "${TEST_SIGNATURE:-/nonexistent}" "$out" || exit 22; status=${TEST_SIG_STATUS:-$status} ;;
|
||||
*/ssh.keys) cp "$TEST_RESPONSE" "$out"; status=${TEST_KEY_STATUS:-$status} ;;
|
||||
*) exit 99 ;;
|
||||
esac
|
||||
printf '%s' "$status"
|
||||
''')
|
||||
self.mock('crontab', '''#!/bin/sh
|
||||
printf 'crontab %s\\n' "$*" >> "$TEST_CALLS"
|
||||
@@ -233,7 +247,7 @@ fi
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.assert_clean()
|
||||
calls = self.calls.read_text()
|
||||
for option in ('--fail', '--proto =https', '--connect-timeout 10', '--max-time 30', '--retry 2'):
|
||||
for option in ('--disable', '--fail', '--proto =https', '--connect-timeout 10', '--max-time 30', '--retry 0'):
|
||||
self.assertIn(option, calls)
|
||||
self.assertNotIn('--location', calls)
|
||||
|
||||
@@ -361,7 +375,7 @@ fi
|
||||
self.assertTrue(text.startswith(unrelated))
|
||||
self.assertIn("*/15 * * * * /bin/sh '", text)
|
||||
self.assertIn("'\\''quote/.conf-sshd/conf-sshd.sh' -o", text)
|
||||
self.assertNotIn('-u', text)
|
||||
self.assertNotRegex(text, r'(?:^|\s)-u(?:\s|$)')
|
||||
self.assertEqual(self.installed.stat().st_mode & 0o777, 0o700)
|
||||
text = text.replace('*/15 * * * *', '7 1 * * 2')
|
||||
self.cron.write_text(text)
|
||||
@@ -476,12 +490,12 @@ fi
|
||||
for text in cases:
|
||||
with self.subTest(text=text[:40]):
|
||||
self.update.write_text(text)
|
||||
self.run_script('-u', ok=False)
|
||||
self.run_script('--install', '--download-script', ok=False)
|
||||
self.assertEqual(self.installed.read_bytes(), original)
|
||||
self.assert_clean()
|
||||
self.run_script('-u', ok=False, env={'TEST_CURL_ERROR': '22'})
|
||||
self.run_script('--install', '--download-script', ok=False, env={'TEST_CURL_ERROR': '22'})
|
||||
self.update.write_text(SCRIPT + '\n# new release\n')
|
||||
self.run_script('-u')
|
||||
self.run_script('--install', '--download-script')
|
||||
self.assertEqual(self.installed.read_bytes(), self.update.read_bytes())
|
||||
self.assertEqual(Path(str(self.installed) + '.conf-sshd.bak').read_bytes(), original)
|
||||
self.assertEqual(self.auth.read_bytes(), keys)
|
||||
@@ -668,9 +682,9 @@ fi
|
||||
self.run_script('-c')
|
||||
self.assertIn('8 3 * * * /bin/sh', self.cron.read_text())
|
||||
self.update.write_text(custom + '\n# updated\n')
|
||||
self.run_script('-u')
|
||||
self.run_script('--install', '--download-script')
|
||||
self.update.write_text(SCRIPT)
|
||||
self.run_script('-u', ok=False)
|
||||
self.run_script('--install', '--download-script', ok=False)
|
||||
|
||||
def test_signal_removes_own_lock_and_temporary_files(self):
|
||||
first = subprocess.Popen(self.script_command('-o'),
|
||||
@@ -721,5 +735,570 @@ fi
|
||||
self.assertFalse(self.auth.exists())
|
||||
|
||||
|
||||
class SignatureTests(ShellTests):
|
||||
"""Pure sandbox OpenPGP/TTY fixtures; all network paths intercepted."""
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.fixture_dir = tempfile.TemporaryDirectory(prefix='conf-sshd-gpg-fixtures-')
|
||||
js = r"""
|
||||
import {openPgpFixture} from './tests/helpers/openpgp-fixture.mjs';
|
||||
import {readFileSync} from 'node:fs';
|
||||
const f = openPgpFixture({subkeys:2}), other = openPgpFixture(), expired = openPgpFixture({expired:true}), revoked = openPgpFixture({revoked:true});
|
||||
const key=readFileSync('tests/fixtures/keys.pub','utf8').trim().split(/\s+/).slice(0,2).join(' ')+'\n';
|
||||
const now=Math.floor(Date.now()/1000);
|
||||
function doc({seq=5,list='fixture-list',issued=now-10,expires=now+3600,payload=key,revoke='no'}={}) {
|
||||
return `# conf-sshd-signed-v1\n# list-id ${list}\n# sequence ${seq}\n# issued-at ${issued}\n# expires-at ${expires}\n# revoke ${revoke}\n# key-count ${payload ? payload.trim().split('\n').length : 0}\n# end-metadata\n${payload}`;
|
||||
}
|
||||
const specs={good:{},next:{seq:6},later:{seq:7,expires:now+7200},old:{seq:4},equivocation:{issued:now-9},expired:{seq:6,issued:now-3600,expires:now-1},future:{seq:6,issued:now+3600,expires:now+7200},wronglist:{seq:6,list:'another'},revoke:{seq:6,payload:'',revoke:'yes'},badrevoke:{seq:6,revoke:'yes'},comment:{seq:6,payload:key.trim()+' comment\n'}};
|
||||
const releases={}; for(const [name,spec] of Object.entries(specs)){const data=doc(spec);releases[name]={data,sig:f.sign(data)}}
|
||||
releases.sibling={data:doc({seq:6}),sig:f.sign(doc({seq:6}),1)};
|
||||
releases.textmode={data:doc({seq:6}),sig:f.signText(doc({seq:6}))};
|
||||
releases.wrongsigner={data:doc({seq:6}),sig:other.sign(doc({seq:6}))};
|
||||
console.log(JSON.stringify({publicKey:f.publicKey,primary:f.primaryFingerprint,subkeys:f.signerFingerprints,otherKey:other.publicKey,otherPin:other.primaryFingerprint,otherSig:other.sign(doc({seq:6})),expiredKey:expired.publicKey,expiredPin:expired.primaryFingerprint,expiredSig:expired.sign(doc()),revokedKey:revoked.publicKey,revokedPin:revoked.primaryFingerprint,revokedSig:revoked.sign(doc()),releases}));
|
||||
"""
|
||||
generated = subprocess.run(['node', '--input-type=module', '-e', js], cwd=ROOT,
|
||||
check=True, capture_output=True, text=True)
|
||||
cls.fixtures = json.loads(generated.stdout)
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(cls):
|
||||
cls.fixture_dir.cleanup()
|
||||
|
||||
def setUp(self):
|
||||
super().setUp()
|
||||
self.cert = self.root / 'public-key.gpg'
|
||||
self.cert.write_text(self.fixtures['publicKey'])
|
||||
self.signature = self.root / 'ssh.keys.sig'
|
||||
self.env.update(TEST_CERTIFICATE=str(self.cert), TEST_SIGNATURE=str(self.signature),
|
||||
GNUPGHOME=str(self.root / 'empty-ambient-home'))
|
||||
self.set_release('good')
|
||||
real_gpg = shutil.which('gpg')
|
||||
self.assertIsNotNone(real_gpg)
|
||||
# GnuPG cryptographic work is real. Remote GnuPG discovery never is.
|
||||
self.mock('gpg', f'''#!/bin/sh
|
||||
printf 'gpg %s\\n' "$*" >> "$TEST_CALLS"
|
||||
home=; server=; action=
|
||||
prev=
|
||||
for arg do
|
||||
case $prev in --homedir) home=$arg ;; --keyserver) server=$arg ;; esac
|
||||
case $arg in --recv-keys|--locate-external-keys) action=$arg ;; esac
|
||||
prev=$arg
|
||||
done
|
||||
if [ -n "$action" ]; then
|
||||
if [ "${{TEST_DISCOVERY_SUCCESS:-}}" = "$server" ] || {{ [ "$action" = --locate-external-keys ] && [ "${{TEST_DISCOVERY_SUCCESS:-}}" = wkd ]; }}; then
|
||||
"{real_gpg}" --batch --no-options --no-autostart --yes --dearmor --output "$home/pubring.gpg" "$TEST_CERTIFICATE" 2>/dev/null
|
||||
exit $?
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
exec "{real_gpg}" "$@"
|
||||
''')
|
||||
|
||||
def set_release(self, name):
|
||||
value = self.fixtures['releases'][name]
|
||||
self.payload.write_text(value['data'])
|
||||
self.signature.write_text(value['sig'])
|
||||
|
||||
def run_tty(self, *args, answer=None, ok=True, env=None, script=None):
|
||||
command = self.script_command(*args, script=script)
|
||||
pid, fd = pty.fork()
|
||||
if pid == 0:
|
||||
os.execvpe(command[0], command, self.env | (env or {}))
|
||||
output = bytearray()
|
||||
sent = False
|
||||
deadline = time.monotonic() + 20
|
||||
code = None
|
||||
try:
|
||||
while time.monotonic() < deadline:
|
||||
ready, _, _ = select.select([fd], [], [], 0.05)
|
||||
if ready:
|
||||
try:
|
||||
data = os.read(fd, 65536)
|
||||
except OSError as e:
|
||||
if e.errno != errno.EIO:
|
||||
raise
|
||||
data = b''
|
||||
output.extend(data)
|
||||
if not sent and b'To confirm ' in output:
|
||||
os.write(fd, ((answer if answer is not None else self.fixtures['primary']) + '\n').encode())
|
||||
sent = True
|
||||
result, status = os.waitpid(pid, os.WNOHANG)
|
||||
if result:
|
||||
code = os.waitstatus_to_exitcode(status)
|
||||
break
|
||||
if code is None:
|
||||
os.kill(pid, signal.SIGKILL)
|
||||
os.waitpid(pid, 0)
|
||||
self.fail('TTY fixture timed out: ' + output.decode(errors='replace'))
|
||||
finally:
|
||||
os.close(fd)
|
||||
result = output.decode(errors='replace')
|
||||
if ok:
|
||||
self.assertEqual(code, 0, result)
|
||||
else:
|
||||
self.assertNotEqual(code, 0, result)
|
||||
self.assertNotIn('UNEXPECTED', self.calls.read_text())
|
||||
return result
|
||||
|
||||
def enroll(self, pin=None, mode='primary', extra=(), answer=None, ok=True):
|
||||
pin = pin or self.fixtures['primary']
|
||||
return self.run_tty('--install', '--gpg-verification', 'on', '--gpg-fingerprint', pin,
|
||||
'--gpg-pin-mode', mode, '--list-id', 'fixture-list', *extra,
|
||||
answer=answer or pin, ok=ok)
|
||||
|
||||
@property
|
||||
def local_config(self):
|
||||
return self.home / '.conf-sshd/local.conf'
|
||||
|
||||
@property
|
||||
def replay(self):
|
||||
return self.home / '.conf-sshd/replay.state'
|
||||
|
||||
def test_strict_primary_accepts_bound_subkeys_and_sync_is_offline_for_certificate(self):
|
||||
self.enroll()
|
||||
self.assertIn('policy required\n', self.local_config.read_text())
|
||||
self.assertIn('sequence 5\n', self.replay.read_text())
|
||||
self.assertEqual(self.auth.read_bytes(), BEGIN + b' '.join(KEY.split()[:2]) + b'\n' + END)
|
||||
self.calls.write_text('')
|
||||
self.set_release('sibling')
|
||||
self.run_script('-o')
|
||||
calls = self.calls.read_text()
|
||||
self.assertIn('/ssh.keys.sig', calls)
|
||||
self.assertNotIn('/public-key.gpg', calls)
|
||||
self.assertNotIn('--recv-keys', calls)
|
||||
self.assertNotIn('--locate-external-keys', calls)
|
||||
self.assert_clean()
|
||||
|
||||
def test_strict_exact_subkey_rejects_sibling_and_other_signer(self):
|
||||
self.enroll(pin=self.fixtures['subkeys'][0], mode='subkey')
|
||||
original = self.auth.read_bytes()
|
||||
for name in ('sibling', 'wrongsigner'):
|
||||
self.set_release(name)
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.assert_clean()
|
||||
|
||||
def test_strict_rejects_rollback_equivocation_expiry_future_wronglist_and_unsigned(self):
|
||||
self.enroll()
|
||||
original = self.auth.read_bytes()
|
||||
original_state = self.replay.read_bytes()
|
||||
for name in ('old', 'equivocation', 'expired', 'future', 'wronglist', 'badrevoke', 'comment', 'wrongsigner', 'textmode'):
|
||||
with self.subTest(name=name):
|
||||
self.set_release(name)
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.assertEqual(self.replay.read_bytes(), original_state)
|
||||
self.assert_clean()
|
||||
self.payload.write_bytes(response())
|
||||
self.signature.write_text('')
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
|
||||
def test_strict_idempotent_replay_and_explicit_empty_revocation(self):
|
||||
original = self.old_auth(b'# manual recovery key\n')
|
||||
self.enroll()
|
||||
self.run_script('-o')
|
||||
self.set_release('revoke')
|
||||
self.run_script('-o')
|
||||
self.assertEqual(self.auth.read_bytes(), original + BEGIN + END)
|
||||
self.assertIn('sequence 6\n', self.replay.read_text())
|
||||
self.set_release('good')
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original + BEGIN + END)
|
||||
|
||||
def test_off_never_requests_signature_or_certificate_even_when_present(self):
|
||||
self.signature.write_text('definitely invalid')
|
||||
self.run_script('-o')
|
||||
self.assertNotIn('/ssh.keys.sig', self.calls.read_text())
|
||||
self.assertNotIn('/public-key.gpg', self.calls.read_text())
|
||||
self.assertNotIn('gpg ', self.calls.read_text())
|
||||
self.assertFalse(self.replay.exists())
|
||||
|
||||
def test_signature_requires_exact_http_200_and_exact_bytes(self):
|
||||
self.enroll()
|
||||
original = self.auth.read_bytes()
|
||||
for status in ('201', '204', '206', '301', '404', '503'):
|
||||
for key in ('TEST_KEY_STATUS', 'TEST_SIG_STATUS'):
|
||||
with self.subTest(status=status, part=key):
|
||||
self.run_script('-o', ok=False, env={key:status})
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.payload.write_text(self.payload.read_text().replace('sequence 5', 'sequence 6'))
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
|
||||
def test_cancel_no_tty_and_removed_bypass_preserve_targets_without_network(self):
|
||||
original = self.old_auth()
|
||||
self.enroll(answer='cancel', ok=False)
|
||||
self.assertFalse(self.local_config.exists())
|
||||
self.assertFalse(self.installed.exists())
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.assertEqual(self.calls.read_text(), '')
|
||||
self.run_script('--install', '--gpg-verification', 'on', '--gpg-fingerprint', self.fixtures['primary'], '--list-id', 'fixture-list', ok=False)
|
||||
self.assertEqual(self.calls.read_text(), '')
|
||||
self.run_script('--install', '--confirm-trust', self.fixtures['primary'], ok=False)
|
||||
self.assertEqual(self.calls.read_text(), '')
|
||||
self.assert_clean()
|
||||
|
||||
def test_bad_initial_signature_never_commits_script_config_certificate_or_state(self):
|
||||
original = self.old_auth()
|
||||
self.signature.write_text(self.fixtures['releases']['wrongsigner']['sig'])
|
||||
self.enroll(ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
for path in (self.installed, self.local_config, self.replay):
|
||||
self.assertFalse(path.exists())
|
||||
self.assertEqual(list((self.home / '.conf-sshd').glob('trust-*.asc')), [])
|
||||
self.assert_clean()
|
||||
|
||||
def test_missing_replay_or_pinned_certificate_fails_closed(self):
|
||||
self.enroll()
|
||||
original = self.auth.read_bytes()
|
||||
saved = self.replay.read_bytes()
|
||||
self.replay.unlink()
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
self.replay.write_bytes(saved)
|
||||
next((self.home / '.conf-sshd').glob('trust-*.asc')).unlink()
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
|
||||
def test_local_urls_fallback_order_and_signature_policy_never_downgrade(self):
|
||||
fallbacks = self.root / 'fallbacks'
|
||||
fallbacks.write_text(ORIGIN + '/mirror/ssh.keys\n')
|
||||
self.enroll(extra=('--fallback-urls-file', str(fallbacks)))
|
||||
self.calls.write_text('')
|
||||
self.run_script('-o', env={'TEST_KEY_STATUS':'503'})
|
||||
calls = self.calls.read_text()
|
||||
self.assertLess(calls.index(ORIGIN+'/ssh.keys'), calls.index(ORIGIN+'/mirror/ssh.keys'))
|
||||
self.assertIn('/mirror/ssh.keys.sig', calls)
|
||||
original = self.auth.read_bytes()
|
||||
self.run_script('-o', ok=False, env={'TEST_SIG_STATUS':'404', 'TEST_FALLBACK_SIG_STATUS':'404'})
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
|
||||
def test_persisted_config_is_strict_data_never_executed(self):
|
||||
self.enroll()
|
||||
original = self.auth.read_bytes()
|
||||
self.local_config.write_text(self.local_config.read_text() + 'touch ' + str(self.root/'PWNED') + '\n')
|
||||
self.run_script('-o', ok=False)
|
||||
self.assertFalse((self.root/'PWNED').exists())
|
||||
self.assertEqual(self.auth.read_bytes(), original)
|
||||
|
||||
def test_floor_and_repository_defaults_require_consent(self):
|
||||
self.enroll(extra=('--min-sequence','6'), ok=False)
|
||||
self.assertFalse(self.replay.exists())
|
||||
defaults = SCRIPT.replace("DEFAULT_GPG_VERIFY='off'", "DEFAULT_GPG_VERIFY='on'").replace("DEFAULT_GPG_FINGERPRINT=''", f"DEFAULT_GPG_FINGERPRINT='{self.fixtures['primary']}'").replace("DEFAULT_LIST_ID=''", "DEFAULT_LIST_ID='fixture-list'")
|
||||
self.script.write_text(defaults)
|
||||
self.run_script('-o', ok=False)
|
||||
self.run_tty('-o', answer=self.fixtures['primary'])
|
||||
self.assertFalse(self.installed.exists())
|
||||
self.assertIn('policy required\n', self.local_config.read_text())
|
||||
self.script.write_text(SCRIPT)
|
||||
self.calls.write_text('')
|
||||
self.run_script('-o')
|
||||
self.assertIn('/ssh.keys.sig', self.calls.read_text())
|
||||
|
||||
def test_disable_requires_terminal_and_preserves_reenable_rollback_floor(self):
|
||||
self.enroll()
|
||||
original_config = self.local_config.read_bytes()
|
||||
self.run_script('-o','--gpg-verification','off',ok=False)
|
||||
self.assertEqual(self.local_config.read_bytes(), original_config)
|
||||
self.run_tty('-o','--gpg-verification','off')
|
||||
self.assertIn('policy off\n', self.local_config.read_text())
|
||||
self.assertIn('sequence 5\n', self.replay.read_text())
|
||||
self.set_release('old')
|
||||
self.run_tty('-o','--gpg-verification','on',ok=False)
|
||||
self.assertIn('policy off\n', self.local_config.read_text())
|
||||
|
||||
def test_explicit_reinstall_preserves_urls_pin_and_schedule(self):
|
||||
self.enroll(extra=('-c','7 1 * * 2'))
|
||||
before_config = self.local_config.read_bytes()
|
||||
before_cron = self.cron.read_bytes()
|
||||
old_script = self.installed.read_bytes()
|
||||
self.script.write_text(SCRIPT + '\n# local verified release\n')
|
||||
self.run_tty('--install')
|
||||
self.assertEqual(self.local_config.read_bytes(), before_config)
|
||||
self.assertEqual(self.cron.read_bytes(), before_cron)
|
||||
self.assertEqual(self.installed.read_bytes(), self.script.read_bytes())
|
||||
self.assertEqual(Path(str(self.installed)+'.conf-sshd.bak').read_bytes(), old_script)
|
||||
self.run_script('-u',ok=False)
|
||||
self.run_script('--install','--download-script',ok=False)
|
||||
self.assert_clean()
|
||||
|
||||
def test_wrong_certificate_then_ordered_keyserver_fallback(self):
|
||||
self.enroll(extra=('--gpg-email','[email protected]'), ok=True)
|
||||
# A separate installation uses real cert parsing but all discovery mocked.
|
||||
self.run_script('--uninstall')
|
||||
self.local_config.unlink(); self.replay.unlink()
|
||||
for path in (self.home/'.conf-sshd').glob('trust-*.asc'): path.unlink()
|
||||
self.calls.write_text('')
|
||||
self.run_tty('--install','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list','--gpg-email','[email protected]', env={'TEST_CERT_STATUS':'404','TEST_DISCOVERY_SUCCESS':'hkps://keyserver.ubuntu.com'})
|
||||
calls=self.calls.read_text()
|
||||
self.assertLess(calls.index('/public-key.gpg'),calls.index('--locate-external-keys'))
|
||||
self.assertLess(calls.index('--locate-external-keys'),calls.index('hkps://keys.openpgp.org'))
|
||||
self.assertLess(calls.index('hkps://keys.openpgp.org'),calls.index('hkps://keyserver.ubuntu.com'))
|
||||
self.assert_clean()
|
||||
|
||||
def test_pending_journal_recovers_same_release_after_auth_replace_failure(self):
|
||||
self.enroll()
|
||||
self.set_release('next')
|
||||
real_mv=shutil.which('mv')
|
||||
self.mock('mv',f'''#!/bin/sh
|
||||
last=
|
||||
for arg do last=$arg; done
|
||||
if [ "$last" = "$HOME/.ssh/authorized_keys" ]; then exit 74; fi
|
||||
exec "{real_mv}" "$@"
|
||||
''')
|
||||
# Force a changed authorized_keys body, while retaining its manual lines.
|
||||
self.old_auth(b'# existing manual\n')
|
||||
self.run_script('-o',ok=False)
|
||||
self.assertTrue((self.home/'.conf-sshd/pending.state').exists())
|
||||
self.assertTrue((self.home/'.conf-sshd/pending.bundle').exists())
|
||||
(self.bin/'mv').unlink()
|
||||
self.set_release('old')
|
||||
self.calls.write_text('')
|
||||
self.run_script('-o')
|
||||
self.assertIn('sequence 6\n',self.replay.read_text())
|
||||
self.assertNotIn('curl ',self.calls.read_text())
|
||||
self.assertFalse((self.home/'.conf-sshd/pending.state').exists())
|
||||
self.assertFalse((self.home/'.conf-sshd/pending.bundle').exists())
|
||||
self.assert_clean()
|
||||
|
||||
def test_wrong_expired_revoked_and_multiple_certificate_rejected(self):
|
||||
for name in ('other','expired','revoked'):
|
||||
with self.subTest(name=name):
|
||||
self.cert.write_text(self.fixtures[name+'Key'])
|
||||
pin=self.fixtures[name+'Pin'] if name!='other' else self.fixtures['primary']
|
||||
self.enroll(pin=pin,ok=False)
|
||||
self.assertFalse(self.installed.exists())
|
||||
self.assertFalse(self.local_config.exists())
|
||||
self.assert_clean()
|
||||
self.cert.write_text(self.fixtures['publicKey']+self.fixtures['otherKey'])
|
||||
self.enroll(ok=False)
|
||||
self.assertFalse(self.installed.exists())
|
||||
|
||||
|
||||
def test_signed_pipe_install_requires_tty_then_installs_downloaded_release(self):
|
||||
defaults = SCRIPT.replace("DEFAULT_GPG_VERIFY='off'", "DEFAULT_GPG_VERIFY='on'").replace("DEFAULT_GPG_FINGERPRINT=''", f"DEFAULT_GPG_FINGERPRINT='{self.fixtures['primary']}'").replace("DEFAULT_LIST_ID=''", "DEFAULT_LIST_ID='fixture-list'")
|
||||
self.update.write_text(defaults)
|
||||
wrapper = self.root/'pipe-bootstrap.sh'
|
||||
prelude = shlex.quote(self.isolation_prelude())
|
||||
wrapper.write_text(f"{{ printf '%s' {prelude}; cat {shlex.quote(str(self.update))}; }} | {shlex.join(SHELL)} -s -- --install --download-script -c\n")
|
||||
self.run_script(script=wrapper,ok=False)
|
||||
self.assertFalse(self.installed.exists())
|
||||
self.assertNotIn('curl ',self.calls.read_text())
|
||||
self.run_tty(script=wrapper)
|
||||
self.assertEqual(self.installed.read_text(),defaults)
|
||||
self.assertIn('policy required\n',self.local_config.read_text())
|
||||
self.assertIn('/ssh.keys.sig',self.calls.read_text())
|
||||
self.assertIn('/script.sh',self.calls.read_text())
|
||||
self.assert_clean()
|
||||
|
||||
def test_machine_status_rejects_weak_digest_text_signature_wrong_primary_and_errors(self):
|
||||
self.enroll()
|
||||
original=self.auth.read_bytes()
|
||||
real_gpg=shutil.which('gpg')
|
||||
self.mock('gpg',f'''#!/bin/sh
|
||||
for arg do
|
||||
if [ "$arg" = --verify ]; then cat "$TEST_FAKE_STATUS"; exit 0; fi
|
||||
done
|
||||
exec "{real_gpg}" "$@"
|
||||
''')
|
||||
path=self.root/'status-fixture'
|
||||
signer=self.fixtures['subkeys'][0]
|
||||
primary=self.fixtures['primary']
|
||||
good=f'[GNUPG:] VALIDSIG {signer} 2026-01-01 {int(time.time())-10} 0 4 0 1 8 00 {primary}\n'
|
||||
cases=[good.replace(' 8 00 ',' 11 00 '),good.replace(' 8 00 ',' 8 01 '),
|
||||
good.replace(' 0 4 0 ',' 1 4 0 '),good.replace(' 0 4 0 ',' 0 5 0 '),
|
||||
good.rstrip()+' extra\n',good.rsplit(' ',1)[0]+'\n',
|
||||
good+good,good+'[GNUPG:] KEYREVOKED\n',good+'[GNUPG:] BADARMOR\n',
|
||||
f'[GNUPG:] GOODSIG {signer[-16:]} fixture\n']
|
||||
for status in cases:
|
||||
with self.subTest(status=status):
|
||||
path.write_text(status)
|
||||
self.run_script('-o',ok=False,env={'TEST_FAKE_STATUS':str(path)})
|
||||
self.assertEqual(self.auth.read_bytes(),original)
|
||||
self.assert_clean()
|
||||
|
||||
def test_rotation_preserves_sequence_and_explicit_floor_cannot_lower_it(self):
|
||||
self.enroll()
|
||||
original=self.local_config.read_bytes()
|
||||
self.cert.write_text(self.fixtures['otherKey'])
|
||||
self.payload.write_text(self.fixtures['releases']['next']['data'])
|
||||
self.signature.write_text(self.fixtures['otherSig'])
|
||||
self.enroll(pin=self.fixtures['otherPin'])
|
||||
self.assertNotEqual(self.local_config.read_bytes(),original)
|
||||
self.assertIn('sequence 6\n',self.replay.read_text())
|
||||
self.enroll(pin=self.fixtures['otherPin'],extra=('--min-sequence','5'),ok=False)
|
||||
self.assertIn('sequence 6\n',self.replay.read_text())
|
||||
self.enroll(pin=self.fixtures['otherPin'],extra=('--min-sequence','7'),ok=False)
|
||||
self.assertIn('sequence 6\n',self.replay.read_text())
|
||||
self.assert_clean()
|
||||
|
||||
def test_missing_policy_does_not_reset_security_to_off(self):
|
||||
self.enroll()
|
||||
original=self.auth.read_bytes()
|
||||
self.local_config.unlink()
|
||||
self.run_script('-o',ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(),original)
|
||||
|
||||
def test_worker_certificate_failure_can_use_pinned_local_public_ring_without_mutation(self):
|
||||
ambient=self.root/'local-public-ring'
|
||||
ambient.mkdir(mode=0o700)
|
||||
subprocess.run(['gpg','--batch','--no-options','--no-autostart','--yes','--dearmor','--output',str(ambient/'pubring.gpg'),str(self.cert)],check=True,capture_output=True)
|
||||
before={x.name:x.read_bytes() for x in ambient.iterdir()}
|
||||
self.run_tty('--install','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list',env={'GNUPGHOME':str(ambient),'TEST_CERT_STATUS':'404'})
|
||||
self.assertNotIn('/public-key.gpg',self.calls.read_text())
|
||||
self.assertEqual({x.name:x.read_bytes() for x in ambient.iterdir()},before)
|
||||
self.assert_clean()
|
||||
|
||||
def test_corrupt_pending_package_blocks_reset_and_preserves_keys(self):
|
||||
self.enroll()
|
||||
original=self.auth.read_bytes()
|
||||
pending=self.home/'.conf-sshd/pending.bundle'
|
||||
pending.write_text('invalid\n')
|
||||
self.run_script('-o',ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(),original)
|
||||
self.assertTrue(pending.exists())
|
||||
self.assertIn('sequence 5\n',self.replay.read_text())
|
||||
|
||||
|
||||
def test_expired_pending_is_not_applied_but_higher_fresh_release_can_progress(self):
|
||||
self.enroll()
|
||||
self.set_release('next')
|
||||
real_mv=shutil.which('mv')
|
||||
self.mock('mv',f'''#!/bin/sh
|
||||
last=
|
||||
for arg do last=$arg; done
|
||||
if [ "$last" = "$HOME/.ssh/authorized_keys" ]; then exit 74; fi
|
||||
exec "{real_mv}" "$@"
|
||||
''')
|
||||
self.old_auth(b'# retained manual key\n')
|
||||
self.run_script('-o',ok=False)
|
||||
original=self.auth.read_bytes()
|
||||
(self.bin/'mv').unlink()
|
||||
now=int(time.time())+3700
|
||||
self.mock('date',f'#!/bin/sh\nprintf "%s\\n" "{now}"\n')
|
||||
self.set_release('old')
|
||||
self.run_script('-o',ok=False)
|
||||
self.assertEqual(self.auth.read_bytes(),original)
|
||||
self.assertTrue((self.home/'.conf-sshd/pending.state').exists())
|
||||
self.set_release('later')
|
||||
self.run_script('-o')
|
||||
self.assertIn('sequence 7\n',self.replay.read_text())
|
||||
self.assertFalse((self.home/'.conf-sshd/pending.state').exists())
|
||||
self.assertTrue(self.auth.read_bytes().startswith(original))
|
||||
self.assert_clean()
|
||||
|
||||
def test_missing_security_state_does_not_block_stop_cron_or_uninstall(self):
|
||||
self.enroll(extra=('-c',))
|
||||
original=self.auth.read_bytes()
|
||||
self.replay.unlink()
|
||||
self.run_script('-c','false')
|
||||
self.assertNotIn(CB,self.cron.read_text())
|
||||
self.local_config.write_text('malformed but cleanup should work\n')
|
||||
self.run_script('--uninstall')
|
||||
self.assertFalse(self.installed.exists())
|
||||
self.assertEqual(self.auth.read_bytes(),original)
|
||||
|
||||
def test_reinstall_reuses_dedicated_certificate_before_worker_and_keyservers(self):
|
||||
self.enroll()
|
||||
self.calls.write_text('')
|
||||
self.run_tty('--install',env={'TEST_CERT_STATUS':'404'})
|
||||
calls=self.calls.read_text()
|
||||
self.assertNotIn('/public-key.gpg',calls)
|
||||
self.assertNotIn('--recv-keys',calls)
|
||||
self.assertNotIn('--locate-external-keys',calls)
|
||||
self.assert_clean()
|
||||
|
||||
def test_wkd_lookup_is_optional_bounded_and_stops_before_keyservers(self):
|
||||
self.run_tty('--install','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list','--gpg-email','[email protected]',env={'TEST_CERT_STATUS':'404','TEST_DISCOVERY_SUCCESS':'wkd'})
|
||||
calls=self.calls.read_text()
|
||||
self.assertIn('--locate-external-keys -- [email protected]',calls)
|
||||
self.assertNotIn('--recv-keys',calls)
|
||||
self.assert_clean()
|
||||
|
||||
def test_keyserver_override_replaces_builtins_and_remains_after_reinstall(self):
|
||||
server='hkps://keys.fixture.invalid'
|
||||
self.run_tty('--install','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list','--keyserver',server,env={'TEST_CERT_STATUS':'404','TEST_DISCOVERY_SUCCESS':server})
|
||||
calls=self.calls.read_text()
|
||||
self.assertIn('--keyserver '+server,calls)
|
||||
self.assertNotIn('--keyserver hkps://keys.openpgp.org',calls)
|
||||
self.assertNotIn('--keyserver hkps://keyserver.ubuntu.com',calls)
|
||||
self.assertIn('keyserver '+server+'\n',self.local_config.read_text())
|
||||
self.assertNotIn('keys.openpgp.org',self.local_config.read_text())
|
||||
|
||||
|
||||
def test_failed_script_upgrade_never_activates_on_policy_over_legacy_script(self):
|
||||
self.installed.parent.mkdir(mode=0o700)
|
||||
self.installed.write_text('#!/bin/sh\n# legacy client without verification\n')
|
||||
old_script=self.installed.read_bytes()
|
||||
old_keys=self.old_auth()
|
||||
real_mv=shutil.which('mv')
|
||||
self.mock('mv',f'''#!/bin/sh
|
||||
last=
|
||||
for arg do last=$arg; done
|
||||
if [ "$last" = "$HOME/.conf-sshd/conf-sshd.sh" ]; then exit 74; fi
|
||||
exec "{real_mv}" "$@"
|
||||
''')
|
||||
self.enroll(ok=False)
|
||||
self.assertEqual(self.installed.read_bytes(),old_script)
|
||||
self.assertEqual(self.auth.read_bytes(),old_keys)
|
||||
self.assertFalse(self.local_config.exists())
|
||||
self.assertFalse(self.replay.exists())
|
||||
self.assertEqual(list(self.installed.parent.glob('trust-*.asc')),[])
|
||||
|
||||
def test_keys_only_enrollment_refuses_to_leave_legacy_scheduled_executable(self):
|
||||
self.installed.parent.mkdir(mode=0o700)
|
||||
self.installed.write_text('#!/bin/sh\n# old script\n')
|
||||
self.run_tty('-o','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list',ok=False)
|
||||
self.assertFalse(self.local_config.exists())
|
||||
self.assertNotIn('curl ',self.calls.read_text())
|
||||
|
||||
def test_install_cron_false_preserves_policy_and_never_uses_cleanup_bypass(self):
|
||||
self.enroll(extra=('-c',))
|
||||
original=self.local_config.read_bytes()
|
||||
self.run_tty('--install','-c','false')
|
||||
self.assertEqual(self.local_config.read_bytes(),original)
|
||||
self.assertNotIn(CB,self.cron.read_text())
|
||||
fresh=self.root/'other-home'
|
||||
fresh.mkdir(mode=0o700)
|
||||
self.run_script('--install','-c','false',env={'HOME':str(fresh)})
|
||||
self.assertIn('policy off\n',(fresh/'.conf-sshd/local.conf').read_text())
|
||||
|
||||
def test_missing_dedicated_certificate_can_be_recovered_by_explicit_install(self):
|
||||
self.enroll()
|
||||
next((self.home/'.conf-sshd').glob('trust-*.asc')).unlink()
|
||||
self.run_tty('--install')
|
||||
self.assertTrue(next((self.home/'.conf-sshd').glob('trust-*.asc')).exists())
|
||||
self.assertIn('sequence 5\n',self.replay.read_text())
|
||||
|
||||
|
||||
def test_certificate_export_failure_continues_to_next_discovery_source(self):
|
||||
wrapper=self.bin/'gpg'
|
||||
text=wrapper.read_text()
|
||||
needle='home=; server=; action=\n'
|
||||
injected="""if [ \"${TEST_FAIL_FIRST_EXPORT:-0}\" = 1 ]; then
|
||||
for arg do
|
||||
if [ \"$arg\" = --export ] && [ ! -f \"$TEST_ROOT/export-failed-once\" ]; then
|
||||
: > \"$TEST_ROOT/export-failed-once\"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
"""
|
||||
self.assertIn(needle,text)
|
||||
wrapper.write_text(text.replace(needle,injected+needle,1))
|
||||
self.run_tty('--install','--gpg-verification','on','--gpg-fingerprint',self.fixtures['primary'],'--list-id','fixture-list',env={'TEST_FAIL_FIRST_EXPORT':'1','TEST_DISCOVERY_SUCCESS':'hkps://keys.openpgp.org'})
|
||||
calls=self.calls.read_text()
|
||||
self.assertIn('/public-key.gpg',calls)
|
||||
self.assertIn('--keyserver hkps://keys.openpgp.org --recv-keys',calls)
|
||||
self.assertTrue((self.root/'export-failed-once').exists())
|
||||
self.assertTrue(self.installed.exists())
|
||||
self.assert_clean()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main(verbosity=2)
|
||||
suite=unittest.TestSuite()
|
||||
suite.addTests(unittest.defaultTestLoader.loadTestsFromTestCase(ShellTests))
|
||||
suite.addTests(SignatureTests(name) for name in SignatureTests.__dict__ if name.startswith('test_'))
|
||||
result=unittest.TextTestRunner(verbosity=2).run(suite)
|
||||
raise SystemExit(not result.wasSuccessful())
|
||||
|
||||
@@ -0,0 +1,234 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import {readFile, mkdtemp, writeFile, rm, cp, mkdir} from 'node:fs/promises';
|
||||
import {tmpdir} from 'node:os';
|
||||
import {join} from 'node:path';
|
||||
import {createHash} from 'node:crypto';
|
||||
import {execFileSync} from 'node:child_process';
|
||||
import {makeSignedDocument, parseSignedDocument, parseSignedBundle, parsePublishedSignedRelease, SIGNATURE_SEPARATOR, SIGNED_RELEASE_LIMITS, validateSignature} from '../cf-worker/src/signed-release.js';
|
||||
import {prepare} from '../scripts/prepare-key-release.mjs';
|
||||
import {openPgpFixture} from './helpers/openpgp-fixture.mjs';
|
||||
import {verifyRemote} from '../scripts/verify-release.mjs';
|
||||
import {validateConfig, validateClientDefaults, build, root} from '../scripts/build.mjs';
|
||||
import {validatePublicCertificate, checkSigningCertificate, validatePayloadSignatureStatus} from '../scripts/signature-tools.mjs';
|
||||
|
||||
const fixture = await readFile(new URL('./fixtures/keys.pub', import.meta.url), 'utf8');
|
||||
const canonical = fixture.trim().split(/\s+/).slice(0, 2).join(' ') + '\n';
|
||||
const policy = {listId: 'production', sequence: 1, issuedAt: 100, expiresAt: 300};
|
||||
const document = await makeSignedDocument(fixture, policy);
|
||||
// Structural fixture only: this armor is NOT a cryptographic signature and must never be trusted as one.
|
||||
const signature = '-----BEGIN PGP SIGNATURE-----\n\nYWJj\n-----END PGP SIGNATURE-----\n';
|
||||
|
||||
test('preparation strips all key comments BEFORE signing; document bytes and metadata are exact', async () => {
|
||||
assert.equal(document, '# conf-sshd-signed-v1\n# list-id production\n# sequence 1\n# issued-at 100\n# expires-at 300\n# revoke no\n# key-count 1\n# end-metadata\n' + canonical);
|
||||
const parsed = await parseSignedDocument(document, {now: 200, listId: 'production'});
|
||||
assert.equal(parsed.document, document);
|
||||
assert.equal(parsed.keys[0].label, 'Server key 1');
|
||||
assert.equal(parsed.metadata.documentSha256, createHash('sha256').update(document).digest('hex'));
|
||||
});
|
||||
|
||||
test('bundle parsing returns exact document and signature without implying cryptographic verification', async () => {
|
||||
const bundle = document + SIGNATURE_SEPARATOR + signature;
|
||||
const parsed = await parseSignedBundle(bundle, {now: 200});
|
||||
assert.equal(parsed.bundle, bundle); assert.equal(parsed.document, document); assert.equal(parsed.signature, signature);
|
||||
assert.equal(parsed.verified, undefined);
|
||||
assert.equal(parsed.metadata.sequence, 1);
|
||||
});
|
||||
|
||||
test('signed documents reject comments, CRLF, normalization, duplicate keys, padding changes and trailing bytes', async () => {
|
||||
for (const changed of [document.replace(canonical, fixture), document.replaceAll('\n','\r\n'), document.replace(canonical, canonical.replace(' ', '\t')), document.replace(canonical, canonical + canonical), document + '\n', document.slice(0, -1), document.replace(canonical, canonical + '# extra\n'), document.replace('key-count 1','key-count 2')]) await assert.rejects(parseSignedDocument(changed, {now:200}));
|
||||
});
|
||||
|
||||
test('metadata is fixed-order, single-instance, canonical and bounded', async () => {
|
||||
for (const [from,to] of [['sequence 1','sequence 0'], ['sequence 1','sequence 01'], ['sequence 1','sequence 2147483648'], ['issued-at 100','issued-at 0100'], ['expires-at 300','expires-at 100'], ['expires-at 300','expires-at 10000000000'], ['list-id production','list-id has space'], ['revoke no','revoke yes'], ['key-count 1','key-count 1001'], ['# end-metadata','# unknown value\n# end-metadata']]) await assert.rejects(parseSignedDocument(document.replace(from,to), {now:200}));
|
||||
await assert.rejects(parseSignedDocument(document, {now:200,listId:'different'}));
|
||||
await assert.rejects(parseSignedDocument(document + 'x'.repeat(SIGNED_RELEASE_LIMITS.documentBytes), {now:200}));
|
||||
});
|
||||
|
||||
test('freshness rejects expiration and future issue, optional transport parsing does not enforce client freshness', async () => {
|
||||
await assert.rejects(parseSignedDocument(document, {now:300}), /expired/);
|
||||
const future = await makeSignedDocument(fixture, {...policy,issuedAt:501,expiresAt:800});
|
||||
await assert.rejects(parseSignedDocument(future, {now:200}), /not yet/);
|
||||
assert.equal((await parseSignedDocument(future, {now:201})).metadata.issuedAt, 501);
|
||||
assert.equal((await parseSignedDocument(document, {now:999,checkFreshness:false})).metadata.sequence, 1);
|
||||
});
|
||||
|
||||
test('empty revocation requires signed explicit revoke, no nonempty revoke accepted', async () => {
|
||||
const empty = await makeSignedDocument('', {...policy,revoke:true});
|
||||
assert.equal((await parseSignedDocument(empty, {now:200})).metadata.revoke, true);
|
||||
for (const args of [['',policy], [fixture,{...policy,revoke:true}]]) await assert.rejects(makeSignedDocument(...args));
|
||||
});
|
||||
|
||||
test('malformed or missing signatures do not block OFF documents but fail strict shape policy', async () => {
|
||||
for (const invalid of [null, '', signature.replace('PGP SIGNATURE','PGP PRIVATE KEY BLOCK'), signature.slice(0,-1), signature + signature, 'x'.repeat(SIGNED_RELEASE_LIMITS.signatureBytes+1)]) {
|
||||
const off = await parsePublishedSignedRelease(document, invalid, {checkFreshness:false});
|
||||
assert.equal(off.document, document); assert.equal(off.signature,null); assert.equal(off.bundle,null);
|
||||
await assert.rejects(parsePublishedSignedRelease(document, invalid, {now:200,requireSigned:true}));
|
||||
}
|
||||
assert.equal(validateSignature(signature), signature);
|
||||
await assert.rejects(parseSignedBundle(document + SIGNATURE_SEPARATOR + signature + SIGNATURE_SEPARATOR, {now:200}));
|
||||
});
|
||||
|
||||
test('preparation CLI never overwrites source/output and packs without altering signed bytes', async () => {
|
||||
const dir = await mkdtemp(join(tmpdir(),'conf-prep-'));
|
||||
try {
|
||||
const input=join(dir,'keys'), output=join(dir,'document'), sig=join(dir,'signature'), bundle=join(dir,'bundle');
|
||||
await writeFile(input, fixture); await writeFile(sig, signature);
|
||||
const args=['--input',input,'--output',output,'--list-id','production','--sequence','1','--issued-at','100','--expires-at','300'];
|
||||
await prepare(args); assert.equal(await readFile(output,'utf8'),document);
|
||||
await assert.rejects(prepare(args),/EEXIST/);
|
||||
await prepare(['--input',output,'--signature',sig,'--bundle',bundle]);
|
||||
assert.equal(await readFile(bundle,'utf8'),document+SIGNATURE_SEPARATOR+signature);
|
||||
await assert.rejects(prepare([...args,'--sequence','2']));
|
||||
await assert.rejects(prepare(args.map(value=>value==='100'?'0100':value)));
|
||||
} finally { await rm(dir,{recursive:true,force:true}); }
|
||||
});
|
||||
|
||||
test('deployment client defaults are OFF and reject unsafe templates or incomplete ON pins', () => {
|
||||
assert.deepEqual(validateClientDefaults(),{gpgVerification:'off',fingerprint:'',pinMode:'primary',listId:'',email:''});
|
||||
assert.equal(validateClientDefaults({gpgVerification:'on',fingerprint:'a'.repeat(40),listId:'prod',email:'[email protected]'}).fingerprint,'A'.repeat(40));
|
||||
for (const value of [null,{gpgVerification:'yes'},{gpgVerification:'on'},{fingerprint:'short'},{listId:'bad space'},{listId:'-'},{pinMode:'any'},{email:"a'@example.com"},{email:'[email protected]\n'},{unknown:1}]) assert.throws(()=>validateClientDefaults(value));
|
||||
const base={baseUrl:'https://ssh.example.com',repositoryUrl:'https://github.com/example/repo',defaultCron:'*/15 * * * *',allowEmpty:false};
|
||||
assert.doesNotThrow(()=>validateConfig({...base,signedRelease:{listId:'prod',publicKeyFile:'keys/certificate.asc',fingerprint:'A'.repeat(40)}}));
|
||||
for (const signedRelease of [{listId:'prod',publicKeyFile:'../secret'}, {listId:'prod',fingerprint:'A'.repeat(40)}, {listId:'bad id'}, {listId:'prod',publicKeyFile:'keys/key.asc',fingerprint:'123'}]) assert.throws(()=>validateConfig({...base,signedRelease}));
|
||||
});
|
||||
|
||||
test('public certificate envelope rejects private material and unbounded input', () => {
|
||||
for (const text of ['-----BEGIN PGP PRIVATE KEY BLOCK-----\nabc\n-----END PGP PRIVATE KEY BLOCK-----\n', 'x'.repeat(SIGNED_RELEASE_LIMITS.publicKeyBytes+1), '-----BEGIN PGP PUBLIC KEY BLOCK-----\nabc\n-----END PGP PUBLIC KEY BLOCK-----\n-----BEGIN PGP PUBLIC KEY BLOCK-----\nx\n-----END PGP PUBLIC KEY BLOCK-----\n']) assert.throws(()=>validatePublicCertificate(text));
|
||||
});
|
||||
|
||||
async function buildFixture(config, action) {
|
||||
const directory=await mkdtemp(join(tmpdir(),'conf-signed-build-'));
|
||||
try {
|
||||
await cp(join(root,'site'),join(directory,'site'),{recursive:true});await mkdir(join(directory,'keys'));
|
||||
await cp(join(root,'conf-sshd.sh'),join(directory,'conf-sshd.sh'));
|
||||
await writeFile(join(directory,'deployment.json'),JSON.stringify({baseUrl:'https://ssh.example.com',repositoryUrl:'https://github.com/example/repo',defaultCron:'*/15 * * * *',allowEmpty:false,...config}));
|
||||
return await action(directory,()=>build({directory,revision:'d'.repeat(40),publishedAt:'2026-10-13T00:00:00.000Z'}));
|
||||
} finally {await rm(directory,{recursive:true,force:true});}
|
||||
}
|
||||
|
||||
test('Git build publishes exact detached files as Worker Static Assets and generated bytes', async () => {
|
||||
await buildFixture({},async (dir,buildNow)=>{
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document);await writeFile(join(dir,'keys/ssh.keys.sig'),signature);
|
||||
await writeFile(join(dir,'keys/authorized_keys'),'# ordinary repository file deliberately empty\n');
|
||||
const result=await buildNow();assert.equal(result.keyCount,1);assert.equal(result.signedDocument,document);
|
||||
assert.equal(result.signature,signature);assert.equal(result.signatureAvailable,true);
|
||||
assert.equal(await readFile(join(dir,'cf-worker/public/ssh.keys'),'utf8'),document);
|
||||
assert.equal(await readFile(join(dir,'cf-worker/public/ssh.keys.sig'),'utf8'),signature);
|
||||
assert.equal(result.sha256,createHash('sha256').update(canonical).digest('hex'));
|
||||
const manifest=JSON.parse(await readFile(join(dir,'cf-worker/generated/manifest.json'),'utf8'));
|
||||
assert.equal(manifest.signedMetadata.sequence,1);assert.equal(manifest.signedDocument,undefined);
|
||||
assert.equal(manifest.signature,undefined);assert.equal(manifest.publicCertificate,undefined);
|
||||
});
|
||||
});
|
||||
|
||||
test('Git missing/malformed signature is usable with OFF; bundle and detached files cannot conflict', async () => {
|
||||
await buildFixture({},async (dir,buildNow)=>{
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document);
|
||||
for(const content of [null,'bad']){
|
||||
if(content!==null)await writeFile(join(dir,'keys/ssh.keys.sig'),content);
|
||||
const result=await buildNow();assert.equal(result.signedDocument,document);assert.equal(result.signature,null);
|
||||
await assert.rejects(readFile(join(dir,'cf-worker/public/ssh.keys.sig')),{code:'ENOENT'});
|
||||
}
|
||||
await writeFile(join(dir,'keys/release.bundle'),document+SIGNATURE_SEPARATOR+signature);
|
||||
await assert.rejects(buildNow(),/not both/);
|
||||
});
|
||||
});
|
||||
|
||||
test('Git revocation bundle overrides legacy empty policy without falling back', async () => {
|
||||
await buildFixture({fallbackSources:['https://keys.example.com/fallback']},async (dir,buildNow)=>{
|
||||
const revoke=await makeSignedDocument('',{...policy,revoke:true});
|
||||
await writeFile(join(dir,'keys/release.bundle'),revoke+SIGNATURE_SEPARATOR+signature);
|
||||
const result=await buildNow();assert.equal(result.allowEmpty,true);assert.equal(result.keyCount,0);assert.equal(result.needsFallback,false);
|
||||
assert.equal(await readFile(join(dir,'cf-worker/public/ssh.keys'),'utf8'),revoke);
|
||||
});
|
||||
});
|
||||
|
||||
test('dynamic Gist builds need no local keys and must not publish stale static key placeholders', async () => {
|
||||
await buildFixture({keySource:{type:'gist',id:'a'.repeat(32),ownerId:7,ownerLogin:'example'}},async (dir,buildNow)=>{
|
||||
await writeFile(join(dir,'keys/authorized_keys'),fixture);
|
||||
const result=await buildNow();assert.equal(result.keys.length,0);assert.equal(result.needsSource,true);assert.equal(result.sha256,null);
|
||||
await assert.rejects(readFile(join(dir,'cf-worker/public/ssh.keys')),{code:'ENOENT'});
|
||||
assert.doesNotMatch(await readFile(join(dir,'cf-worker/generated/release.js'),'utf8'),/TEST-ONLY/);
|
||||
});
|
||||
});
|
||||
|
||||
test('ON static defaults fail known-missing signatures and mismatched list IDs', async () => {
|
||||
await buildFixture({clientDefaults:{gpgVerification:'on',fingerprint:'A'.repeat(40),listId:'production'}},async (dir,buildNow)=>{
|
||||
await writeFile(join(dir,'keys/authorized_keys'),fixture);
|
||||
await assert.rejects(buildNow(),/require a signed document/);
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document);await writeFile(join(dir,'keys/ssh.keys.sig'),signature);
|
||||
assert.equal((await buildNow()).clientDefaults.gpgVerification,'on');
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document.replace('list-id production','list-id wrong'));
|
||||
await assert.rejects(buildNow(),/list ID differs/);
|
||||
});
|
||||
});
|
||||
|
||||
test('real detached signatures verify with a public-only isolated GPG keyring and reject tampering/pin mismatch', async () => {
|
||||
const fixture = openPgpFixture({subkey:true});
|
||||
const actualSignature=fixture.sign(document), bundle=document+SIGNATURE_SEPARATOR+actualSignature;
|
||||
assert.equal(await checkSigningCertificate(fixture.publicKey,fixture.primaryFingerprint,bundle),fixture.primaryFingerprint);
|
||||
await assert.rejects(checkSigningCertificate(fixture.publicKey,'A'.repeat(40),bundle),/fingerprint mismatch/);
|
||||
await assert.rejects(checkSigningCertificate(fixture.publicKey,fixture.primaryFingerprint,document.replace('sequence 1','sequence 2')+SIGNATURE_SEPARATOR+actualSignature),/verification failed/);
|
||||
await assert.rejects(checkSigningCertificate(fixture.publicKey,fixture.primaryFingerprint,document+SIGNATURE_SEPARATOR+signature),/verification failed/);
|
||||
});
|
||||
|
||||
test('real revoked and expired signing identities fail even for formerly valid payload signatures', async () => {
|
||||
for(const options of [{expired:true},{revoked:true}]) {
|
||||
const fixture=openPgpFixture(options);
|
||||
await assert.rejects(checkSigningCertificate(fixture.publicKey,fixture.primaryFingerprint,document+SIGNATURE_SEPARATOR+fixture.sign(document)));
|
||||
}
|
||||
});
|
||||
|
||||
test('strict GPG status requires binary v4 strong hash and rejects every failure marker', () => {
|
||||
const fp='A'.repeat(40), status=`[GNUPG:] VALIDSIG ${fp} 2026-01-01 100 0 4 0 1 8 00 ${fp}\n`;
|
||||
assert.equal(validatePayloadSignatureStatus(status,fp).primaryFingerprint,fp);
|
||||
for(const token of ['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']) assert.throws(()=>validatePayloadSignatureStatus(status+`[GNUPG:] ${token} value\n`,fp));
|
||||
for(const invalid of [status+status,status.replace('1 8 00','1 11 00'),status.replace('1 8 00','1 2 00'),status.replace('1 8 00','1 8 01'),status.replace('0 4 0','0 5 0'),status.trim().split(' ').slice(0,-1).join(' '),status.replace('100 0 4','100 101 4')]) assert.throws(()=>validatePayloadSignatureStatus(invalid,fp));
|
||||
});
|
||||
|
||||
test('build publishes only a validated public certificate and verifies exact signed bytes against its primary pin', async () => {
|
||||
const fixture=openPgpFixture({subkey:true});
|
||||
await buildFixture({signedRelease:{listId:'production',publicKeyFile:'keys/certificate.asc',fingerprint:fixture.primaryFingerprint}},async (dir,buildNow)=>{
|
||||
await writeFile(join(dir,'keys/certificate.asc'),fixture.publicKey);
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document);await writeFile(join(dir,'keys/ssh.keys.sig'),fixture.sign(document));
|
||||
const release=await buildNow();assert.equal(release.publicCertificate,fixture.publicKey);
|
||||
assert.equal(await readFile(join(dir,'cf-worker/public/public-key.gpg'),'utf8'),fixture.publicKey);
|
||||
await writeFile(join(dir,'keys/ssh.keys'),document.replace('sequence 1','sequence 2'));
|
||||
await assert.rejects(buildNow(),/verification failed/);
|
||||
});
|
||||
});
|
||||
|
||||
test('remote verification ON cannot pass a dynamic Gist with a missing detached signature', async () => {
|
||||
const revision='a'.repeat(40), gist={type:'gist',id:'b'.repeat(32),ownerId:1,ownerLogin:'user'}, sha256=createHash('sha256').update(canonical).digest('hex');
|
||||
const manifest={revision,baseUrl:'https://ssh.example.com',keySource:gist,needsSource:true,fallbackSources:[],clientDefaults:{gpgVerification:'on'}};
|
||||
const fetcher=async url=>new Response(url.endsWith('/release.json')?JSON.stringify({revision,sha256,keyCount:1,source:{...gist,gistRevision:'c'.repeat(40)}}):url.endsWith('/ssh.keys')?document:'',{status:url.endsWith('/ssh.keys.sig')?404:200});
|
||||
await assert.rejects(verifyRemote(manifest,fetcher),/signature is missing/);
|
||||
const text=await verifyRemote({...manifest,clientDefaults:{gpgVerification:'off'}},fetcher);
|
||||
assert.match(text,/OpenPGP not checked/);
|
||||
});
|
||||
|
||||
|
||||
test('cryptographically valid text-mode signatures are rejected by exact-byte payload policy',async()=>{
|
||||
const fixture=openPgpFixture();
|
||||
const textSignature=fixture.signText(document);
|
||||
const dir=await mkdtemp(join(tmpdir(),'conf-text-signature-'));
|
||||
try {
|
||||
const cert=join(dir,'public.asc'),ring=join(dir,'public.gpg'),doc=join(dir,'document'),sig=join(dir,'document.sig');
|
||||
await writeFile(cert,fixture.publicKey,{mode:0o600});
|
||||
await writeFile(doc,document,{mode:0o600});
|
||||
await writeFile(sig,textSignature,{mode:0o600});
|
||||
const args=['--no-options','--homedir',dir,'--batch','--no-tty','--no-autostart','--no-auto-key-retrieve','--auto-key-locate','clear'];
|
||||
execFileSync('gpg',[...args,'--output',ring,'--dearmor',cert],{stdio:'pipe'});
|
||||
const status=execFileSync('gpg',[...args,'--no-default-keyring','--keyring',ring,'--status-fd','1','--verify',sig,doc],{encoding:'utf8',stdio:['ignore','pipe','pipe']});
|
||||
assert.match(status,/\[GNUPG:\] VALIDSIG .* 01 /);
|
||||
await assert.rejects(checkSigningCertificate(fixture.publicKey,fixture.primaryFingerprint,document+SIGNATURE_SEPARATOR+textSignature),/binary/);
|
||||
} finally {await rm(dir,{recursive:true,force:true});}
|
||||
});
|
||||
|
||||
|
||||
test('list identity dash is reserved consistently with local enrollment state',async()=>{
|
||||
await assert.rejects(makeSignedDocument(fixture,{...policy,listId:'-'}),/list ID/);
|
||||
await assert.rejects(parseSignedDocument(document.replace('# list-id production','# list-id -'),{checkFreshness:false}),/list ID/);
|
||||
assert.throws(()=>validateConfig({baseUrl:'https://ssh.example.com',repositoryUrl:'https://github.com/test/repo',defaultCron:'*/15 * * * *',allowEmpty:false,signedRelease:{listId:'-'}}),/list ID/);
|
||||
});
|
||||
+162
-66
@@ -2,10 +2,14 @@ import assert from "node:assert/strict";
|
||||
import { readFile } from "node:fs/promises";
|
||||
import test from "node:test";
|
||||
import vm from "node:vm";
|
||||
import { commandsFor, renderPage } from "../cf-worker/src/view.js";
|
||||
import { makeSignedDocument, parsePublishedSignedRelease } from "../cf-worker/src/signed-release.js";
|
||||
|
||||
const script = await readFile(new URL("../site/assets/app.js", import.meta.url), "utf8");
|
||||
const html = await readFile(new URL("../site/index.html", import.meta.url), "utf8");
|
||||
const css = await readFile(new URL("../site/assets/style.css", import.meta.url), "utf8");
|
||||
const config = { baseUrl: "https://example.test", repositoryUrl: "https://github.com/example/repo", defaultCron: "*/15 * * * *" };
|
||||
const commands = commandsFor(config);
|
||||
|
||||
class Element {
|
||||
constructor(id, text = "") {
|
||||
@@ -32,12 +36,11 @@ class Element {
|
||||
close() { this.open = false; this.dispatch("close"); }
|
||||
}
|
||||
|
||||
function setup({ keys = ["ssh-ed25519 AAAA exact comment"], savedTheme, brokenStorage = false, clipboard = async () => {}, rawRelease } = {}) {
|
||||
function setup({ commandTexts = commands.map(({command}) => command), savedTheme, brokenStorage = false, clipboard = async () => {}, missingTarget = false } = {}) {
|
||||
const root = new Element("root");
|
||||
const ids = ["theme-picker", "copy-status", "copy-fallback", "fallback-text", "close-copy-fallback", "copy-all-keys", "release-data"];
|
||||
const ids = ["theme-picker", "copy-status", "copy-fallback", "fallback-text", "close-copy-fallback"];
|
||||
const elements = new Map(ids.map((id) => [id, new Element(id)]));
|
||||
const keyElements = keys.map((text, index) => new Element(`key-${index}`, text));
|
||||
const codeElements = [...keyElements, new Element("command-install", "curl -fsSL https://example.test/script.sh | sh -s -- -c")];
|
||||
const codeElements = commandTexts.map((text, index) => new Element(`command-${index}`, text));
|
||||
const pres = codeElements.map((code) => new Element(`pre-${code.id}`));
|
||||
const buttons = codeElements.map((code) => {
|
||||
const button = new Element(`copy-${code.id}`);
|
||||
@@ -46,16 +49,12 @@ function setup({ keys = ["ssh-ed25519 AAAA exact comment"], savedTheme, brokenSt
|
||||
return button;
|
||||
});
|
||||
for (const element of codeElements) elements.set(element.id, element);
|
||||
elements.get("release-data").textContent = rawRelease ?? JSON.stringify({ keys: keys.map((text) => ({ text })) });
|
||||
elements.get("copy-all-keys").setAttribute("aria-label", "复制全部公钥");
|
||||
if (missingTarget) elements.delete(codeElements[0].id);
|
||||
const requestedIds = [];
|
||||
const document = {
|
||||
documentElement: root,
|
||||
getElementById: (id) => elements.get(id) || null,
|
||||
querySelectorAll: (selector) => ({
|
||||
".code-block pre": pres,
|
||||
"[data-copy-target]": buttons,
|
||||
".key-card pre code": keyElements,
|
||||
})[selector] || [],
|
||||
getElementById: (id) => { requestedIds.push(id); return elements.get(id) || null; },
|
||||
querySelectorAll: (selector) => ({ ".code-block pre": pres, "[data-copy-target]": buttons })[selector] || [],
|
||||
};
|
||||
const stored = new Map(savedTheme ? [["quickly-conf-sshd-theme", savedTheme]] : []);
|
||||
const timers = new Map();
|
||||
@@ -71,15 +70,22 @@ function setup({ keys = ["ssh-ed25519 AAAA exact comment"], savedTheme, brokenSt
|
||||
clearTimeout: (id) => timers.delete(id),
|
||||
});
|
||||
vm.runInContext(script, context);
|
||||
return { root, elements, keyElements, codeElements, buttons, pres, stored, flushTimers: () => {
|
||||
return { root, elements, codeElements, buttons, pres, stored, requestedIds, flushTimers: () => {
|
||||
const pending = [...timers.values()];
|
||||
timers.clear();
|
||||
pending.forEach((callback) => callback());
|
||||
} };
|
||||
}
|
||||
|
||||
test("homepage prerenders content, release metadata, and independent local assets", () => {
|
||||
for (const token of ["RELEASE_JSON", "KEYS_HTML", "COMMANDS_HTML", "REVISION", "PUBLISHED_AT", "KEY_COUNT", "REPOSITORY_URL", "RELEASE_LABEL", "PREVIEW_NOTICE", "SOURCE_LABEL", "SOURCE_STATUS", "CONTENT_REVISION", "KEYS_NOTICE"]) {
|
||||
function snapshot(overrides = {}) {
|
||||
return {revision: "a".repeat(40), publishedAt: "2026-10-12T00:00:00Z", keys: [], keyCount: 1, sha256: "b".repeat(64), keyRevision: "c".repeat(64), commands, ...config, ...overrides};
|
||||
}
|
||||
function embeddedMetadata(page) {
|
||||
return JSON.parse(page.match(/<script id="release-data" type="application\/json">([\s\S]*?)<\/script>/)[1]);
|
||||
}
|
||||
|
||||
test("homepage prerenders metadata and commands, never a public-key listing", () => {
|
||||
for (const token of ["RELEASE_JSON", "COMMANDS_HTML", "REVISION", "PUBLISHED_AT", "KEY_COUNT", "REPOSITORY_URL", "RELEASE_LABEL", "PREVIEW_NOTICE", "SOURCE_LABEL", "SOURCE_STATUS", "SIGNATURE_STATUS", "CERTIFICATE_STATUS", "CERTIFICATE_LINK", "CONTENT_REVISION", "KEYS_NOTICE"]) {
|
||||
assert.ok(html.includes(`@@${token}@@`), `${token} placeholder is required`);
|
||||
}
|
||||
assert.match(html, /<html lang="zh-CN">/);
|
||||
@@ -90,8 +96,124 @@ test("homepage prerenders content, release metadata, and independent local asset
|
||||
assert.match(html, /<noscript>/);
|
||||
assert.match(html, /不代表所有服务器均已同步/);
|
||||
assert.match(html, /不会要求上传或输入私钥/);
|
||||
assert.doesNotMatch(html, /github\.io|https?:[^"']+\.(?:css|js)["']/);
|
||||
assert.doesNotMatch(html, /copy-all-commands/);
|
||||
assert.match(html, /公钥不是秘密/);
|
||||
assert.match(html, /原始 API 与公开 Git \/ Gist/);
|
||||
assert.doesNotMatch(html, /KEYS_HTML|key-list|key-card|copy-all|github\.io|https?:[^"']+\.(?:css|js)["']/);
|
||||
});
|
||||
|
||||
test("homepage projection excludes raw keys, fingerprints, comments and signed document content", () => {
|
||||
const secretMarker = "must-not-appear-in-homepage";
|
||||
const key = {text: `ssh-ed25519 ${secretMarker} comment`, fingerprint: `SHA256:${secretMarker}`, label: `${secretMarker}<script>`, type: "ssh-ed25519"};
|
||||
const page = renderPage(html, snapshot({keys: [key], keysText: key.text, signedDocument: key.text, signature: `-----BEGIN PGP SIGNATURE-----\nComment: ${secretMarker}\n\nAQID\n-----END PGP SIGNATURE-----\n`, publicCertificate: secretMarker, signedBundle: secretMarker, signedMetadata: {listId: secretMarker}, source: {type: "gist", url: "https://gist.github.com/example/example", keys: [key], fingerprint: key.fingerprint}}));
|
||||
assert.doesNotMatch(page, new RegExp(secretMarker));
|
||||
assert.doesNotMatch(page, /ssh-ed25519|SHA256:|data-copy-target="key-|id="key-\d|class="key-card"/);
|
||||
const embedded = embeddedMetadata(page);
|
||||
assert.deepEqual(Object.keys(embedded).sort(), ["schema", "revision", "publishedAt", "keyCount", "sha256", "keyRevision", "source", "sourceStatus", "signaturePresent", "signatureStatus", "certificatePresent", "certificateStatus", "repositoryUrl", "testFixture"].sort());
|
||||
assert.deepEqual(embedded.source, {type: "gist", url: "https://gist.github.com/example/example"});
|
||||
assert.equal(embedded.keyCount, 1);
|
||||
assert.equal(embedded.keyRevision, "c".repeat(64));
|
||||
assert.equal(embedded.signaturePresent, true);
|
||||
assert.match(embedded.signatureStatus, /待客户端验证/);
|
||||
assert.doesNotMatch(embedded.signatureStatus, /已验签|已验证签名|verified/i);
|
||||
assert.match(page, /不代表 Worker 已验证签名/);
|
||||
});
|
||||
|
||||
test("source states and signature presence describe one snapshot without claiming verification", () => {
|
||||
for (const [type, status] of [["repository", "可用"], ["git", "可用"], ["gist", "可用"], ["fallback", "备用源可用"], ["unavailable", "暂不可用"], ["pending", "待获取"], ["explicit-empty", "明确撤销"]]) {
|
||||
const unavailable = ["unavailable", "pending"].includes(type);
|
||||
const empty = unavailable || type === "explicit-empty";
|
||||
const state = snapshot({source: {type, url: 'https://example.test/list?text=<script>window.__injected=true</script>'}, keyCount: empty ? 0 : 1, allowEmpty: type === "explicit-empty", sha256: empty ? null : "b".repeat(64), keyRevision: empty ? null : "c".repeat(64)});
|
||||
const page = renderPage(html, state);
|
||||
const embedded = embeddedMetadata(page);
|
||||
assert.equal(embedded.sourceStatus, status);
|
||||
assert.equal(embedded.keyCount, empty ? 0 : 1);
|
||||
assert.equal(embedded.signaturePresent, false);
|
||||
assert.equal(embedded.signatureStatus, "未提供签名包");
|
||||
assert.doesNotMatch(page, /<script>window\.__injected/);
|
||||
if (unavailable) assert.match(page, /未发布撤销指令.*保留上次成功密钥/);
|
||||
if (type === "explicit-empty") assert.match(page, /明确撤销全部受管理公钥/);
|
||||
}
|
||||
assert.equal(embeddedMetadata(renderPage(html, snapshot({signature: "unvalidated signature alone"}))).signaturePresent, false);
|
||||
assert.match(renderPage(html, snapshot({source: {type: "gist"}, keyCount: 0, allowEmpty: true})), /class="source-status">明确撤销/);
|
||||
});
|
||||
|
||||
test("a parsed valid document with missing or malformed signature stays unsigned on the homepage", async () => {
|
||||
const fixture = await readFile(new URL("./fixtures/keys.pub", import.meta.url), "utf8");
|
||||
const document = await makeSignedDocument(fixture, {listId: "homepage-regression", sequence: 1, issuedAt: 1, expiresAt: 2});
|
||||
for (const signature of [null, "malformed-detached-signature"]) {
|
||||
const parsed = await parsePublishedSignedRelease(document, signature, {checkFreshness: false});
|
||||
assert.ok(parsed.metadata);
|
||||
assert.equal(parsed.signature, null);
|
||||
const page = renderPage(html, snapshot({keys: parsed.keys, keysText: parsed.document, signedDocument: parsed.document, signedMetadata: parsed.metadata, signature: parsed.signature, signedBundle: parsed.bundle}));
|
||||
const metadata = embeddedMetadata(page);
|
||||
assert.equal(metadata.signaturePresent, false);
|
||||
assert.equal(metadata.signatureStatus, "未提供签名包");
|
||||
assert.equal(metadata.certificatePresent, false);
|
||||
assert.ok(!page.includes(parsed.keys[0].text));
|
||||
assert.ok(!page.includes(document));
|
||||
assert.doesNotMatch(page, /malformed-detached-signature|conf-sshd-signed-v1/);
|
||||
}
|
||||
});
|
||||
|
||||
test("signature and certificate availability are independent and never expose their bytes", () => {
|
||||
const document = "document-bytes-must-not-appear";
|
||||
const signature = "-----BEGIN PGP SIGNATURE-----\nComment: signature-bytes-must-not-appear\n\nAQID\n-----END PGP SIGNATURE-----\n";
|
||||
const certificate = "-----BEGIN PGP PUBLIC KEY BLOCK-----\ncertificate-bytes-must-not-appear\n-----END PGP PUBLIC KEY BLOCK-----\n";
|
||||
const paired = {keysText: document, signedDocument: document, signedMetadata: {listId: "test-list"}};
|
||||
const cases = [
|
||||
{name: "document alone", data: paired, signature: false, certificate: false},
|
||||
{name: "malformed detached signature", data: {...paired, signature: "malformed-signature-must-not-appear"}, signature: false, certificate: false},
|
||||
{name: "valid pair without certificate", data: {...paired, signature}, signature: true, certificate: false},
|
||||
{name: "certificate without signature", data: {...paired, publicCertificate: certificate}, signature: false, certificate: true},
|
||||
{name: "valid pair with certificate", data: {...paired, signature, publicCertificate: certificate}, signature: true, certificate: true},
|
||||
{name: "wrong document pair", data: {...paired, keysText: "different-document", signature}, signature: false, certificate: false},
|
||||
{name: "explicit unavailable flags", data: {...paired, signature, publicCertificate: certificate, signatureAvailable: false, publicCertificateAvailable: false}, signature: false, certificate: false},
|
||||
{name: "explicit available flags", data: {signatureAvailable: true, publicCertificateAvailable: true}, signature: true, certificate: true},
|
||||
{name: "unavailable keys retain independent certificate", data: {...paired, source: {type: "unavailable"}, signatureAvailable: true, publicCertificate: certificate}, signature: false, certificate: true},
|
||||
];
|
||||
for (const entry of cases) {
|
||||
const page = renderPage(html, snapshot(entry.data));
|
||||
const metadata = embeddedMetadata(page);
|
||||
assert.equal(metadata.signaturePresent, entry.signature, entry.name);
|
||||
assert.equal(metadata.certificatePresent, entry.certificate, entry.name);
|
||||
assert.equal(metadata.signatureStatus, entry.signature ? "签名包已提供（待客户端验证）" : "未提供签名包", entry.name);
|
||||
assert.equal(metadata.certificateStatus, entry.certificate ? "公开证书已提供（安装时核验）" : "未提供公开证书", entry.name);
|
||||
assert.equal(page.includes('href="/public-key.gpg"'), entry.certificate, entry.name);
|
||||
assert.doesNotMatch(page, /must-not-appear|BEGIN PGP|AQID/, entry.name);
|
||||
assert.equal(metadata.signedMetadata, undefined);
|
||||
assert.equal(metadata.signature, undefined);
|
||||
assert.equal(metadata.publicCertificate, undefined);
|
||||
}
|
||||
});
|
||||
|
||||
test("commands use an explicit installer and fixed installed client; no self-update command", () => {
|
||||
const byId = Object.fromEntries(commands.map((command) => [command.id, command]));
|
||||
assert.equal(byId.install.command, "curl -fsSL 'https://example.test/script.sh' | sh -s -- --install --download-script -c");
|
||||
assert.equal(byId.once.command, 'sh "$HOME/.conf-sshd/conf-sshd.sh" -o');
|
||||
assert.equal(byId.preview.command, 'sh "$HOME/.conf-sshd/conf-sshd.sh" -o --dry-run');
|
||||
assert.equal(byId.help.command, "curl -fsSL 'https://example.test/script.sh' | sh -s -- -h");
|
||||
assert.match(byId.help.description, /不建立信任/);
|
||||
assert.match(byId.install.description, /备份.*保留本地配置/);
|
||||
assert.match(byId.install.description, /首次安装或明确重装都会信任你执行的脚本/);
|
||||
assert.match(byId.install.description, /推荐先独立核验安装脚本/);
|
||||
assert.doesNotMatch(byId.install.description, /重装须使用.*本地脚本/);
|
||||
assert.equal(byId.update, undefined);
|
||||
for (const id of ["root-off", "root-on", "uninstall"]) {
|
||||
assert.equal(byId[id].advanced, true);
|
||||
assert.ok(byId[id].command.startsWith('sh "$HOME/.conf-sshd/conf-sshd.sh"'));
|
||||
}
|
||||
assert.ok(commands.every(({command}) => !/(?:^|\s)-u(?:\s|$)|--update/.test(command)));
|
||||
assert.match(html, /预期 SHA-256.*pin/);
|
||||
assert.match(html, /验签默认关闭/);
|
||||
assert.match(html, /--install --gpg-verification on/);
|
||||
assert.match(html, /远端发布内容不能关闭本地验签/);
|
||||
assert.match(html, /本地终端确认完整指纹，不能跳过确认/);
|
||||
assert.match(html, /日常同步不联网刷新证书/);
|
||||
assert.doesNotMatch(html, /--confirm-trust/);
|
||||
assert.match(html, /不请求签名/);
|
||||
assert.match(html, /两者均返回 200/);
|
||||
assert.match(html, /href="\/ssh\.keys\.sig"/);
|
||||
assert.doesNotMatch(html, /\/key-release/);
|
||||
});
|
||||
|
||||
test("default follows system and explicit light/dark/system choices persist", () => {
|
||||
@@ -119,13 +241,13 @@ test("storage restrictions do not prevent theme selection or enhancement", () =>
|
||||
for (const pre of page.pres) assert.equal(pre.getAttribute("tabindex"), "0");
|
||||
});
|
||||
|
||||
test("individual key and command copies retain every byte, including comments and punctuation", async () => {
|
||||
const exact = `ssh-ed25519 ${"A".repeat(2000)} user <script> & \"quoted\" 中文`;
|
||||
test("individual command copies retain every byte, including shell quotes and punctuation", async () => {
|
||||
const exact = `sh "$HOME/${"long-path-".repeat(250)}/conf-sshd.sh" -o --dry-run`;
|
||||
const copied = [];
|
||||
const page = setup({ keys: [exact], clipboard: async (text) => copied.push(text) });
|
||||
const page = setup({ commandTexts: [commands[0].command, exact], clipboard: async (text) => copied.push(text) });
|
||||
await page.buttons[0].dispatch("click");
|
||||
await page.buttons[1].dispatch("click");
|
||||
assert.deepEqual(copied, [exact, page.codeElements[1].textContent]);
|
||||
assert.deepEqual(copied, [commands[0].command, exact]);
|
||||
assert.equal(page.buttons[0].dataset.state, "success");
|
||||
assert.match(page.buttons[0].getAttribute("aria-label"), /已复制/);
|
||||
assert.equal(page.buttons[0].disabled, false);
|
||||
@@ -133,32 +255,29 @@ test("individual key and command copies retain every byte, including comments an
|
||||
page.flushTimers();
|
||||
assert.equal(page.elements.get("copy-status").textContent, "已复制完整内容。");
|
||||
assert.equal(page.buttons[0].dataset.state, undefined);
|
||||
assert.equal(page.buttons[0].getAttribute("aria-label"), "复制 key-0");
|
||||
assert.equal(page.buttons[0].getAttribute("aria-label"), "复制 command-0");
|
||||
});
|
||||
|
||||
test("copy all contains only raw public keys and a final LF, never commands", async () => {
|
||||
const keys = ["ssh-ed25519 AAAA key one", "ssh-rsa BBBB key two"];
|
||||
test("page enhancement neither requests key data nor reads embedded release metadata", () => {
|
||||
const page = setup();
|
||||
assert.ok(!page.requestedIds.includes("release-data"));
|
||||
assert.ok(!page.requestedIds.includes("copy-all-keys"));
|
||||
assert.doesNotMatch(script, /release-data|release\.keys|key-card|allKeysButton|JSON\.parse|\bfetch\s*\(|XMLHttpRequest|WebSocket|EventSource/);
|
||||
});
|
||||
|
||||
test("missing command targets disable only their own copy buttons", async () => {
|
||||
const copied = [];
|
||||
const page = setup({ keys, clipboard: async (text) => copied.push(text) });
|
||||
await page.elements.get("copy-all-keys").dispatch("click");
|
||||
assert.deepEqual(copied, [`${keys.join("\n")}\n`]);
|
||||
assert.ok(!copied[0].includes("curl"));
|
||||
const page = setup({missingTarget: true, clipboard: async (text) => copied.push(text)});
|
||||
assert.equal(page.buttons[0].disabled, true);
|
||||
await page.buttons[0].dispatch("click");
|
||||
await page.buttons[1].dispatch("click");
|
||||
assert.deepEqual(copied, [page.codeElements[1].textContent]);
|
||||
});
|
||||
|
||||
test("missing or malformed release metadata falls back to prerendered keys", async () => {
|
||||
for (const rawRelease of ["not json", "{}", '{"keys":[null]}']) {
|
||||
const copied = [];
|
||||
const page = setup({ keys: ["ssh-ed25519 AAAA fallback"], rawRelease, clipboard: async (text) => copied.push(text) });
|
||||
await page.elements.get("copy-all-keys").dispatch("click");
|
||||
assert.deepEqual(copied, ["ssh-ed25519 AAAA fallback\n"]);
|
||||
}
|
||||
assert.equal(setup({ keys: [] }).elements.get("copy-all-keys").disabled, true);
|
||||
});
|
||||
|
||||
test("denied or unavailable clipboard offers exact text for manual copy and returns focus", async () => {
|
||||
test("denied or unavailable clipboard offers exact command for manual copy and returns focus", async () => {
|
||||
for (const clipboard of [null, async () => { throw new Error("NotAllowedError"); }]) {
|
||||
const exact = "ssh-ed25519 AAAA comment <not markup>";
|
||||
const page = setup({ keys: [exact], clipboard });
|
||||
const exact = commands[0].command;
|
||||
const page = setup({ commandTexts: [exact], clipboard });
|
||||
await page.buttons[0].dispatch("click");
|
||||
const dialog = page.elements.get("copy-fallback");
|
||||
const textarea = page.elements.get("fallback-text");
|
||||
@@ -197,34 +316,11 @@ test("repeated clicks while clipboard is pending make a single request and retri
|
||||
assert.equal(page.buttons[0].dataset.state, "success");
|
||||
});
|
||||
|
||||
test("unavailable or explicitly revoked key sets leave copy-all disabled and make no clipboard request", async () => {
|
||||
for (const sourceStatus of ["暂不可用", "明确撤销"]) {
|
||||
const copied = [];
|
||||
const page = setup({ keys: [], rawRelease: JSON.stringify({ keys: [], sourceStatus }), clipboard: async (text) => copied.push(text) });
|
||||
assert.equal(page.elements.get("copy-all-keys").disabled, true);
|
||||
await page.elements.get("copy-all-keys").dispatch("click");
|
||||
assert.deepEqual(copied, []);
|
||||
}
|
||||
assert.match(html, /公钥来源/);
|
||||
assert.match(html, /代码版本/);
|
||||
assert.match(html, /公钥版本/);
|
||||
assert.match(html, /class="keys-notice" role="note"/);
|
||||
});
|
||||
|
||||
test("CSS covers system theme, narrow viewports, touch copies, focus, and reduced motion", () => {
|
||||
assert.match(css, /prefers-color-scheme: dark/);
|
||||
assert.match(css, /:root\[data-theme="dark"\]/);
|
||||
assert.match(css, /max-width: 680px/);
|
||||
assert.match(css, /hover: hover/);
|
||||
assert.match(css, /pointer: fine/);
|
||||
assert.match(css, /focus-within/);
|
||||
assert.match(css, /focus-visible/);
|
||||
assert.match(css, /overflow-x: auto/);
|
||||
assert.match(css, /prefers-reduced-motion/);
|
||||
assert.doesNotMatch(script, /innerHTML|insertAdjacentHTML|\beval\s*\(|\bfetch\s*\(/);
|
||||
for (const pattern of [/prefers-color-scheme: dark/, /:root\[data-theme="dark"\]/, /max-width: 680px/, /hover: hover/, /pointer: fine/, /focus-within/, /focus-visible/, /overflow-x: auto/, /prefers-reduced-motion/]) assert.match(css, pattern);
|
||||
assert.doesNotMatch(script, /innerHTML|insertAdjacentHTML|\beval\s*\(/);
|
||||
});
|
||||
|
||||
|
||||
test("touch and narrow layouts explicitly override desktop copy-button hiding", () => {
|
||||
const override = css.match(/@media \(hover: none\), \(pointer: coarse\), \(any-pointer: coarse\), \(max-width: 680px\) \{[\s\S]*?\n\}/);
|
||||
assert.ok(override, "touch, hybrid, and narrow layouts need an explicit visibility rule");
|
||||
|
||||
+48
-3
@@ -19,7 +19,7 @@ test('explicit endpoints ignore user agent and are never cached',async()=>{
|
||||
}
|
||||
});
|
||||
test('root serves browser HTML and legacy curl script without content mixing',async()=>{
|
||||
for(const agent of ['curl/8.1.0','libcurl/8.1.0']){
|
||||
for(const agent of ['curl/8.1.0','libcurl/8.1.0','Wget/1.21.3','HTTPie/3.2.4']){
|
||||
const response=await fetch(request('/',{headers:{'User-Agent':agent,Accept:'*/*'}}),env);
|
||||
assert.equal(await response.text(),release.script);assert.equal(response.headers.get('Vary'),'Accept, User-Agent');
|
||||
}
|
||||
@@ -48,9 +48,9 @@ test('fallback page and key metadata represent one effective snapshot; unavailab
|
||||
const fallback={...release,keys:[],keyCount:0,sha256:null,keysText:null,fallbackSources:['https://keys.example.com/server.keys']};
|
||||
const handler=createHandler(fallback,{fetchImpl:async()=>new Response(fixture)});
|
||||
const html=await (await handler(request('/'),env)).text();
|
||||
assert.ok(html.includes('备用源可用'));assert.ok(html.includes('https://keys.example.com/server.keys'));assert.ok(html.includes(keys[0].fingerprint));
|
||||
assert.ok(html.includes('备用源可用'));assert.ok(html.includes('https://keys.example.com/server.keys'));assert.ok(!html.includes(keys[0].fingerprint));assert.ok(!html.includes(keys[0].text));
|
||||
const match=html.match(/<script id="release-data" type="application\/json">([\s\S]*?)<\/script>/);
|
||||
const embedded=JSON.parse(match[1]);assert.equal(embedded.sha256,bundle.sha256);assert.equal(embedded.keyCount,1);assert.equal(embedded.keys[0].text,keys[0].text);
|
||||
const embedded=JSON.parse(match[1]);assert.equal(embedded.sha256,bundle.sha256);assert.equal(embedded.keyCount,1);assert.equal(embedded.keys,undefined);
|
||||
const metadata=await (await handler(request('/release.json'),env)).json();assert.equal(metadata.keyRevision,bundle.sha256);assert.equal(metadata.source.type,'fallback');
|
||||
assert.equal(await (await handler(request('/ssh.keys'),env)).text(),bundle.text);
|
||||
const unavailable=createHandler(fallback,{fetchImpl:async()=>new Response('',{status:503})});
|
||||
@@ -64,3 +64,48 @@ test('explicit empty revocation suppresses fallback in page, metadata and keys',
|
||||
const html=await (await handler(request('/'),env)).text();assert.ok(html.includes('明确撤销'));assert.ok(!html.includes('未发布撤销指令'));
|
||||
const keysText=await (await handler(request('/ssh.keys'),env)).text();assert.match(keysText,/# key-count 0\n# allow-empty yes/);
|
||||
});
|
||||
|
||||
test('signature endpoint never invents a signature for unsigned sources',async()=>{
|
||||
for(const method of ['GET','HEAD']) {
|
||||
const response=await fetch(request('/ssh.keys.sig',{method}),env);
|
||||
assert.equal(response.status,404);
|
||||
assert.equal(response.headers.get('Cache-Control'),'no-store');
|
||||
if(method==='HEAD') assert.equal(await response.text(),'');
|
||||
}
|
||||
const metadata=await(await fetch(request('/release.json'),env)).json();
|
||||
assert.equal(metadata.signatureAvailable,false);
|
||||
assert.equal(metadata.signatureVerifiedByWorker,false);
|
||||
assert.equal(metadata.signedMetadata,null);
|
||||
});
|
||||
|
||||
test('public certificate is independent of unavailable key sources and never cached',async()=>{
|
||||
assert.equal((await fetch(request('/public-key.gpg'),env)).status,404);
|
||||
const certificate='-----BEGIN PGP PUBLIC KEY BLOCK-----\nfixture-public-only\n-----END PGP PUBLIC KEY BLOCK-----\n';
|
||||
const handler=createHandler({...release,publicCertificate:certificate,keys:[],allowEmpty:false,fallbackSources:['https://bad.example.com/keys']},{fetchImpl:async()=>{throw Error('certificate must not resolve keys')}});
|
||||
const response=await handler(request('/public-key.gpg'),env);
|
||||
assert.equal(response.status,200);assert.equal(await response.text(),certificate);
|
||||
assert.equal(response.headers.get('Cache-Control'),'no-store');
|
||||
assert.equal(response.headers.get('Content-Type'),'application/pgp-keys');
|
||||
assert.equal(await(await handler(request('/public-key.gpg',{method:'HEAD'}),env)).text(),'');
|
||||
});
|
||||
|
||||
test('signature endpoint pairs with exact signed document, never the legacy wrapper',async()=>{
|
||||
const {makeSignedDocument}=await import('../cf-worker/src/signed-release.js');
|
||||
const document=await makeSignedDocument(fixture,{listId:'test-list',sequence:1,issuedAt:1700000000,expiresAt:1900000000});
|
||||
// Structurally valid, deliberately non-cryptographic armor tests routing only.
|
||||
const signature='-----BEGIN PGP SIGNATURE-----\n\nYWJj\n-----END PGP SIGNATURE-----\n';
|
||||
const handler=createHandler({...release,signedDocument:document,signature});
|
||||
const keysResponse=await handler(request('/ssh.keys'),env);
|
||||
assert.equal(keysResponse.status,200);assert.equal(await keysResponse.text(),document);
|
||||
const sigResponse=await handler(request('/ssh.keys.sig'),env);
|
||||
assert.equal(sigResponse.status,200);assert.equal(await sigResponse.text(),signature);
|
||||
assert.equal(sigResponse.headers.get('Content-Type'),'application/pgp-signature');
|
||||
assert.equal(sigResponse.headers.get('Cache-Control'),'no-store');
|
||||
const metadata=await(await handler(request('/release.json'),env)).json();
|
||||
assert.equal(metadata.signatureAvailable,true);assert.equal(metadata.signatureVerifiedByWorker,false);
|
||||
assert.equal(metadata.signedMetadata.sequence,1);
|
||||
assert.equal(metadata.keyRevision,metadata.signedMetadata.documentSha256);
|
||||
const unsigned=createHandler({...release,signedDocument:document,signature:null});
|
||||
assert.equal(await(await unsigned(request('/ssh.keys'),env)).text(),document);
|
||||
assert.equal((await unsigned(request('/ssh.keys.sig'),env)).status,404);
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user