${escapeHTML(key.label)}
${escapeHTML(key.type)}${escapeHTML(key.fingerprint)}
${codeBlock(`key-${i}`,key.text,`复制第 ${i + 1} 个公钥`)}${escapeHTML(text)}${escapeHTML(key.fingerprint)}
${codeBlock(`key-${i}`,key.text,`复制第 ${i + 1} 个公钥`)}此版本明确撤销全部受管理公钥，手工管理的公钥仍保留。
'; -} export function renderCommands(commands) { const card = command => `${escapeHTML(command.description)}
${codeBlock(`command-${command.id}`,command.command,`复制“${command.title}”命令`)}测试预览：这里使用公开测试密钥，不能部署到真实服务器。
' : '', - SOURCE_LABEL:escapeHTML(sourceLabel),SOURCE_STATUS:escapeHTML(sourceStatus),CONTENT_REVISION:escapeHTML(snapshot.sha256?.slice(0,12) || '—'),KEYS_NOTICE:escapeHTML(notice), + COMMANDS_HTML:renderCommands(commands),REVISION:escapeHTML(revision.slice(0,12)),PUBLISHED_AT:escapeHTML(publishedAt),KEY_COUNT:String(keyCount), + REPOSITORY_URL:escapeHTML(repositoryUrl),RELEASE_LABEL:testFixture ? '测试预览' : unavailable ? '等待发布源' : '发布元数据', + PREVIEW_NOTICE:testFixture ? '测试预览：这里使用公开测试数据，不能部署到真实服务器。
' : '', + CERTIFICATE_LINK:certificatePresent ? '公开签名证书 ' : '', + SOURCE_LABEL:escapeHTML(sourceLabel),SOURCE_STATUS:escapeHTML(sourceStatus),SIGNATURE_STATUS:escapeHTML(signatureStatus),CERTIFICATE_STATUS:escapeHTML(certificateStatus),CONTENT_REVISION:escapeHTML((snapshot.keyRevision || snapshot.sha256)?.slice(0,12) || '—'),KEYS_NOTICE:escapeHTML(notice), }; return template.replace(/@@([A-Z_]+)@@/g, (_, token) => { if (!Object.hasOwn(replacements, token)) throw Error(`Unresolved page template token: ${token}`); diff --git a/conf-sshd.sh b/conf-sshd.sh index f62bd50..b06ae79 100755 --- a/conf-sshd.sh +++ b/conf-sshd.sh @@ -1,8 +1,14 @@ #!/bin/sh # conf-sshd-script-v2 +# conf-sshd-client-security-v1 # Generated configuration. Never source or eval downloaded data. BASE_URL='@@BASE_URL@@' DEFAULT_CRON='@@DEFAULT_CRON@@' +DEFAULT_GPG_VERIFY='@@DEFAULT_GPG_VERIFY@@' +DEFAULT_GPG_FINGERPRINT='@@DEFAULT_GPG_FINGERPRINT@@' +DEFAULT_GPG_PIN_MODE='@@DEFAULT_GPG_PIN_MODE@@' +DEFAULT_LIST_ID='@@DEFAULT_LIST_ID@@' +DEFAULT_GPG_EMAIL='@@DEFAULT_GPG_EMAIL@@' set -eu umask 077 @@ -22,6 +28,23 @@ temps= lock_owned=no created_state=no created_ssh=no +gpg_home= +download_script=no +requested_verification= +config_prepared=no +validation_only=no +enforce_freshness=yes +replace_pending=no +public_key_file= +requested_fingerprint= +requested_pin_mode= +requested_list_id= +requested_min_sequence= +fallback_urls_file= +primary_url= +requested_email= +requested_keyservers= +trust_options=no say() { printf '%s\n' "$*"; } fail() { printf 'conf-sshd: %s\n' "$*" >&2; exit 1; } @@ -32,7 +55,25 @@ Usage: sh conf-sshd.sh [options] -c, --cron ["five fields"|false] Sync and schedule; bare -c keeps an existing schedule, otherwise the configured default. -c false only removes this script's schedule. - -u, --update-self Explicitly update the installed script only + --install Install/reinstall this trusted local file; + retain local trust, URLs and existing schedule. + --download-script With --install: HTTPS bootstrap/reinstall from + Worker (explicit invocation only; never cron). + --gpg-verification on|off Explicitly enroll/change persisted verification; + default from repository, existing config wins + --gpg-required, --gpg-off Aliases for --gpg-verification on/off + --gpg-fingerprint FULL40HEX Independently verified full fingerprint + --gpg-pin-mode primary|subkey Primary (default) trusts its valid signing + subkeys; subkey permits only that exact subkey + --public-key-file FILE Explicit independently verified local certificate; + supersedes cached/discovered certificate + --list-id ID Required signed-list identity + --min-sequence N Enrollment floor, default 1; never lowers state + --gpg-email EMAIL Optional WKD identity during explicit install + --keyserver HKPS_URL Override built-in ordered keyservers (repeat) + --primary-url HTTPS_URL Local first key endpoint; defaults to Worker + --fallback-urls-file FILE Ordered one-HTTPS-endpoint-per-line fallbacks + -u, --update-self Refused: reinstall explicitly with --install --uninstall Remove own schedule/script; preserve keys/config -p, --allow-root-passwd yes|no Explicit root-only sshd_config edit; never reload -n, --no-install-sshd Compatibility flag; packages are never installed @@ -41,6 +82,29 @@ Usage: sh conf-sshd.sh [options] -h, --help Show this help -u, --uninstall, -p and --status are exclusive operations. -o cannot use -c or -p. +Trust/URL changes require explicit installation, or keys-only -o enrollment. +--install -c also schedules; --install always validates and syncs keys. +Running an installer from Worker explicitly trusts that bootstrap code. For higher +assurance, verify a downloaded file against an independently obtained SHA-256. +No installed script updates itself: cron runs only -o. Ordinary initial -c may +bootstrap from Worker over HTTPS; --install --download-script explicitly repeats +that bootstrap. HTTPS bootstrap trusts Worker and the transport at install time. +During enrollment, approve the full fingerprint and scope in your terminal. +No noninteractive trust-confirmation bypass is supported. Certificate discovery: +local public keyring, Worker /public-key.gpg, optional email WKD, then ordered +HKPS keyservers. Each candidate must match the complete primary/subkey pin. +Keyserver/WKD operators may learn the queried fingerprint/email and your IP. +A dedicated public-only certificate is saved locally; normal sync uses only it, +with no keyserver, WKD or certificate refresh. Reinstall reuses a valid local +certificate; --public-key-file explicitly supplies a verified replacement. +Built-in keyservers: hkps://keys.openpgp.org, hkps://keyserver.ubuntu.com. +A distributor can replay an old matching certificate that omits a revocation; +fingerprint pinning does not prove certificate freshness. +Strict mode needs GnuPG and a correct clock. A missing rollback-state file fails +closed. With --min-sequence omitted, initial enrollment cannot detect a previously +published, still-unexpired release being replayed; obtain a current floor out of band. +Expired/invalid responses retain last installed keys; expiry is not automatic revocation. +Local state uses atomic renames and a pending journal, not a power-loss fsync guarantee. Requires curl, ssh-keygen, awk, standard POSIX tools, mktemp, stat, and one of sha256sum, shasum or openssl. Scheduling also requires crontab. Downloads require HTTPS; existing keys survive any validation/download failure. @@ -61,6 +125,30 @@ while [ "$#" -gt 0 ]; do usage; exit 0 ;; -o|--only-update-keys) select_mode keys ;; -u|--update-self) select_mode update ;; + --install) select_mode install ;; + --download-script) [ "$download_script" = no ] || fail 'Duplicate --download-script.'; download_script=yes ;; + --gpg-required|--gpg-off) + [ -z "$requested_verification" ] || fail 'Duplicate GPG verification option.' + if [ "$1" = --gpg-required ]; then requested_verification=on; else requested_verification=off; fi + trust_options=yes ;; + --gpg-verification|--public-key-file|--fingerprint|--gpg-fingerprint|--gpg-pin-mode|--gpg-email|--keyserver|--list-id|--min-sequence|--fallback-urls-file|--primary-url) + option=$1 + [ "$#" -ge 2 ] && [ -n "$2" ] || fail "$option requires a value." + shift + case $option in + --gpg-verification) [ -z "$requested_verification" ] || fail "Duplicate $option."; requested_verification=$1 ;; + --public-key-file) [ -z "$public_key_file" ] || fail "Duplicate $option."; public_key_file=$1 ;; + --fingerprint|--gpg-fingerprint) [ -z "$requested_fingerprint" ] || fail "Duplicate $option."; requested_fingerprint=$1 ;; + --gpg-pin-mode) [ -z "$requested_pin_mode" ] || fail "Duplicate $option."; requested_pin_mode=$1 ;; + --list-id) [ -z "$requested_list_id" ] || fail "Duplicate $option."; requested_list_id=$1 ;; + --min-sequence) [ -z "$requested_min_sequence" ] || fail "Duplicate $option."; requested_min_sequence=$1 ;; + --fallback-urls-file) [ -z "$fallback_urls_file" ] || fail "Duplicate $option."; fallback_urls_file=$1 ;; + --primary-url) [ -z "$primary_url" ] || fail "Duplicate $option."; primary_url=$1 ;; + --gpg-email) [ -z "$requested_email" ] || fail "Duplicate $option."; requested_email=$1 ;; + --keyserver) requested_keyservers="$requested_keyservers$1 +" ;; + esac + trust_options=yes ;; --uninstall) select_mode uninstall ;; --status) select_mode status ;; -p|--allow-root-passwd) @@ -79,7 +167,11 @@ while [ "$#" -gt 0 ]; do esac shift done -[ "$cron_requested" = no ] || [ "$mode" = sync ] || fail '-c cannot be combined with this operation.' +[ "$cron_requested" = no ] || [ "$mode" = sync ] || [ "$mode" = install ] || fail '-c cannot be combined with this operation.' +[ "$trust_options" = no ] || [ "$mode" = install ] || [ "$mode" = keys ] || [ "$mode" = sync ] || fail 'Trust and URL settings require explicit installation or keys-only enrollment.' +case $requested_verification in ''|on|off) : ;; *) fail '--gpg-verification requires on or off.' ;; esac +[ "$download_script" = no ] || [ "$mode" = install ] || fail '--download-script requires --install.' +[ "$mode" != update ] || fail 'Remote self-update is disabled. Download and independently verify a local script, then run sh ./conf-sshd.sh --install. Explicit HTTPS bootstrap may use --install --download-script.' need() { command -v "$1" >/dev/null 2>&1 || fail "Missing dependency: $1. Install it explicitly before continuing."; } for dep in awk cat chmod cmp cp dd grep id mkdir mktemp mv od rm rmdir sed stat tail tr wc; do need "$dep"; done @@ -94,6 +186,10 @@ state=$HOME/.conf-sshd ssh_dir=$HOME/.ssh auth_file=$ssh_dir/authorized_keys target_script=$state/conf-sshd.sh +local_config=$state/local.conf +replay_state=$state/replay.state +pending_bundle=$state/pending.bundle +pending_state=$state/pending.state # GNU/Linux and BSD/macOS stat. No filesystem changes precede ownership checks. if stat -c '%u %a %h' "$HOME" >/dev/null 2>&1; then @@ -124,6 +220,10 @@ check_path "$state" dir check_path "$ssh_dir" dir check_path "$auth_file" file check_path "$target_script" file +check_path "$local_config" file +check_path "$replay_state" file +check_path "$pending_bundle" file +check_path "$pending_state" file validate_cron() { printf '%s\n' "$1" | awk ' @@ -151,12 +251,16 @@ if [ "$cron_requested" = yes ] && [ -n "$cron_value" ] && [ "$cron_value" != fal fi cleanup() { - result=$? + result=${1:-$?} trap - 0 HUP INT TERM old_ifs=$IFS; IFS=' ' for path in $temps; do rm -f "$path"; done IFS=$old_ifs + if [ -n "$gpg_home" ]; then + if command -v gpgconf >/dev/null 2>&1; then gpgconf --homedir "$gpg_home" --kill all >/dev/null 2>&1 || :; fi + rm -rf "$gpg_home" + fi if [ "$lock_owned" = yes ]; then rm -f "$state/lock/pid"; rmdir "$state/lock" 2>/dev/null || :; fi if [ "$dry_run" = yes ] || [ "$mode" = uninstall ]; then if [ "$created_ssh" = yes ]; then rmdir "$ssh_dir" 2>/dev/null || :; fi @@ -206,14 +310,22 @@ fi validate_build() { printf '%s\n' "$BASE_URL" | grep -Eq '^https://([A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?|\[[0-9A-Fa-f:]+\])(:[0-9]{1,5})?$' || fail 'BASE_URL must be a configured HTTPS origin.' validate_cron "$DEFAULT_CRON" >/dev/null || fail 'Invalid or unbuilt default cron configuration.' + case $DEFAULT_GPG_VERIFY in on|off) : ;; *) fail 'Invalid or unbuilt default GPG verification mode.' ;; esac + case $DEFAULT_GPG_PIN_MODE in primary|subkey) : ;; *) fail 'Invalid or unbuilt default pin mode.' ;; esac + if [ "$DEFAULT_GPG_VERIFY" = on ]; then + printf '%s\n' "$DEFAULT_GPG_FINGERPRINT" | grep -Eq '^[0-9A-Fa-f]{40}$' || fail 'Invalid default GPG fingerprint.' + printf '%s\n' "$DEFAULT_LIST_ID" | grep -Eq '^[A-Za-z0-9._-]{1,64}$' || fail 'Invalid default signed list ID.' + fi } download() { need curl - # No redirects: a configured origin must serve these endpoints directly. - curl --fail --silent --show-error --proto '=https' --tlsv1.2 \ - --connect-timeout 10 --max-time 30 --retry 2 --retry-delay 1 \ - --retry-max-time 65 --max-filesize 1048576 --output "$2" "$1" || fail "Download failed: $1 (existing files unchanged)." - [ "$(wc -c < "$2" | tr -d ' ')" -le 1048576 ] || fail 'Downloaded response is too large.' + download_limit=${3:-1048576} + # No redirects. Partial/error bodies are never parsed as a successful source. + http_status=$(curl --disable --fail --silent --show-error --proto '=https' --tlsv1.2 \ + --connect-timeout 10 --max-time 30 --retry 0 \ + --max-filesize "$download_limit" --output "$2" --write-out '%{http_code}' "$1") || return 1 + [ "$http_status" = 200 ] || return 1 + [ "$(wc -c < "$2" | tr -d ' ')" -le "$download_limit" ] } sha256() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}' @@ -249,20 +361,30 @@ replace_file() { mv -f "$staged" "$destination" } validate_script() { - sh -n "$1" || fail 'Downloaded script has invalid shell syntax.' - [ "$(grep -Fxc '# conf-sshd-script-v2' "$1" || :)" = 1 ] || fail 'Downloaded script is missing its unique version marker.' - [ "$(grep -Fxc "BASE_URL='$BASE_URL'" "$1" || :)" = 1 ] || fail 'Downloaded script changed its configured origin.' - [ "$(grep -Fxc "DEFAULT_CRON='$DEFAULT_CRON'" "$1" || :)" = 1 ] || fail 'Downloaded script has invalid default cron configuration.' - if grep -Eq '@@[A-Z_]+@@' "$1"; then fail 'Downloaded script contains unexpanded build tokens.'; fi + sh -n "$1" || fail 'Installer script has invalid shell syntax.' + [ "$(grep -Fxc '# conf-sshd-script-v2' "$1" || :)" = 1 ] || fail 'Installer script is missing its unique version marker.' + [ "$(grep -Fxc '# conf-sshd-client-security-v1' "$1" || :)" = 1 ] || fail 'Installer script lacks the fixed-client security version marker.' + [ "$(grep -Fxc "BASE_URL='$BASE_URL'" "$1" || :)" = 1 ] || fail 'Installer script changed its configured origin.' + [ "$(grep -Fxc "DEFAULT_CRON='$DEFAULT_CRON'" "$1" || :)" = 1 ] || fail 'Installer script has invalid default cron configuration.' + if grep -Eq '@@[A-Z_]+@@' "$1"; then fail 'Installer script contains unexpanded build tokens.'; fi } -install_script() { +prepare_script() { validate_build new_temp "$state"; script_tmp=$TEMP - # In a piped invocation $0 can name an unrelated cwd file. Always fetch the - # configured origin, rather than guessing whether $0 is this script. - download "$BASE_URL/script.sh" "$script_tmp" + if [ "$download_script" = yes ] || [ "$mode" != install ]; then + download "$BASE_URL/script.sh" "$script_tmp" || fail 'Installer download failed; existing script is unchanged.' + else + case $0 in /*|./*|../*) : ;; *) fail '--install requires an unambiguous local file path (sh ./conf-sshd.sh), or ordinary --download-script.' ;; esac + case $0 in /dev/*|/proc/*|/sys/*) fail '--install cannot use stdin, a pipe, or a device file.' ;; esac + check_path "$0" file + [ -f "$0" ] || fail '--install requires a real local script file.' + cp "$0" "$script_tmp" + fi validate_script "$script_tmp" +} +install_script() { replace_file "$target_script" "$script_tmp" 700 + say 'Installed local script. Scheduled runs update keys only.' } # Rewrite only an exact paired managed block or the exact known legacy command. @@ -327,11 +449,7 @@ apply_cron() { say "Managed cron set: $1" } -sync_keys() { - need ssh-keygen - validate_build - new_temp "$state"; response=$TEMP - download "$BASE_URL/ssh.keys" "$response" +validate_legacy_response() { last_lf "$response" || fail 'Key response must end with LF.' new_temp "$state"; invalid_bytes=$TEMP tr -d '\012\040-\176\200-\377' < "$response" > "$invalid_bytes" @@ -354,8 +472,12 @@ sync_keys() { [ "$(sha256 "$payload")" = "$expected_hash" ] || fail 'Payload SHA-256 mismatch.' [ "$(wc -l < "$payload" | tr -d ' ')" = "$key_count" ] || fail 'Payload key count mismatch.' if [ "$key_count" = 0 ]; then [ "$allow_empty" = yes ] || fail 'Empty key set was not explicitly allowed.'; fi - awk ' + validate_payload +} +validate_payload() { + awk -v strict="$policy" ' { + if(strict=="required" && NF!=2) exit 1 if($0 ~ /[ \t]$/ || $0 !~ /^[^ ]+ [^ ]+( [^ ].*)?$/ || NF<2) exit 1 if($1!="ssh-ed25519" && $1!="ssh-rsa" && $1!="ecdsa-sha2-nistp256" && $1!="ecdsa-sha2-nistp384" && $1!="ecdsa-sha2-nistp521" && $1!="sk-ssh-ed25519@openssh.com" && $1!="sk-ecdsa-sha2-nistp256@openssh.com") exit 1 if($2 !~ /^[A-Za-z0-9+\/]+={0,2}$/) { @@ -377,6 +499,8 @@ sync_keys() { [ "$bits" -ge 2048 ] || fail 'RSA keys must be at least 2048 bits.' ;; esac done < "$payload" +} +apply_payload() { [ -d "$ssh_dir" ] || { mkdir "$ssh_dir"; created_ssh=yes; } # Existing secure directory permissions need not be changed in dry-run mode. if [ "$dry_run" = no ]; then chmod 700 "$ssh_dir"; fi @@ -478,30 +602,604 @@ edit_sshd_config() { [ "$root_password" != yes ] || say 'PermitRootLogin yes does not enable PasswordAuthentication if it is disabled elsewhere.' } +# All persistent policy/state is a data format with a strict parser, never shell code. +validate_url() { + [ "${#1}" -le 2048 ] || return 1 + printf '%s\n' "$1" | grep -Eq '^https://([A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?|\[[0-9A-Fa-f:]+\])(:[0-9]{1,5})?(/[!-~]*)?$' || return 1 + case $1 in *'?'*|*'#'*|*'\'*) return 1 ;; esac +} +strict_text() { + last_lf "$1" || fail 'Local data must end with LF.' + new_temp "$state"; invalid_local=$TEMP + tr -d '\012\040-\176' < "$1" > "$invalid_local" + [ ! -s "$invalid_local" ] || fail 'Local data contains non-ASCII or control bytes.' +} +validate_urls() { + [ -s "$1" ] || fail 'At least one source URL is required.' + [ "$(wc -l < "$1" | tr -d ' ')" -le 6 ] || fail 'At most six source URLs (primary plus five fallbacks) are allowed.' + while IFS= read -r source_url; do + validate_url "$source_url" || fail 'Invalid HTTPS source URL; query strings, fragments and credentials are unsupported.' + done < "$1" + awk 'seen[$0]++ {exit 1}' "$1" || fail 'Duplicate source URL.' +} +load_local_config() { + policy=off + list_id=- + pinned_fingerprint=- + pin_mode=primary + gpg_email=- + keyservers="hkps://keys.openpgp.org +hkps://keyserver.ubuntu.com" + config_snapshot=absent + new_temp "$state"; urls=$TEMP + printf '%s/ssh.keys\n' "$BASE_URL" > "$urls" + if [ -f "$local_config" ]; then + new_temp "$state"; config_snapshot=$TEMP + cp "$local_config" "$config_snapshot" + [ "$(wc -c < "$config_snapshot" | tr -d ' ')" -le 40000 ] || fail 'Local configuration is too large.' + strict_text "$config_snapshot" + awk ' + NR==1 { if($0!="conf-sshd-local-v1") exit 1 } + NR==2 { if($0!="policy off" && $0!="policy required") exit 1; p=$2 } + NR==3 { if($0!="list-id " $2 || $2 ~ /[^A-Za-z0-9._-]/ || length($2)<1 || length($2)>64) exit 1; l=$2 } + NR==4 { if($0!="fingerprint " $2) exit 1; f=$2 + if(p=="required" && (length(f)!=40 || f ~ /[^0-9A-F]/ || l=="-")) exit 1 + if(p=="off" && !((f=="-" && l=="-") || (length(f)==40 && f !~ /[^0-9A-F]/ && l!="-"))) exit 1 } + NR==5 {if($0!="pin-mode primary" && $0!="pin-mode subkey") exit 1; if(f=="-" && $2!="primary") exit 1} + NR==6 { if($0!="email " $2 || $2=="") exit 1 } + NR>6 { if(substr($0,1,4)=="url ") {u++; if(k) exit 1} else if(substr($0,1,10)=="keyserver ") k++; else exit 1 } + END { if(NR<8 || NR>16 || u<1 || u>6 || k<1 || k>4) exit 1 } + ' "$config_snapshot" || fail 'Malformed local configuration; refusing to guess or downgrade.' + policy=$(sed -n '2s/^policy //p' "$config_snapshot") + list_id=$(sed -n '3s/^list-id //p' "$config_snapshot") + pinned_fingerprint=$(sed -n '4s/^fingerprint //p' "$config_snapshot") + pin_mode=$(sed -n '5s/^pin-mode //p' "$config_snapshot") + gpg_email=$(sed -n '6s/^email //p' "$config_snapshot") + keyservers=$(sed -n '7,$s/^keyserver //p' "$config_snapshot") + sed -n '7,$s/^url //p' "$config_snapshot" > "$urls" + elif [ -e "$replay_state" ] || [ -e "$pending_state" ] || [ -e "$pending_bundle" ]; then + fail 'Local policy is missing while security state exists; refusing an implicit downgrade.' + fi + validate_urls "$urls" + validate_discovery_settings + if [ "$policy" = required ] && [ "$mode" != uninstall ] && [ "$mode" != config ] && [ "$cron_value" != false ] && [ "$requested_verification" != off ]; then + trust_key=$state/trust-$pinned_fingerprint-$pin_mode.asc + check_path "$trust_key" file + [ -f "$trust_key" ] || [ "$mode" = install ] || [ "$trust_options" = yes ] || fail 'Dedicated pinned certificate is missing; reinstall explicitly to recover it.' + [ -f "$replay_state" ] || fail 'Rollback state is missing after enrollment; refusing silent bootstrap.' + fi +} +new_gpg_home() { + need gpg + if [ -z "$gpg_home" ]; then + gpg_home=$(mktemp -d "$state/.conf-sshd-gpg.XXXXXX") || fail 'Cannot create isolated GnuPG directory.' + chmod 700 "$gpg_home" + fi +} +gpg_local() { + gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart \ + --no-auto-key-retrieve --auto-key-locate clear --no-default-keyring \ + --keyring "$gpg_home/pinned.gpg" "$@" +} +import_pinned_key() { + new_gpg_home + [ "$(wc -c < "$1" | tr -d ' ')" -le 1048576 ] || fail 'Public key file exceeds 1 MiB.' + new_temp "$state"; key_description=$TEMP + gpg_local --with-colons --show-keys "$1" > "$key_description" 2>/dev/null || fail 'Cannot inspect local OpenPGP public key.' + current_time=$(date +%s) + temps="$temps +$key_description.primary" + awk -F: -v pin="$pinned_fingerprint" -v mode="$pin_mode" -v now="$current_time" ' + $1=="sec" || $1=="ssb" { bad=1 } + $1=="pub" || $1=="sub" { + kind=$1; valid=($2 !~ /[redi]/ && ($7=="" || $7+0>now)); signing=($12 ~ /[sS]/) + if(kind=="pub" && (++p!=1 || !valid)) bad=1 + want=1; next + } + $1=="fpr" && want { + if(kind=="pub") primary=$10 + if($10==pin && ((mode=="primary" && kind=="pub") || (mode=="subkey" && kind=="sub"))) {matched++; if(!valid || !signing) bad=1} + want=0 + } + END {if(bad || p!=1 || matched!=1 || length(primary)!=40 || primary ~ /[^0-9A-F]/) exit 1; print primary} + ' "$key_description" > "$key_description.primary" || fail 'Certificate must contain exactly one current primary and the expected current primary/subkey fingerprint, with no secret keys.' + certificate_primary=$(cat "$key_description.primary") + gpg_local --yes --dearmor --output "$gpg_home/pinned.gpg" "$1" >/dev/null 2>&1 || fail 'Cannot prepare isolated public-only certificate keyring.' +} +validate_discovery_settings() { + if [ "$gpg_email" != - ]; then + [ "${#gpg_email}" -le 254 ] && printf '%s\n' "$gpg_email" | grep -Eq '^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}$' || fail 'Invalid WKD email address.' + fi + new_temp "$state"; server_list=$TEMP + printf '%s\n' "$keyservers" > "$server_list" + [ "$(wc -l < "$server_list" | tr -d ' ')" -le 4 ] || fail 'At most four keyservers are permitted.' + while IFS= read -r server; do + printf '%s\n' "$server" | grep -Eq '^hkps://[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?(:[0-9]{1,5})?$' || fail 'Keyservers must be explicit HKPS origins.' + done < "$server_list" +} +reset_gpg_home() { + if [ -n "$gpg_home" ]; then + # Kill only services belonging to our private transient home, if any. + if command -v gpgconf >/dev/null 2>&1; then gpgconf --homedir "$gpg_home" --kill all >/dev/null 2>&1 || :; fi + rm -rf "$gpg_home" + gpg_home= + fi + new_gpg_home +} +accept_certificate_candidate() { + # A separate clean keyring per discovery candidate prevents unrelated keys + # or a rejected certificate from contaminating the final verifier. + reset_gpg_home + new_temp "$state"; candidate_export=$TEMP + if ( lock_owned=no; created_state=no; created_ssh=no; temps=; + trap 'candidate_result=$?; gpg_home=; cleanup "$candidate_result"' 0 + import_pinned_key "$1" + gpg_local --armor --export "$certificate_primary" > "$candidate_export" || fail 'Candidate certificate cannot be exported by this GnuPG version.' + [ -s "$candidate_export" ] && [ "$(wc -c < "$candidate_export" | tr -d ' ')" -le 1048576 ] || fail 'Candidate public certificate export is empty or oversized.' ); then + import_pinned_key "$candidate_export" + staged_trust=$candidate_export + trust_key=$state/trust-$pinned_fingerprint-$pin_mode.asc + check_path "$trust_key" file + return 0 + fi + return 1 +} +lookup_bounded() { + now=$(date +%s) + remaining=$((discovery_deadline - now)) + [ "$remaining" -gt 0 ] || return 1 + if [ "$remaining" -gt 15 ]; then remaining=15; fi + if command -v timeout >/dev/null 2>&1; then timeout -k 2 "$remaining" "$@" + elif command -v gtimeout >/dev/null 2>&1; then gtimeout -k 2 "$remaining" "$@" + else say 'Skipping WKD/keyserver lookup: a timeout or gtimeout utility is required.' >&2; return 1; fi +} +discover_certificate() { + discovery_deadline=$(($(date +%s) + 120)) + new_temp "$state"; candidate=$TEMP + if [ -n "$public_key_file" ]; then + check_path "$public_key_file" file + [ -f "$public_key_file" ] || fail 'Local public key file does not exist.' + accept_certificate_candidate "$public_key_file" || fail 'Explicit certificate failed validation; refusing to fall back to a possibly stale certificate.' + return + fi + existing_trust=$state/trust-$pinned_fingerprint-$pin_mode.asc + check_path "$existing_trust" file + if [ -f "$existing_trust" ]; then + accept_certificate_candidate "$existing_trust" || fail 'Existing dedicated certificate is expired, revoked or invalid; supply an independently verified replacement explicitly.' + return + fi + ambient_home=${GNUPGHOME:-$HOME/.gnupg} + if [ -d "$ambient_home" ]; then + # Read/export only: no import, trust edits or remote lookup in this home. + if gpg --batch --no-options --homedir "$ambient_home" --no-tty --no-autostart \ + --no-auto-key-retrieve --auto-key-locate clear --no-auto-check-trustdb \ + --lock-never --export "$pinned_fingerprint" > "$candidate" 2>/dev/null && [ -s "$candidate" ]; then + if accept_certificate_candidate "$candidate"; then return; fi + fi + fi + if download "$BASE_URL/public-key.gpg" "$candidate" 1048576; then + if accept_certificate_candidate "$candidate"; then return; fi + fi + if [ "$gpg_email" != - ]; then + reset_gpg_home + if lookup_bounded gpg --batch --no-options --homedir "$gpg_home" --no-tty \ + --no-auto-key-retrieve --auto-key-locate clear,wkd --locate-external-keys -- "$gpg_email" >/dev/null 2>&1; then + gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear --armor --export > "$candidate" 2>/dev/null || : + if accept_certificate_candidate "$candidate"; then return; fi + fi + fi + while IFS= read -r server; do + reset_gpg_home + if lookup_bounded gpg --batch --no-options --homedir "$gpg_home" --no-tty \ + --no-auto-key-retrieve --auto-key-locate clear --keyserver "$server" \ + --recv-keys "$pinned_fingerprint" >/dev/null 2>&1; then + gpg --batch --no-options --homedir "$gpg_home" --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear --armor --export > "$candidate" 2>/dev/null || : + if accept_certificate_candidate "$candidate"; then return; fi + fi + done < "$server_list" + fail 'No local, Worker, WKD or configured keyserver certificate matched the complete trusted pin; nothing installed.' +} +read_replay_state() { + strict_text "$1" + [ "$(wc -c < "$1" | tr -d ' ')" -le 256 ] || fail 'Rollback state is oversized.' + awk -v list="$list_id" ' + NR==1 { if($0!="conf-sshd-state-v1") exit 1 } + NR==2 { if($0!="list-id " list) exit 1 } + NR==3 { if($0!="sequence " $2 || $2 !~ /^(0|[1-9][0-9]*)$/ || length($2)>10 || $2+0>2147483647) exit 1 } + NR==4 { if($0!="sha256 " $2 || ($2!="-" && (length($2)!=64 || $2 ~ /[^0-9a-f]/))) exit 1 } + END { if(NR!=4) exit 1 } + ' "$1" || fail 'Malformed rollback state; refusing silent bootstrap.' + recorded_sequence=$(sed -n '3s/^sequence //p' "$1") + recorded_digest=$(sed -n '4s/^sha256 //p' "$1") +} +write_replay_record() { + printf 'conf-sshd-state-v1\nlist-id %s\nsequence %s\nsha256 %s\n' "$list_id" "$1" "$2" > "$3" +} +confirm_policy_change() { + say "Signature policy change: $1; fingerprint $2; pin mode $3; list $4." >&2 + if [ "$3" = primary ]; then say 'Primary pin trusts valid, bound signing subkeys of that primary.' >&2 + else say 'Subkey pin trusts only that exact signing subkey, not its siblings.' >&2; fi + say 'If local/Worker discovery fails, optional WKD and configured keyservers may receive the email/fingerprint and your IP.' >&2 + if [ "$dry_run" = yes ]; then fail 'Trust-changing dry runs do not enroll, query certificates or prompt; rerun locally without --dry-run to review and consent.'; fi + if ! ( : < /dev/tty ) 2>/dev/null; then fail 'Trust changes require confirmation in a local terminal (/dev/tty); no noninteractive bypass exists.'; fi + printf 'To confirm %s, type the complete fingerprint %s: ' "$1" "$2" > /dev/tty + IFS= read -r confirmation < /dev/tty || fail 'Trust confirmation was not received.' + [ "$confirmation" = "$2" ] || fail 'Trust change was not confirmed.' +} +require_explicit_installer() { + if [ "$mode" != install ] && [ -f "$target_script" ]; then + [ "$(grep -Fxc '# conf-sshd-client-security-v1' "$target_script" || :)" = 1 ] || fail 'Existing scheduled script predates signature enforcement; use --install to upgrade it before changing trust.' + fi + # --install or explicit trust options are a user-triggered installation; + # scheduled -o without options never enters this policy-change flow. + say 'Installer bootstrap code is trusted by this invocation. Independently checking a local script hash is recommended.' >&2 +} +prepare_install_config() { + config_prepared=yes + staged_replay= + replay_snapshot=absent + staged_trust= + old_policy=$policy + old_pin=$pinned_fingerprint + old_pin_mode=$pin_mode + old_list=$list_id + if [ "$config_snapshot" = absent ]; then + requested_verification=${requested_verification:-$DEFAULT_GPG_VERIFY} + requested_fingerprint=${requested_fingerprint:-$DEFAULT_GPG_FINGERPRINT} + requested_pin_mode=${requested_pin_mode:-$DEFAULT_GPG_PIN_MODE} + requested_list_id=${requested_list_id:-$DEFAULT_LIST_ID} + requested_email=${requested_email:-$DEFAULT_GPG_EMAIL} + fi + if [ -n "$requested_email" ]; then gpg_email=$requested_email; fi + if [ -n "$requested_keyservers" ]; then keyservers=$(printf '%s' "$requested_keyservers"); fi + validate_discovery_settings + if [ "$requested_verification" = off ]; then + if [ "$old_policy" = required ]; then + require_explicit_installer + confirm_policy_change disable "$old_pin" "$old_pin_mode" "$old_list" + fi + policy=off + # Preserve the enrolled pin and rollback state for any future re-enable. + if [ "$old_pin" = - ]; then pinned_fingerprint=-; list_id=-; pin_mode=primary; fi + elif [ "$requested_verification" = on ] || [ -n "$public_key_file$requested_fingerprint$requested_list_id$requested_min_sequence$requested_pin_mode" ]; then + require_explicit_installer + if [ "$old_pin" != - ]; then + requested_fingerprint=${requested_fingerprint:-$old_pin} + requested_list_id=${requested_list_id:-$old_list} + fi + [ -n "$requested_fingerprint" ] && [ -n "$requested_list_id" ] || fail 'Enabling verification requires --gpg-fingerprint and --list-id (or configured defaults).' + requested_pin_mode=${requested_pin_mode:-$pin_mode} + case $requested_pin_mode in primary|subkey) : ;; *) fail '--gpg-pin-mode must be primary or subkey.' ;; esac + requested_fingerprint=$(printf '%s' "$requested_fingerprint" | tr 'a-f' 'A-F') + printf '%s\n' "$requested_fingerprint" | grep -Eq '^[0-9A-F]{40}$' || fail 'Expected a full 40-hex fingerprint.' + printf '%s\n' "$requested_list_id" | grep -Eq '^[A-Za-z0-9._-]{1,64}$' || fail 'Invalid signed list ID.' + [ "$requested_list_id" != - ] || fail 'List ID cannot be a dash.' + if [ "$old_pin" != - ]; then + [ "$requested_list_id" = "$old_list" ] || fail 'Reinstall cannot reset the enrolled list identity or rollback history.' + [ -f "$replay_state" ] || fail 'Rollback state is missing after enrollment; refusing silent bootstrap.' + fi + confirm_policy_change enable/change "$requested_fingerprint" "$requested_pin_mode" "$requested_list_id" + policy=required + list_id=$requested_list_id + pinned_fingerprint=$requested_fingerprint + pin_mode=$requested_pin_mode + need date + discover_certificate + if [ "$old_pin" != - ] && [ -n "$requested_min_sequence" ]; then + floor=$requested_min_sequence + printf '%s\n' "$floor" | grep -Eq '^[1-9][0-9]{0,9}$' && [ "$floor" -le 2147483647 ] || fail 'Minimum sequence must be 1..2147483647.' + new_temp "$state"; replay_snapshot=$TEMP + cp "$replay_state" "$replay_snapshot" + read_replay_state "$replay_snapshot" + [ "$floor" -ge "$recorded_sequence" ] || fail 'Explicit minimum sequence cannot lower the persisted rollback boundary.' + new_temp "$state"; staged_replay=$TEMP + if [ "$floor" -gt "$recorded_sequence" ]; then write_replay_record "$((floor - 1))" - "$staged_replay" + else cp "$replay_snapshot" "$staged_replay"; fi + fi + if [ "$old_pin" = - ]; then + [ ! -e "$replay_state" ] && [ ! -e "$pending_state" ] && [ ! -e "$pending_bundle" ] || fail 'Existing security state requires manual recovery; cannot silently enroll over it.' + floor=${requested_min_sequence:-1} + printf '%s\n' "$floor" | grep -Eq '^[1-9][0-9]{0,9}$' && [ "$floor" -le 2147483647 ] || fail 'Minimum sequence must be 1..2147483647.' + new_temp "$state"; staged_replay=$TEMP + write_replay_record "$((floor - 1))" - "$staged_replay" + fi + fi + if [ "$policy" = required ] && [ -z "$staged_trust" ]; then + require_explicit_installer + confirm_policy_change reinstall/refresh "$pinned_fingerprint" "$pin_mode" "$list_id" + discover_certificate + fi + if [ -n "$primary_url" ] || [ -n "$fallback_urls_file" ]; then + new_temp "$state"; new_urls=$TEMP + if [ -n "$primary_url" ]; then printf '%s\n' "$primary_url" > "$new_urls" + else sed -n '1p' "$urls" > "$new_urls"; fi + if [ -n "$fallback_urls_file" ]; then + check_path "$fallback_urls_file" file + [ -f "$fallback_urls_file" ] || fail 'Fallback URL file does not exist.' + [ "$(wc -c < "$fallback_urls_file" | tr -d ' ')" -le 35000 ] || fail 'Fallback URL file is too large.' + if [ -s "$fallback_urls_file" ]; then strict_text "$fallback_urls_file"; fi + cat "$fallback_urls_file" >> "$new_urls" + elif [ -n "$primary_url" ]; then sed -n '2,$p' "$urls" >> "$new_urls"; fi + urls=$new_urls + validate_urls "$urls" + fi + new_temp "$state"; staged_config=$TEMP + printf 'conf-sshd-local-v1\npolicy %s\nlist-id %s\nfingerprint %s\npin-mode %s\nemail %s\n' "$policy" "$list_id" "$pinned_fingerprint" "$pin_mode" "$gpg_email" > "$staged_config" + sed 's/^/url /' "$urls" >> "$staged_config" + sed 's/^/keyserver /' "$server_list" >> "$staged_config" +} +commit_install_config() { + if [ -n "$staged_trust" ]; then replace_file "$trust_key" "$staged_trust" 600; fi + if [ -n "$staged_replay" ]; then replace_file "$replay_state" "$staged_replay" 600 "$replay_snapshot"; fi + replace_file "$local_config" "$staged_config" 600 "$config_snapshot" +} +validate_signed_document() { + last_lf "$response" || fail 'Signed document must end with LF.' + [ "$(wc -c < "$response" | tr -d ' ')" -le 1048576 ] || fail 'Signed document exceeds 1 MiB.' + new_temp "$state"; invalid_bytes=$TEMP + tr -d '\012\040-\176' < "$response" > "$invalid_bytes" + [ ! -s "$invalid_bytes" ] || fail 'Signed document contains noncanonical bytes.' + new_temp "$state"; metadata=$TEMP + awk ' + NR==1 { if($0!="# conf-sshd-signed-v1") exit 1 } + NR==2 { if($0!="# list-id " $3 || $3 ~ /[^A-Za-z0-9._-]/ || length($3)<1 || length($3)>64) exit 1; print $3 } + NR==3 { if($0!="# sequence " $3 || $3 !~ /^[1-9][0-9]*$/ || length($3)>10 || $3+0>2147483647) exit 1; print $3 } + NR==4 || NR==5 { label=(NR==4 ? "issued-at" : "expires-at") + if($0!="# " label " " $3 || $3 !~ /^(0|[1-9][0-9]*)$/ || length($3)>10) exit 1 + if(NR==4) issue=$3+0; else if($3+0<=issue) exit 1; print $3 } + NR==6 { if($0!="# revoke yes" && $0!="# revoke no") exit 1; revoke=$3; print $3 } + NR==7 { if($0!="# key-count " $3 || $3 !~ /^(0|[1-9][0-9]*)$/ || length($3)>4 || $3+0>1000) exit 1 + if(($3==0 && revoke!="yes") || ($3!=0 && revoke!="no")) exit 1; print $3 } + NR==8 { if($0!="# end-metadata") exit 1 } + END { if(NR<8) exit 1 } + ' "$response" > "$metadata" || fail 'Invalid signed-document schema or revocation metadata.' + release_list=$(sed -n '1p' "$metadata") + sequence=$(sed -n '2p' "$metadata") + issued_at=$(sed -n '3p' "$metadata") + expires_at=$(sed -n '4p' "$metadata") + key_count=$(sed -n '6p' "$metadata") + revision=$sequence + new_temp "$state"; payload=$TEMP + tail -n +9 "$response" > "$payload" + [ "$(wc -l < "$payload" | tr -d ' ')" = "$key_count" ] || fail 'Signed payload key count mismatch.' + # Signed documents are canonical even when signature verification is OFF. + awk 'NF!=2 || $0!=$1 " " $2 {exit 1}' "$payload" || fail 'Signed document key lines must be comment-free and canonical.' + if [ "$policy" = required ]; then + [ "$release_list" = "$list_id" ] || fail 'Signed list identity does not match local enrollment.' + now=$(date +%s) + if [ "$enforce_freshness" = yes ]; then + [ "$issued_at" -le "$((now + 300))" ] && [ "$expires_at" -gt "$now" ] || fail 'Signed release is expired or issued too far in the future.' + fi + fi + digest=$(sha256 "$response") + validate_payload +} +verify_signature() { + last_lf "$signature" || fail 'Detached signature must end with LF.' + [ "$(wc -c < "$signature" | tr -d ' ')" -le 65536 ] || fail 'Detached signature exceeds 64 KiB.' + new_temp "$state"; bad_signature=$TEMP + tr -d '\012\040-\176' < "$signature" > "$bad_signature" + [ ! -s "$bad_signature" ] || fail 'Detached signature must be ASCII armor with LF line endings.' + awk ' + NR==1 {if($0!="-----BEGIN PGP SIGNATURE-----") exit 1} + { if(ended) exit 1; if($0=="-----END PGP SIGNATURE-----") ended=1 } + END {if(!ended) exit 1} + ' "$signature" || fail 'Malformed detached-signature armor.' + new_temp "$state"; gpg_status=$TEMP + gpg_local --status-fd 1 --verify "$signature" "$response" > "$gpg_status" 2>/dev/null || fail 'Detached signature verification failed.' + awk -v pin="$pinned_fingerprint" -v mode="$pin_mode" -v expectedprimary="$certificate_primary" -v now="$(date +%s)" ' + $1!="[GNUPG:]" {bad=1} + $2 ~ /^(BADSIG|ERRSIG|NO_PUBKEY|EXPSIG|EXPKEYSIG|REVKEYSIG|KEYEXPIRED|KEYREVOKED|SIGEXPIRED|BADARMOR|FAILURE|ERROR|NODATA|UNEXPECTED)$/ {bad=1} + $2=="VALIDSIG" { good++; primary=$12 + if(NF!=12 || $7!=4 || $11!="00" || length(primary)!=40 || primary ~ /[^0-9A-F]/ || primary!=expectedprimary || (mode=="primary" && primary!=pin) || (mode=="subkey" && $3!=pin) || length($3)!=40 || $3 ~ /[^0-9A-F]/ || ($10!=8 && $10!=9 && $10!=10)) bad=1 + if($5 !~ /^(0|[1-9][0-9]*)$/ || length($5)>10 || $5+0>now+300 || $6 !~ /^(0|[1-9][0-9]*)$/ || length($6)>10 || ($6!=0 && $6+0<=now)) bad=1 } + END {if(bad || good!=1) exit 1} + ' "$gpg_status" || fail 'Signature status lacks one valid, unexpired signature from the locally pinned primary/subkey.' +} +check_replay() { + [ "$sequence" -ge "$recorded_sequence" ] || fail 'Signed sequence rollback rejected.' + if [ "$sequence" = "$recorded_sequence" ]; then + [ "$digest" = "$recorded_digest" ] || fail 'Signed sequence equivocation rejected (same sequence, different bytes).' + fi +} +validate_response() { + if [ "$policy" = required ]; then + verify_signature + validate_signed_document + check_replay + elif [ "$(sed -n '1p' "$response")" = '# conf-sshd-signed-v1' ]; then + validate_signed_document + else validate_legacy_response; fi +} +# Journal pairs are local only; transport is /ssh.keys plus /ssh.keys.sig. +make_pending_bundle() { + cat "$response" > "$1" + printf '# detached-signature\n' >> "$1" + cat "$signature" >> "$1" +} +read_pending_bundle() { + [ "$(wc -c < "$pending_bundle" | tr -d ' ')" -le 1114133 ] || fail 'Pending package is oversized.' + new_temp "$state"; response=$TEMP + new_temp "$state"; signature=$TEMP + # Marker is forbidden by the strict document schema and signature armor. + awk -v sig="$signature" ' + $0=="# detached-signature" {if(found++) exit 1; next} + {if(found) print > sig; else print} + END {if(found!=1) exit 1} + ' "$pending_bundle" > "$response" || fail 'Malformed pending package.' + # Enforce original bytes: awk must not normalize a malformed journal. + new_temp "$state"; rebuilt=$TEMP + make_pending_bundle "$rebuilt" + cmp -s "$rebuilt" "$pending_bundle" || fail 'Noncanonical pending package.' +} +finish_verified_release() { + # Commit a complete verified package before advancing any anti-rollback state + # or replacing keys. Atomic renames survive process interruption, not every + # power-loss/filesystem failure; no portable fsync promise is made here. + if [ "$dry_run" = no ]; then + if [ "$replace_pending" = yes ]; then + # Preserve the authenticated old journal floor before superseding its + # files. A crash at any step can only retain/raise this boundary. + new_temp "$state"; promoted_state=$TEMP + write_replay_record "$recorded_sequence" "$recorded_digest" "$promoted_state" + replace_file "$replay_state" "$promoted_state" 600 + rm -f "$pending_state" "$pending_bundle" + fi + if [ ! -f "$pending_state" ]; then + new_temp "$state"; pending_tmp=$TEMP + make_pending_bundle "$pending_tmp" + replace_file "$pending_bundle" "$pending_tmp" 600 + new_temp "$state"; pending_record=$TEMP + write_replay_record "$sequence" "$digest" "$pending_record" + replace_file "$pending_state" "$pending_record" 600 absent + fi + fi + apply_payload + if [ "$dry_run" = no ]; then + new_temp "$state"; final_state=$TEMP + write_replay_record "$sequence" "$digest" "$final_state" + replace_file "$replay_state" "$final_state" 600 + rm -f "$pending_state" "$pending_bundle" + fi +} +sync_keys() { + need ssh-keygen + validate_build + if [ "$policy" = required ]; then + need date + if [ -n "${staged_replay:-}" ]; then read_replay_state "$staged_replay" + else read_replay_state "$replay_state"; fi + if [ -z "$gpg_home" ]; then import_pinned_key "$trust_key"; fi + if [ -f "$pending_state" ] || [ -f "$pending_bundle" ]; then + saved_sequence=$recorded_sequence + saved_digest=$recorded_digest + pending_sequence= + pending_digest= + if [ -f "$pending_state" ]; then + read_replay_state "$pending_state" + pending_sequence=$recorded_sequence + pending_digest=$recorded_digest + [ "$pending_digest" != - ] || fail 'Pending state must identify an already verified document.' + [ "$pending_sequence" -ge "$saved_sequence" ] || fail 'Pending rollback record is below the committed boundary.' + if [ "$pending_sequence" = "$saved_sequence" ]; then + [ "$pending_digest" = "$saved_digest" ] || fail 'Pending rollback record conflicts with committed history.' + fi + fi + recorded_sequence=$saved_sequence + recorded_digest=$saved_digest + if [ -f "$pending_bundle" ]; then + read_pending_bundle + enforce_freshness=no + validate_signed_document + enforce_freshness=yes + check_replay + if [ -n "$pending_sequence" ]; then + [ "$sequence" = "$pending_sequence" ] && [ "$digest" = "$pending_digest" ] || fail 'Pending package does not match its rollback record.' + elif [ "$sequence" = "$recorded_sequence" ] && [ "$digest" = "$recorded_digest" ]; then + # Crash while removing an old journal after promoting its + # floor: committed state already authenticates these bytes. + pending_sequence=$sequence + pending_digest=$digest + fi + if ( lock_owned=no; created_state=no; created_ssh=no; temps=; + trap 'child_result=$?; gpg_home=; cleanup "$child_result"' 0 + validate_response ); then + if [ "$validation_only" = no ]; then + finish_verified_release + say 'Recovered the same verified pending release; no fallback was fetched.' + fi + return + fi + [ -n "$pending_sequence" ] || fail 'Uncommitted pending package is no longer verifiable; manual recovery is required.' + else + [ -n "$pending_sequence" ] || fail 'Pending package/state is incomplete.' + fi + # The protected committed journal records a previously verified + # release. Its current expiry/revocation never authorizes installing + # it, but its sequence/digest still prevent rollback while fetching + # a fresh valid release under the currently enrolled pin. + recorded_sequence=$pending_sequence + recorded_digest=$pending_digest + replace_pending=yes + say 'Pending release cannot currently be applied; retaining its rollback floor while fetching a fresh valid release.' >&2 + fi + fi + new_temp "$state"; response=$TEMP + new_temp "$state"; signature=$TEMP + accepted=no + # Full validation occurs per source. A failed mirror never permits a policy + # downgrade; candidate-local temporaries are cleaned even when fail() exits. + while IFS= read -r source_url; do + if download "$source_url" "$response" 1048576; then + if [ "$policy" = required ] && ! download "$source_url.sig" "$signature" 65536; then + say "Signature unavailable from $source_url; trying next locally configured source." >&2 + continue + fi + if ( lock_owned=no; created_state=no; created_ssh=no; gpg_home_saved=$gpg_home; gpg_home=; temps=; + # Preserve the caller keyring but never delete it in this subshell. + gpg_home=$gpg_home_saved + trap 'child_result=$?; gpg_home=; cleanup "$child_result"' 0 + validate_response ); then accepted=yes; break; fi + fi + say "Rejected source $source_url; trying next locally configured source." >&2 + done < "$urls" + [ "$accepted" = yes ] || fail 'No locally configured source passed the required policy; existing keys are unchanged.' + validate_response + if [ "$validation_only" = no ]; then + if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi + fi +} + +if [ "$mode" = uninstall ] || [ "$mode" = config ] || { [ "$mode" = sync ] && [ "$cron_requested" = yes ] && [ "$cron_value" = false ]; }; then + policy=off + config_snapshot=absent +else load_local_config; fi case $mode in - update) + install) validate_build - [ -f "$target_script" ] || fail 'No installed script. Install scheduling with -c first.' - new_temp "$state"; updated_script=$TEMP - download "$BASE_URL/script.sh" "$updated_script" - validate_script "$updated_script" - replace_file "$target_script" "$updated_script" 700 - say 'Script update validated. Keys, cron and sshd configuration were not changed.' ;; + prepare_install_config + prepare_script + if [ "$cron_requested" = yes ]; then + prepare_cron + if [ -z "$cron_value" ]; then cron_value=${existing_schedule:-$DEFAULT_CRON}; fi + fi + validation_only=yes + sync_keys + # Activate policy only after replacing any legacy scheduled executable. + install_script + commit_install_config + if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi + if [ "$cron_requested" = yes ]; then apply_cron "$cron_value"; fi ;; uninstall) if command -v crontab >/dev/null 2>&1; then prepare_cron; apply_cron false; fi for uninstall_file in "$target_script" "$target_script.conf-sshd.bak"; do check_path "$uninstall_file" file if [ "$dry_run" = yes ]; then say "Would remove $uninstall_file"; else rm -f "$uninstall_file"; fi done - say 'Uninstalled managed scheduling/script. Authorized keys and sshd configuration are preserved.' ;; + say 'Uninstalled managed scheduling/script. Authorized keys, trust and rollback state are preserved.' ;; config) edit_sshd_config ;; sync|keys) + script_tmp= if [ "$cron_requested" = yes ]; then prepare_cron if [ "$cron_value" = false ]; then apply_cron false; exit 0; fi validate_build if [ -z "$cron_value" ]; then cron_value=${existing_schedule:-$DEFAULT_CRON}; fi fi + if [ "$trust_options" = yes ] || { [ "$config_snapshot" = absent ] && [ "$DEFAULT_GPG_VERIFY" = on ]; }; then + validate_build + prepare_install_config + validation_only=yes + fi + if [ "$cron_requested" = yes ] && [ ! -f "$target_script" ]; then prepare_script; fi sync_keys - if [ "$cron_requested" = yes ]; then install_script; apply_cron "$cron_value"; fi ;; + if [ "$config_prepared" = yes ]; then + if [ -n "$script_tmp" ]; then install_script; script_tmp=; fi + commit_install_config + if [ "$policy" = required ]; then finish_verified_release; else apply_payload; fi + fi + if [ "$cron_requested" = yes ]; then + if [ -n "$script_tmp" ]; then install_script; fi + apply_cron "$cron_value" + fi ;; esac diff --git a/deployment.json b/deployment.json index 3b759f9..4addff9 100644 --- a/deployment.json +++ b/deployment.json @@ -3,5 +3,15 @@ "repositoryUrl": "https://github.com/LamGC/quickly-conf-sshd", "defaultCron": "*/15 * * * *", "allowEmpty": false, - "fallbackSources": [] + "fallbackSources": [], + "keySource": { + "type": "git" + }, + "clientDefaults": { + "gpgVerification": "off", + "fingerprint": "", + "pinMode": "primary", + "listId": "", + "email": "" + } } diff --git a/scripts/build.mjs b/scripts/build.mjs index 2ffcd1b..5bf4444 100644 --- a/scripts/build.mjs +++ b/scripts/build.mjs @@ -7,20 +7,25 @@ import { execFileSync } from 'node:child_process'; export const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); export const digest = data => createHash('sha256').update(data).digest('hex'); -import { escapeHTML, commandsFor, renderKeys, renderCommands, renderPage } from '../cf-worker/src/view.js'; -export { escapeHTML, commandsFor, renderKeys, renderCommands }; -import { validateFallbackSources, parsePublicKeys } from '../cf-worker/src/key-source.js'; +import { escapeHTML, commandsFor, renderCommands, renderPage } from '../cf-worker/src/view.js'; +export { escapeHTML, commandsFor, renderCommands }; +import { validateFallbackSources, parsePublicKeys, validateKeySource, validateSignedReleaseConfig } from '../cf-worker/src/key-source.js'; +import {withoutKeyComments, parsePublishedSignedRelease, SIGNATURE_SEPARATOR} from '../cf-worker/src/signed-release.js'; +import {checkSigningCertificate, validatePublicCertificate} from './signature-tools.mjs'; export function validateConfig(config) { if (!config || typeof config !== 'object' || Array.isArray(config)) throw Error('Deployment configuration must be an object.'); - for (const key of Object.keys(config)) if (!['baseUrl','repositoryUrl','defaultCron','allowEmpty','fallbackSources'].includes(key)) throw Error(`Unknown configuration: ${key}`); + for (const key of Object.keys(config)) if (!['baseUrl','repositoryUrl','defaultCron','allowEmpty','fallbackSources','keySource','signedRelease','clientDefaults'].includes(key)) throw Error(`Unknown configuration: ${key}`); if (typeof config.baseUrl !== 'string' || !/^https:\/\/[a-zA-Z0-9.-]+(?::[0-9]+)?$/.test(config.baseUrl)) throw Error('baseUrl must be an HTTPS origin without paths, credentials, or shell metacharacters.'); const url = new URL(config.baseUrl); if (url.origin !== config.baseUrl || !url.hostname.includes('.') || url.hostname.includes('..')) throw Error('baseUrl must be a canonical HTTPS origin.'); if (typeof config.repositoryUrl !== 'string' || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(config.repositoryUrl)) throw Error('repositoryUrl must identify a GitHub repository.'); if (typeof config.allowEmpty !== 'boolean') throw Error('allowEmpty must be an explicit boolean.'); validateFallbackSources(Object.hasOwn(config, 'fallbackSources') ? config.fallbackSources : []); + validateKeySource(config.keySource); + validateSignedReleaseConfig(config.signedRelease); + validateClientDefaults(config.clientDefaults); const cron = config.defaultCron; if (typeof cron !== 'string' || cron.trim() !== cron || !/^[0-9*,/ -]+$/.test(cron) || cron.split(/ +/).length !== 5) throw Error('defaultCron must contain five numeric cron fields.'); const bounds = [[0,59],[0,23],[1,31],[1,12],[0,7]]; @@ -37,6 +42,18 @@ export function validateConfig(config) { return config; } +export function validateClientDefaults(value = {}) { + if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !['gpgVerification', 'fingerprint', 'pinMode', 'listId', 'email'].includes(key))) throw Error('Invalid clientDefaults configuration.'); + const result = {gpgVerification: value.gpgVerification ?? 'off', fingerprint: value.fingerprint ?? '', pinMode: value.pinMode ?? 'primary', listId: value.listId ?? '', email: value.email ?? ''}; + if (!['off', 'on'].includes(result.gpgVerification) || !['primary', 'subkey'].includes(result.pinMode)) throw Error('Invalid client verification defaults.'); + if (typeof result.fingerprint !== 'string' || (result.fingerprint !== '' && !/^[A-Fa-f0-9]{40}$/.test(result.fingerprint))) throw Error('Client fingerprint must be empty or a full 40-character fingerprint.'); + if (typeof result.listId !== 'string' || result.listId === '-' || (result.listId !== '' && !/^[A-Za-z0-9._-]{1,64}$/.test(result.listId))) throw Error('Invalid client list ID.'); + if (result.gpgVerification === 'on' && (!result.fingerprint || !result.listId)) throw Error('Enabled verification defaults require a full fingerprint and list ID.'); + if (typeof result.email !== 'string' || (result.email !== '' && (!/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}$/.test(result.email) || result.email.length > 254))) throw Error('Client email must be empty or a safe public email address.'); + result.fingerprint = result.fingerprint.toUpperCase(); + return result; +} + export async function parseKeys(input) { // Use the exact runtime parser, then additionally verify against the build's OpenSSH tools. const keys = await parsePublicKeys(input); @@ -54,8 +71,9 @@ export async function parseKeys(input) { export function makeKeysText(keys, revision, allowEmpty) { if (!/^[0-9a-f]{40}$/.test(revision)) throw Error('Release revision must be a 40-character Git commit SHA.'); + if (typeof allowEmpty !== 'boolean') throw Error('allowEmpty must be an explicit boolean.'); if (!keys.length && !allowEmpty) throw Error('No server public keys configured. Add keys/authorized_keys, or explicitly allow an empty revocation release.'); - const payload = keys.map(key => key.text + '\n').join(''); + const payload = withoutKeyComments(keys).map(key => key.text + '\n').join(''); const sha256 = digest(payload); const text = `# conf-sshd-v1\n# revision ${revision}\n# key-count ${keys.length}\n# allow-empty ${allowEmpty ? 'yes' : 'no'}\n# sha256 ${sha256}\n# end-metadata\n${payload}`; if (Buffer.byteLength(text) > 1024 * 1024) throw Error('Serialized key release exceeds client response limit.'); @@ -65,26 +83,62 @@ export function makeKeysText(keys, revision, allowEmpty) { export async function build({directory = root, outDirectory = join(directory,'cf-worker'), testFixture = false, revision, publishedAt} = {}) { const config = validateConfig(JSON.parse(await readFile(join(directory,'deployment.json'),'utf8'))); - const input = await readFile(join(directory,testFixture ? 'tests/fixtures/keys.pub' : 'keys/authorized_keys'),'utf8'); - const keys = await parseKeys(input); + const input = config.keySource?.type === 'gist' && !testFixture ? '' : await readFile(join(directory,testFixture ? 'tests/fixtures/keys.pub' : 'keys/authorized_keys'),'utf8').catch(error => {if (error.code === 'ENOENT' && !testFixture) return ''; throw error;}); + let keys = []; revision ||= process.env.GITHUB_SHA || execFileSync('git',['rev-parse','HEAD'],{cwd:directory,encoding:'utf8'}).trim(); + if (!/^[0-9a-f]{40}$/.test(revision)) throw Error('Release revision must be a 40-character Git commit SHA.'); publishedAt ||= new Date().toISOString(); const fallbackSources = validateFallbackSources(config.fallbackSources ?? []); - const needsFallback = keys.length === 0 && !config.allowEmpty && fallbackSources.length > 0; - const bundle = needsFallback ? {sha256:null,text:null} : makeKeysText(keys,revision,config.allowEmpty); + const keySource = validateKeySource(config.keySource), signedRelease = validateSignedReleaseConfig(config.signedRelease); + const optional = async path => { try { return await readFile(join(directory, path), 'utf8'); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } }; + let signed = null, publicCertificate = null; + if (keySource.type === 'git' && !testFixture) { + const documentFile = await optional('keys/ssh.keys'), bundleFile = await optional('keys/release.bundle'); + if (documentFile !== null && bundleFile !== null) throw Error('Use keys/ssh.keys plus its optional signature OR keys/release.bundle, not both.'); + if (documentFile !== null || bundleFile !== null) { + const separator = bundleFile?.indexOf(SIGNATURE_SEPARATOR) ?? -1; + if (bundleFile !== null && separator < 0) throw Error('release.bundle lacks its detached-signature separator.'); + const document = documentFile ?? bundleFile.slice(0, separator); + const signature = documentFile !== null ? await optional('keys/ssh.keys.sig') : bundleFile.slice(separator + SIGNATURE_SEPARATOR.length); + signed = await parsePublishedSignedRelease(document, signature, {listId: signedRelease?.listId, checkFreshness: false}); + keys = signed.keys; + } + } + if (!signed) keys = withoutKeyComments(await parseKeys(input)); + if (signedRelease?.publicKeyFile) { + publicCertificate = validatePublicCertificate(await readFile(join(directory, signedRelease.publicKeyFile), 'utf8')); + if (signed && !signed.bundle) throw Error('Configured build signature verification requires a valid detached signature.'); + await checkSigningCertificate(publicCertificate, signedRelease.fingerprint, signed?.bundle); + } + const allowEmpty = signed ? signed.metadata.revoke : config.allowEmpty; + const needsFallback = keySource.type === 'git' && keys.length === 0 && !allowEmpty && fallbackSources.length > 0; + const needsSource = keySource.type === 'gist' || needsFallback; + if (keySource.type === 'gist') keys = []; + const bundle = needsSource ? {sha256:null,text:null} : signed ? {sha256:digest(keys.map(key=>key.text+'\n').join('')),text:signed.document} : makeKeysText(keys,revision,allowEmpty); + const clientDefaults = validateClientDefaults(config.clientDefaults); + if (!testFixture && !needsSource && clientDefaults.gpgVerification === 'on') { + if (!signed?.signature) throw Error('Verification-enabled static Git releases require a signed document and detached signature.'); + if (signed.metadata.listId !== clientDefaults.listId) throw Error('Client default list ID differs from the static signed document.'); + if (signedRelease?.fingerprint && clientDefaults.pinMode === 'primary' && clientDefaults.fingerprint !== signedRelease.fingerprint) throw Error('Client primary fingerprint differs from the configured signing certificate.'); + } let script = await readFile(join(directory,'conf-sshd.sh'),'utf8'); for (const [name,value] of Object.entries({'BASE_URL':config.baseUrl,'DEFAULT_CRON':config.defaultCron})) { if (!script.includes(`@@${name}@@`)) throw Error(`Script is missing @@${name}@@.`); script = script.replaceAll(`@@${name}@@`,value); } + for (const [name, value] of Object.entries({DEFAULT_GPG_VERIFY:clientDefaults.gpgVerification,DEFAULT_GPG_FINGERPRINT:clientDefaults.fingerprint,DEFAULT_GPG_PIN_MODE:clientDefaults.pinMode,DEFAULT_LIST_ID:clientDefaults.listId,DEFAULT_GPG_EMAIL:clientDefaults.email})) script = script.replaceAll(`@@${name}@@`, value); if (/@@[A-Z_]+@@/.test(script)) throw Error('Unresolved script template token.'); if (!script.includes('# conf-sshd-script-v2')) throw Error('Missing script format marker.'); execFileSync('sh',['-n'],{input:script,stdio:['pipe','pipe','pipe']}); - const release = {schema:1,revision,publishedAt,keyCount:keys.length,allowEmpty:config.allowEmpty,sha256:bundle.sha256,testFixture,baseUrl:config.baseUrl,repositoryUrl:config.repositoryUrl,fallbackSources,needsFallback,keys,commands:commandsFor(config)}; + const release = {schema:1,revision,publishedAt,keyCount:keys.length,allowEmpty,sha256:bundle.sha256,keyRevision:signed?.metadata.documentSha256 ?? bundle.sha256,testFixture,baseUrl:config.baseUrl,repositoryUrl:config.repositoryUrl,fallbackSources,keySource,signedRelease,clientDefaults,publicCertificate,signedDocument:signed?.document ?? null,signature:signed?.signature ?? null,signatureAvailable:Boolean(signed?.signature),publicCertificateAvailable:Boolean(publicCertificate),signedBundle:signed?.bundle ?? null,signedMetadata:signed?.metadata ?? null,needsFallback,needsSource,keys,commands:commandsFor(config)}; let html = await readFile(join(directory,'site/index.html'),'utf8'); const publicDir = join(outDirectory,'public'), generatedDir = join(outDirectory,'generated'); await rm(publicDir,{recursive:true,force:true}); await mkdir(join(publicDir,'assets'),{recursive:true}); await mkdir(generatedDir,{recursive:true}); + // Git files are true Worker Static Assets as well as exact router response bytes (never Pages). + if (!needsSource) await writeFile(join(publicDir,'ssh.keys'), signed?.document ?? bundle.text); + if (signed?.signature) await writeFile(join(publicDir,'ssh.keys.sig'), signed.signature); + if (publicCertificate) await writeFile(join(publicDir,'public-key.gpg'), publicCertificate); for (const [file,ext] of [['style','css'],['app','js']]) { const body = await readFile(join(directory,`site/assets/${file}.${ext}`)); const name = `${file}.${digest(body).slice(0,12)}.${ext}`; @@ -92,9 +146,9 @@ export async function build({directory = root, outDirectory = join(directory,'cf html = html.replaceAll(`/assets/${file}.${ext}`,`/assets/${name}`); } release.pageTemplate = html; - await writeFile(join(publicDir,'index.html'),renderPage(html,{...release,source:{type:needsFallback ? 'pending' : keys.length ? 'repository' : 'explicit-empty'}})); - await writeFile(join(generatedDir,'release.js'),`// Generated release; do not edit.\nexport default ${JSON.stringify({...release,script,keysText:bundle.text})};\n`); - await writeFile(join(generatedDir,'manifest.json'),JSON.stringify({...release,keys:undefined,commands:undefined,pageTemplate:undefined},null,2)+'\n'); + await writeFile(join(publicDir,'index.html'),renderPage(html,{...release,source:{type:needsSource ? 'pending' : keys.length ? 'repository' : 'explicit-empty'}})); + await writeFile(join(generatedDir,'release.js'),`// Generated release; do not edit.\nexport default ${JSON.stringify({...release,script,keysText:signed?.document ?? bundle.text})};\n`); + await writeFile(join(generatedDir,'manifest.json'),JSON.stringify({...release,keys:undefined,commands:undefined,pageTemplate:undefined,publicCertificate:undefined,signedDocument:undefined,signature:undefined,signedBundle:undefined},null,2)+'\n'); return release; } diff --git a/scripts/notify-deployment.mjs b/scripts/notify-deployment.mjs new file mode 100644 index 0000000..1bd9929 --- /dev/null +++ b/scripts/notify-deployment.mjs @@ -0,0 +1,92 @@ +// Optional JSON webhook for a separately configured email delivery service. +// This sends deployment configuration, not observed server/fleet state. +import {readFile} from 'node:fs/promises'; +import {resolve} from 'node:path'; +import {fileURLToPath} from 'node:url'; + +export function notificationEnabled(value) { + if (value === undefined || value === '' || value === 'false') return false; + if (value === 'true') return true; + throw Error('ENABLE_MAIL_NOTIFICATION must be unset, false, or exactly true.'); +} + +function httpsUrl(value, name) { + let url; + try { url = new URL(value); } catch { throw Error(`${name} must be an HTTPS URL.`); } + if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw Error(`${name} must be HTTPS without URL credentials or fragments.`); + return url.href; +} + +export function deploymentPayload(config, env) { + if (!config || typeof config !== 'object' || Array.isArray(config)) throw Error('Deployment configuration must be an object.'); + const status = env.DEPLOYMENT_STATUS; + if (!['success','failure','cancelled'].includes(status)) throw Error('DEPLOYMENT_STATUS must be success, failure, or cancelled.'); + const phase = env.DEPLOYMENT_PHASE; + if (!['deployment','remote-verification','complete'].includes(phase)) throw Error('DEPLOYMENT_PHASE must identify the attempted deployment phase.'); + if (!/^[0-9a-f]{40}$/.test(env.GITHUB_SHA || '')) throw Error('GITHUB_SHA must be an exact 40-hex commit SHA.'); + if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(env.GITHUB_REPOSITORY || '') || !/^\d+$/.test(env.GITHUB_RUN_ID || '')) throw Error('A valid GitHub repository and run ID are required.'); + const mode = config.keySource?.type ?? 'git'; + if (!['git','gist'].includes(mode)) throw Error('Unsupported deployment key source mode.'); + const listId = config.signedRelease?.listId ?? null; + if (listId !== null && (typeof listId !== 'string' || !/^[A-Za-z0-9._-]{1,64}$/.test(listId))) throw Error('Invalid deployment list identity.'); + const fallbackSources = config.fallbackSources ?? []; + if (!Array.isArray(fallbackSources) || fallbackSources.length > 5) throw Error('Invalid deployment fallback sources.'); + const to = env.MAIL_NOTIFICATION_TO || null; + if (to !== null && (to.length > 254 || !/^[^\s@,<>]+@[^\s@,<>]+\.[^\s@,<>]+$/.test(to))) throw Error('MAIL_NOTIFICATION_TO must be one email address.'); + return { + schema:1, + event:'worker-deployment', + status, + phase, + repository:env.GITHUB_REPOSITORY, + revision:env.GITHUB_SHA, + workflowRunUrl:`https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`, + to, + configuration:{ + baseUrl:httpsUrl(config.baseUrl, 'Deployment baseUrl'), + mode, + listId, + signedRelease:Boolean(config.signedRelease), + fallbackSources:fallbackSources.map(value => httpsUrl(value,'Deployment fallback source')), + }, + configurationScope:'deployment configuration only; not measured server state', + }; +} + +export async function notifyDeployment({env = process.env, config, fetchImpl = globalThis.fetch} = {}) { + if (!notificationEnabled(env.ENABLE_MAIL_NOTIFICATION)) return {sent:false,reason:'disabled'}; + if (env.GITHUB_ACTIONS !== 'true' || env.CI !== 'true') throw Error('Deployment notification sending is allowed only in GitHub Actions CI.'); + if (!env.MAIL_NOTIFICATION_WEBHOOK) throw Error('MAIL_NOTIFICATION_WEBHOOK is required when notifications are enabled.'); + const endpoint = httpsUrl(env.MAIL_NOTIFICATION_WEBHOOK,'Notification webhook'); + const payload = deploymentPayload(config,env); + let response; + try { + response = await fetchImpl(endpoint, { + method:'POST', + headers:{'content-type':'application/json'}, + body:JSON.stringify(payload), + redirect:'error', + signal:AbortSignal.timeout(10_000), + }); + } catch { + // Provider errors may contain secret URL tokens. Do not print them or retry + // automatically: a timed-out request may already have sent the email. + throw Error('Deployment notification request failed; check the webhook service.'); + } + if (!response.ok) throw Error(`Deployment notification was rejected (HTTP ${response.status}).`); + // Do not log response bodies, the recipient, or the secret webhook URL. + return {sent:true}; +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + try { + if (process.argv.length !== 2) throw Error('Usage: node scripts/notify-deployment.mjs'); + let config; + if (notificationEnabled(process.env.ENABLE_MAIL_NOTIFICATION)) { + try { config = JSON.parse(await readFile(new URL('../deployment.json',import.meta.url),'utf8')); } + catch { throw Error('Cannot read deployment notification configuration.'); } + } + const result = await notifyDeployment({config}); + console.log(result.sent ? 'Deployment notification webhook accepted the request.' : 'Deployment notification disabled.'); + } catch (error) { console.error(error.message); process.exitCode = 1; } +} diff --git a/scripts/prepare-key-release.mjs b/scripts/prepare-key-release.mjs new file mode 100644 index 0000000..c02b8b0 --- /dev/null +++ b/scripts/prepare-key-release.mjs @@ -0,0 +1,37 @@ +#!/usr/bin/env node +// This preparation tool only reads PUBLIC SSH keys and writes the exact bytes to sign offline. +// It never reads a signing private key, invokes gpg signing, or uploads anything. +import {readFile, writeFile} from 'node:fs/promises'; +import {resolve} from 'node:path'; +import {fileURLToPath} from 'node:url'; +import {makeSignedDocument, parseSignedDocument, SIGNATURE_SEPARATOR, validateSignature} from '../cf-worker/src/signed-release.js'; + +export async function prepare(argv) { + const options = {}; + for (let i = 0; i < argv.length; i++) { + const key = argv[i]; + if (key === '--revoke') { options.revoke = true; continue; } + if (!['--input', '--output', '--list-id', '--sequence', '--issued-at', '--expires-at', '--signature', '--bundle'].includes(key) || i + 1 >= argv.length || Object.hasOwn(options, key)) throw Error('Usage: node scripts/prepare-key-release.mjs --input PUBLIC_KEYS --output DOCUMENT --list-id ID --sequence N --issued-at EPOCH --expires-at EPOCH [--revoke]\nOr: --input DOCUMENT --signature SIGNATURE --bundle BUNDLE (pack only after offline signing).'); + options[key] = argv[++i]; + } + if (options['--bundle']) { + if (!options['--input'] || !options['--signature'] || Object.keys(options).some(key => !['--input', '--signature', '--bundle'].includes(key))) throw Error('Packing accepts only --input DOCUMENT --signature SIGNATURE --bundle BUNDLE.'); + const document = await readFile(options['--input'], 'utf8'), signature = await readFile(options['--signature'], 'utf8'); + await parseSignedDocument(document, {checkFreshness: false}); + validateSignature(signature); + await writeFile(options['--bundle'], document + SIGNATURE_SEPARATOR + signature, {flag: 'wx', mode: 0o600}); + return 'Packed exact document and detached signature. Cryptographic verification is still required.'; + } + if (!options['--input'] || !options['--output'] || !options['--list-id'] || options['--signature']) throw Error('Preparation requires --input, --output, --list-id, --sequence, --issued-at and --expires-at.'); + const numbers = {}; + for (const [key, field] of [['--sequence','sequence'], ['--issued-at','issuedAt'], ['--expires-at','expiresAt']]) { + if (!/^(?:0|[1-9][0-9]{0,9})$/.test(options[key] ?? '')) throw Error(`${key} must be a canonical decimal integer.`); + numbers[field] = Number(options[key]); + } + const document = await makeSignedDocument(await readFile(options['--input'], 'utf8'), {listId: options['--list-id'], ...numbers, revoke: Boolean(options.revoke)}); + await writeFile(options['--output'], document, {flag: 'wx', mode: 0o600}); + return 'Prepared comment-free bytes. Sign this exact file offline with an armored detached signature; never rewrite it afterward.'; +} +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + try { console.log(await prepare(process.argv.slice(2))); } catch (error) { console.error(error.message); process.exitCode = 1; } +} diff --git a/scripts/signature-tools.mjs b/scripts/signature-tools.mjs new file mode 100644 index 0000000..47d9ce9 --- /dev/null +++ b/scripts/signature-tools.mjs @@ -0,0 +1,59 @@ +import {mkdtemp, writeFile, rm} from 'node:fs/promises'; +import {tmpdir} from 'node:os'; +import {join} from 'node:path'; +import {execFileSync} from 'node:child_process'; +import {SIGNED_RELEASE_LIMITS, parseSignedBundle} from '../cf-worker/src/signed-release.js'; + +export function validatePublicCertificate(certificate) { + if (typeof certificate !== 'string' || Buffer.byteLength(certificate) > SIGNED_RELEASE_LIMITS.publicKeyBytes || !/^-----BEGIN PGP PUBLIC KEY BLOCK-----\r?\n[\s\S]+\r?\n-----END PGP PUBLIC KEY BLOCK-----\r?\n?$/.test(certificate) || /[^\x09\x0a\x0d\x20-\x7e]/.test(certificate) || (certificate.match(/-----BEGIN /g) || []).length !== 1) throw Error('Expected one bounded ASCII-armored PUBLIC OpenPGP certificate, never private material.'); + return certificate; +} + +/** Uses an ephemeral public-only keyring. Never loads the operator's keyring, signs, or retrieves keys. */ +export async function checkSigningCertificate(certificate, fingerprint, signed = null) { + validatePublicCertificate(certificate); + if (typeof fingerprint !== 'string' || !/^[A-Fa-f0-9]{40}$/.test(fingerprint)) throw Error('A full primary signing fingerprint is required.'); + fingerprint = fingerprint.toUpperCase(); + const home = await mkdtemp(join(tmpdir(), 'conf-sshd-public-verify-')); + const args = ['--no-options', '--homedir', home, '--batch', '--no-tty', '--no-autostart', '--no-auto-key-retrieve', '--auto-key-locate', 'clear']; + const gpg = more => {try {return execFileSync('gpg', [...args, ...more], {encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15000, maxBuffer: 4 * 1024 * 1024});} catch {throw Error('GPG public verification command failed.');}}; + try { + const certPath = join(home, 'certificate.asc'); + await writeFile(certPath, certificate, {mode: 0o600}); + const packets = gpg(['--list-packets', certPath]); + if (/:secret (?:sub )?key packet:/.test(packets)) throw Error('Secret key packets are not accepted.'); + const listing = gpg(['--with-colons', '--show-keys', certPath]); + const records = listing.split('\n').map(line => line.split(':')); + const primaries = records.filter(record => record[0] === 'pub'); + if (primaries.length !== 1 || records.some(record => record[0] === 'sec' || record[0] === 'ssb')) throw Error('The public certificate must contain exactly one primary identity.'); + if (['r', 'e', 'd'].includes(primaries[0][1]) || (primaries[0][6] && Number(primaries[0][6]) <= Math.floor(Date.now()/1000))) throw Error('Signing public certificate is expired, revoked, or disabled.'); + const primaryIndex = records.findIndex(record => record[0] === 'pub'); + const actual = records.slice(primaryIndex + 1).find(record => record[0] === 'fpr')?.[9]; + if (actual !== fingerprint) throw Error('Signing public certificate fingerprint mismatch.'); + if (!signed) return fingerprint; + const parsed = await parseSignedBundle(signed, {checkFreshness: false}); + const keyring = join(home, 'public.gpg'); + gpg(['--output', keyring, '--dearmor', certPath]); + const documentPath = join(home, 'document'), signaturePath = join(home, 'signature.asc'); + await writeFile(documentPath, parsed.document, {mode: 0o600}); + await writeFile(signaturePath, parsed.signature, {mode: 0o600}); + let status; + try { status = gpg(['--no-default-keyring', '--keyring', keyring, '--status-fd', '1', '--verify', signaturePath, documentPath]); } + catch { throw Error('Detached OpenPGP signature verification failed.'); } + validatePayloadSignatureStatus(status, fingerprint); + return fingerprint; + } finally { await rm(home, {recursive: true, force: true}); } +} + +export function validatePayloadSignatureStatus(output, fingerprint, now = Math.floor(Date.now() / 1000)) { + const records = output.split(/\r?\n/).filter(line => line.startsWith('[GNUPG:] ')).map(line => line.slice(9).split(/ +/)); + const rejected = new Set(['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']); + if (records.some(record => rejected.has(record[0]))) throw Error('Detached signature is invalid, expired, revoked, or unverifiable.'); + const valid = records.filter(record => record[0] === 'VALIDSIG'); + if (valid.length !== 1) throw Error('Expected exactly one valid detached signature.'); + const [, signer, , timestamp, expires, version, , , hash, signatureClass, primary] = valid[0]; + if (valid[0].length !== 11 || !/^[A-Fa-f0-9]{40}$/.test(signer) || !/^[A-Fa-f0-9]{40}$/.test(primary || '') || version !== '4' || !['8','9','10'].includes(hash) || signatureClass !== '00') throw Error('Payload requires an OpenPGP v4 binary SHA-256/384/512 signature with a full primary fingerprint.'); + if (!/^\d+$/.test(timestamp) || !/^\d+$/.test(expires) || (Number(expires) !== 0 && Number(expires) <= now)) throw Error('Detached signature has expired or invalid timestamps.'); + if (primary.toUpperCase() !== fingerprint.toUpperCase()) throw Error('Detached signature primary identity is not pinned.'); + return {signerFingerprint:signer.toUpperCase(), primaryFingerprint:primary.toUpperCase()}; +} diff --git a/scripts/verify-commit-signature.mjs b/scripts/verify-commit-signature.mjs new file mode 100644 index 0000000..dbcd286 --- /dev/null +++ b/scripts/verify-commit-signature.mjs @@ -0,0 +1,81 @@ +// This verifier and the workflow are trusted repository code, not an immutable +// security boundary. Protect changes to both; trusted keys/pins live in Actions +// variables outside this commit. No npm packages or repository imports are used. +import {spawnSync} from 'node:child_process'; +import {mkdtemp, writeFile, rm} from 'node:fs/promises'; +import {tmpdir} from 'node:os'; +import {join, resolve} from 'node:path'; +import {fileURLToPath} from 'node:url'; + +export function enabledFlag(value, name = 'REQUIRE_GPG_SIGNATURE') { + if (value === undefined || value === '' || value === 'false') return false; + if (value === 'true') return true; + throw Error(`${name} must be unset, false, or exactly true.`); +} + +export function parseFingerprints(value) { + const values = typeof value === 'string' ? value.trim().split(/[\s,]+/).filter(Boolean) : []; + if (!values.length || values.some(value => !/^[0-9a-fA-F]{40}$/.test(value))) { + throw Error('GPG_ALLOWED_PRIMARY_FINGERPRINTS must contain full 40-hex OpenPGP v4 primary fingerprints.'); + } + return new Set(values.map(value => value.toUpperCase())); +} + +export function verifySignatureStatus(output, allowed, now = Math.floor(Date.now() / 1000)) { + const records = output.split(/\r?\n/).filter(line => line.startsWith('[GNUPG:] ')).map(line => line.slice(9).split(/ +/)); + const rejected = new Set(['BADSIG','ERRSIG','NO_PUBKEY','EXPSIG','EXPKEYSIG','REVKEYSIG','KEYEXPIRED','SIGEXPIRED','KEYREVOKED','FAILURE','ERROR','NODATA','BADARMOR']); + if (records.some(record => rejected.has(record[0]))) throw Error('Commit signature is invalid, expired, revoked, or unverifiable.'); + const valid = records.filter(record => record[0] === 'VALIDSIG'); + if (valid.length !== 1) throw Error('Expected exactly one valid OpenPGP commit signature.'); + const [, signer, , timestamp, expires, version, , , hash, signatureClass, primary] = valid[0]; + if (valid[0].length !== 11 || !/^[A-Fa-f0-9]{40}$/.test(signer) || !/^[A-Fa-f0-9]{40}$/.test(primary || '') || version !== '4' || !['8','9','10'].includes(hash) || signatureClass !== '00') { + throw Error('Commit requires an OpenPGP v4 SHA-256/384/512 signature with full primary fingerprint.'); + } + if (!/^\d+$/.test(timestamp) || !/^\d+$/.test(expires) || (Number(expires) !== 0 && Number(expires) <= now)) throw Error('Commit signature has expired or invalid timestamps.'); + if (!allowed.has(primary.toUpperCase())) throw Error('Commit signer primary fingerprint is not pinned.'); + return {signerFingerprint:signer.toUpperCase(), primaryFingerprint:primary.toUpperCase()}; +} + +function run(command, args, {cwd, env, input} = {}) { + const result = spawnSync(command, args, {cwd, env, input, encoding:'utf8', timeout:30_000, maxBuffer:4 * 1024 * 1024}); + // Never relay GPG key text/UIDs or arbitrary subprocess errors into CI logs. + if (result.error || result.status !== 0 || result.signal) throw Error(`${command === 'git' ? 'Git' : 'GPG'} verification command failed.`); + return result; +} + +export async function verifyCommitSignature({env = process.env, directory = process.cwd()} = {}) { + const required = enabledFlag(env.REQUIRE_GPG_SIGNATURE); + const revision = env.GITHUB_SHA; + if (!/^[0-9a-f]{40}$/.test(revision || '')) throw Error('GITHUB_SHA must be the exact 40-hex commit SHA.'); + const cleanEnv = {...env, GIT_CONFIG_NOSYSTEM:'1', GIT_CONFIG_GLOBAL:'/dev/null', GIT_NO_REPLACE_OBJECTS:'1'}; + const head = run('git', ['-c','core.fsmonitor=false','rev-parse','--verify','HEAD'], {cwd:directory,env:cleanEnv}).stdout.trim(); + if (head !== revision) throw Error('Checked-out HEAD does not match GITHUB_SHA.'); + if (!required) return {required:false,revision}; + const allowed = parseFingerprints(env.GPG_ALLOWED_PRIMARY_FINGERPRINTS); + const publicKeys = env.GPG_PUBLIC_KEYS; + if (typeof publicKeys !== 'string' || !publicKeys.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----') || publicKeys.includes('PRIVATE KEY')) throw Error('GPG_PUBLIC_KEYS must contain externally configured armored public keys only.'); + const home = await mkdtemp(join(tmpdir(), 'conf-sshd-gpg-')); + try { + const gpgEnv = {...cleanEnv, GNUPGHOME:home}; + const options = ['--no-options','--homedir',home,'--batch','--no-tty','--no-autostart','--no-auto-key-retrieve','--auto-key-locate','clear']; + // Decode into an isolated legacy public keyring without importing keys or + // contacting gpg-agent. This also avoids starting secret-key services in CI. + const listing = run('gpg', [...options,'--with-colons','--show-keys'], {env:gpgEnv,input:publicKeys}).stdout; + if (!/^pub:/m.test(listing) || /^(?:sec|ssb):/m.test(listing)) throw Error('Only public verification keys are allowed.'); + run('gpg', [...options,'--output',join(home,'public.gpg'),'--dearmor'], {env:gpgEnv,input:publicKeys}); + const wrapper = join(home,'verify-gpg'); + await writeFile(wrapper, '#!/bin/sh\nexec gpg --no-options --homedir "$GNUPGHOME" --no-default-keyring --keyring "$GNUPGHOME/public.gpg" --batch --no-tty --no-autostart --no-auto-key-retrieve --auto-key-locate clear "$@"\n', {mode:0o700}); + const result = run('git', ['-c','core.fsmonitor=false','-c','gpg.format=openpgp','-c',`gpg.program=${wrapper}`,'-c',`gpg.openpgp.program=${wrapper}`,'verify-commit','--raw',revision], {cwd:directory,env:gpgEnv}); + return {required:true,revision,...verifySignatureStatus(result.stderr,allowed)}; + } finally { + await rm(home,{recursive:true,force:true}); + } +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + try { + if (process.argv.length !== 2) throw Error('Usage: node scripts/verify-commit-signature.mjs'); + const result = await verifyCommitSignature(); + console.log(result.required ? `Verified commit ${result.revision} with pinned primary ${result.primaryFingerprint}.` : `GPG commit gate disabled; checked exact commit ${result.revision}.`); + } catch (error) { console.error(error.message); process.exitCode = 1; } +} diff --git a/scripts/verify-release.mjs b/scripts/verify-release.mjs index aa039f1..62a6dd6 100644 --- a/scripts/verify-release.mjs +++ b/scripts/verify-release.mjs @@ -1,29 +1,82 @@ import {readFile} from 'node:fs/promises'; +import {resolve} from 'node:path'; +import {fileURLToPath} from 'node:url'; import {createHash} from 'node:crypto'; import {parsePublicKeys} from '../cf-worker/src/key-source.js'; -const manifest=JSON.parse(await readFile(new URL('../cf-worker/generated/manifest.json',import.meta.url),'utf8')); -if (manifest.testFixture) throw Error('Refusing to deploy a test-fixture build. Run the production build with real server public keys.'); -if (!process.argv.includes('--remote')) { console.log(`Production release verified: ${manifest.revision}`); } -else { - const timeout=()=>AbortSignal.timeout(20000); - const metadataResponse=await fetch(manifest.baseUrl+'/release.json',{cache:'no-store',signal:timeout()}); - if(!metadataResponse.ok) throw Error(`Metadata endpoint returned ${metadataResponse.status}`); - const metadata=await metadataResponse.json(); - if(metadata.revision!==manifest.revision||metadata.testFixture) throw Error('Remote release does not match this build.'); - if(!/^[0-9a-f]{64}$/.test(metadata.sha256)) throw Error('Remote key digest is invalid.'); - if(manifest.needsFallback) { - if(metadata.source?.type!=='fallback'||!manifest.fallbackSources.includes(metadata.source.url)||metadata.keyCount<1)throw Error('Unexpected effective fallback source.'); - } else if(metadata.sha256!==manifest.sha256) throw Error('Remote repository keys differ from this build.'); - const keysResponse=await fetch(manifest.baseUrl+'/ssh.keys',{cache:'no-store',signal:timeout()}); - if(!keysResponse.ok) throw Error(`Keys endpoint returned ${keysResponse.status}`); - const keysText=await keysResponse.text(); - const match=/^# conf-sshd-v1\n# revision ([0-9a-f]{40})\n# key-count (0|[1-9][0-9]*)\n# allow-empty (yes|no)\n# sha256 ([0-9a-f]{64})\n# end-metadata\n([\s\S]*)$/.exec(keysText); - if(!match||match[1]!==manifest.revision)throw Error('Remote key manifest invalid.'); - const [, , count, empty, hash, payload]=match; - if(createHash('sha256').update(payload).digest('hex')!==hash) throw Error('Remote key body does not match its response digest.'); - const keys=await parsePublicKeys(payload); - if(keys.length!==Number(count)||(!keys.length&&(!manifest.allowEmpty||empty!=='yes')))throw Error('Remote key count/empty policy invalid.'); - if(!manifest.needsFallback&&hash!==manifest.sha256)throw Error('Remote repository key payload differs from this build.'); - // Dynamic fallback may legitimately change between the two requests; each response is checked independently. - console.log(`Remote code release verified: ${metadata.revision}; key payload ${hash} (${count} keys).`); +import {parseSignedDocument, SIGNATURE_SEPARATOR, SIGNED_RELEASE_LIMITS, withoutKeyComments, validateSignature} from '../cf-worker/src/signed-release.js'; +import {checkSigningCertificate} from './signature-tools.mjs'; +const hash = text => createHash('sha256').update(text).digest('hex'); +const root = new URL('../', import.meta.url); + +async function remoteText(url, maxBytes, {allowMissing = false, fetchImpl = fetch} = {}) { + const signal = AbortSignal.timeout(20000); + const response = await fetchImpl(url, {cache: 'no-store', redirect: 'error', signal}); + if (allowMissing && response.status === 404) { await response.body?.cancel(); return null; } + if (response.status !== 200) { await response.body?.cancel(); throw Error(`Endpoint returned HTTP ${response.status}.`); } + const reader = response.body?.getReader(); + if (!reader) return ''; + let bytes = new Uint8Array(Math.min(16384,maxBytes)), size = 0; + try { + while (true) { + const {value, done} = await reader.read(); + if (done) break; + size += value.byteLength; + if (size > maxBytes) throw Error('Remote response exceeds its size limit.'); + if (size > bytes.length) { const grown = new Uint8Array(Math.min(maxBytes, Math.max(size, bytes.length * 2))); grown.set(bytes); bytes = grown; } + bytes.set(value,size-value.byteLength); + } + return new TextDecoder('utf-8', {fatal: true}).decode(bytes.subarray(0,size)); + } finally { await reader.cancel().catch(() => {}); reader.releaseLock(); } +} + +export async function verifyRemote(manifest, fetchImpl = fetch) { + const read = (path, maxBytes, allowMissing = false) => remoteText(manifest.baseUrl + path, maxBytes, {allowMissing, fetchImpl}); + const metadata = JSON.parse(await read('/release.json', 64 * 1024)); + if (metadata.revision !== manifest.revision || metadata.testFixture) throw Error('Remote release does not match this build.'); + if (!/^[0-9a-f]{64}$/.test(metadata.sha256)) throw Error('Remote key digest is invalid.'); + const dynamic = manifest.needsSource || manifest.needsFallback || manifest.keySource?.type === 'gist'; + if (dynamic) { + const source = metadata.source; + const acceptedFallback = source?.type === 'fallback' && manifest.fallbackSources.includes(source.url); + const acceptedGist = manifest.keySource?.type === 'gist' && source?.type === 'gist' && source.id === manifest.keySource.id && source.ownerId === manifest.keySource.ownerId && /^[0-9a-f]{40}$/.test(source.gistRevision); + if (!acceptedFallback && !acceptedGist) throw Error('Unexpected effective dynamic source.'); + } else if (metadata.sha256 !== manifest.sha256) throw Error('Remote repository keys differ from this build.'); + const document = await read('/ssh.keys', SIGNED_RELEASE_LIMITS.documentBytes); + let count, payloadHash, cryptoNote = ""; + if (document.startsWith('# conf-sshd-signed-v1\n')) { + const parsed = await parseSignedDocument(document, {listId: manifest.signedRelease?.listId, checkFreshness: false}); + count = parsed.keys.length; + payloadHash = hash(parsed.keys.map(key => key.text + '\n').join('')); + if (!dynamic && parsed.metadata.documentSha256 !== manifest.signedMetadata?.documentSha256) throw Error('Remote signed document differs from this build.'); + // Each detached signature must validate THIS exact document; an update race fails safely and can be retried. + const signature = await read('/ssh.keys.sig', SIGNED_RELEASE_LIMITS.signatureBytes, true); + if (manifest.signedRelease?.publicKeyFile) { + if (signature === null) throw Error('Remote signature is missing.'); + const certificate = await read('/public-key.gpg', SIGNED_RELEASE_LIMITS.publicKeyBytes); + await checkSigningCertificate(certificate, manifest.signedRelease.fingerprint, document + SIGNATURE_SEPARATOR + signature); + } else { + if ((manifest.signatureAvailable || manifest.clientDefaults?.gpgVerification === 'on') && signature === null) throw Error('Expected remote signature is missing.'); + if (signature !== null) validateSignature(signature); + cryptoNote = ' OpenPGP not checked: no build verification certificate configured.'; + } + } else { + const match = /^# conf-sshd-v1\n# revision ([0-9a-f]{40})\n# key-count (0|[1-9][0-9]*)\n# allow-empty (yes|no)\n# sha256 ([0-9a-f]{64})\n# end-metadata\n([\s\S]*)$/.exec(document); + if (!match || match[1] !== manifest.revision) throw Error('Remote key manifest invalid.'); + const [, , countText, empty, digest, payload] = match; + if (hash(payload) !== digest) throw Error('Remote key body does not match its response digest.'); + const keys = await parsePublicKeys(payload); + count = keys.length; payloadHash = digest; + if (keys.length !== Number(countText) || (!keys.length && (!manifest.allowEmpty || empty !== 'yes')) || withoutKeyComments(keys).map(key => key.text + '\n').join('') !== payload) throw Error('Remote key count/empty/canonical policy invalid.'); + if (manifest.clientDefaults?.gpgVerification === 'on') throw Error('Verification-enabled clients require a signed-format document.'); + } + if (!dynamic && payloadHash !== manifest.sha256) throw Error('Remote repository payload differs from this build.'); + // Dynamic sources may change between requests; build revision is independent of key sequence/digest. + return `Remote code release checked: ${metadata.revision}; key payload ${payloadHash} (${count} keys).${cryptoNote}`; +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + const manifest = JSON.parse(await readFile(new URL('cf-worker/generated/manifest.json', root), 'utf8')); + if (manifest.testFixture) throw Error('Refusing to deploy a test-fixture build. Run the production build with real server public keys.'); + if (!process.argv.includes('--remote')) console.log(`Production release checked: ${manifest.revision}`); + else console.log(await verifyRemote(manifest)); } diff --git a/site/assets/app.js b/site/assets/app.js index 08e549b..15e022c 100644 --- a/site/assets/app.js +++ b/site/assets/app.js @@ -8,7 +8,6 @@ const dialog = document.getElementById("copy-fallback"); const fallbackText = document.getElementById("fallback-text"); const closeFallback = document.getElementById("close-copy-fallback"); - const allKeysButton = document.getElementById("copy-all-keys"); const validThemes = new Set(["system", "light", "dark"]); const resetTimers = new WeakMap(); let fallbackTrigger = null; @@ -115,23 +114,5 @@ button.addEventListener("click", () => copy(target.textContent, button)); }); - let keys = []; - try { - const release = JSON.parse(document.getElementById("release-data")?.textContent || "{}"); - if (Array.isArray(release.keys) && release.keys.every((key) => typeof key.text === "string" && key.text.length > 0)) { - keys = release.keys.map((key) => key.text); - } - } catch { - // Prerendered content remains usable if release metadata is unavailable. - } - if (keys.length === 0) { - keys = Array.from(document.querySelectorAll(".key-card pre code"), (code) => code.textContent).filter(Boolean); - } - if (allKeysButton) { - allKeysButton.disabled = keys.length === 0; - if (keys.length === 0) allKeysButton.setAttribute("title", "暂无可复制的公钥"); - allKeysButton.addEventListener("click", () => copy(`${keys.join("\n")}\n`, allKeysButton)); - } - root.classList.add("enhanced"); })(); diff --git a/site/assets/style.css b/site/assets/style.css index 7fb22fc..a18a4eb 100644 --- a/site/assets/style.css +++ b/site/assets/style.css @@ -103,19 +103,16 @@ h1 { margin: 0; font-size: clamp(30px, 3.4vw, 42px); font-weight: 650; letter-sp .section-index { color: var(--subtle); font-size: 10px; margin: 0 0 8px; } .section-heading h2 { font-size: 23px; font-weight: 650; letter-spacing: -0.45px; line-height: 1.4; margin: 0; } .section-heading p:not(.section-index) { color: var(--muted); font-size: 12px; margin: 7px 0 0; max-width: 690px; } -.section-actions { display: flex; align-items: center; gap: 18px; flex-shrink: 0; padding-bottom: 2px; } +.section-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 18px; flex-shrink: 0; padding-bottom: 2px; } .text-link { white-space: nowrap; color: var(--muted); font-size: 12px; } .text-link span { margin-left: 4px; } .keys-notice { margin: 0 0 15px; padding: 12px 15px; border: 1px solid var(--line); border-radius: 8px; background: var(--surface-soft); color: var(--muted); font-size: 12px; } .keys-notice:empty { display: none; } -.key-list, .command-list { display: grid; gap: 14px; min-width: 0; } +.command-list { display: grid; gap: 14px; min-width: 0; } .command-list { grid-template-columns: repeat(2, minmax(0, 1fr)); } -.key-card, .command-card { min-width: 0; border: 1px solid var(--line); border-radius: 12px; background: var(--surface); overflow: hidden; } -.key-card { padding: 18px; } +.command-card { min-width: 0; border: 1px solid var(--line); border-radius: 12px; background: var(--surface); overflow: hidden; } .card-heading { display: flex; align-items: flex-start; gap: 12px; justify-content: space-between; min-width: 0; } .card-heading h3 { min-width: 0; overflow-wrap: anywhere; font-size: 13px; font-weight: 600; margin: 0; line-height: 1.65; } -.key-type { flex-shrink: 0; max-width: 40%; overflow-wrap: anywhere; border: 1px solid var(--line); background: var(--surface-soft); border-radius: 4px; padding: 1px 7px; color: var(--muted); font: 10px/1.6 ui-monospace, SFMono-Regular, Consolas, monospace; } -.fingerprint { color: var(--subtle); font: 11px/1.65 ui-monospace, SFMono-Regular, Consolas, monospace; margin: 6px 0 12px; overflow-wrap: anywhere; } .code-block { position: relative; min-width: 0; border: 1px solid var(--line); border-radius: 7px; background: var(--code); } pre { overflow-x: auto; margin: 0; padding: 14px 62px 14px 14px; white-space: pre; scrollbar-width: thin; scrollbar-color: var(--line) transparent; } code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace; font-size: 11px; line-height: 1.8; } @@ -129,8 +126,6 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Libe .copy-button[data-state="success"] { color: var(--accent); background: var(--accent-soft); border-color: var(--accent-line); } .copy-button[data-state="success"]::before { width: 7px; height: 13px; left: calc(var(--icon-center) - 4px); top: 8px; border: solid currentColor; border-width: 0 2px 2px 0; border-radius: 0; transform: rotate(45deg); } .copy-button[data-state="success"]::after { display: none; } -.copy-all { --icon-center: 19px; width: auto; gap: 8px; padding: 0 12px 0 38px; color: var(--accent); font-size: 12px; font-weight: 600; } -.copy-all:disabled { opacity: 0.55; } .public-notice { display: flex; align-items: flex-start; gap: 9px; margin-top: 15px; color: var(--subtle); font-size: 11px; } .public-notice p { margin: 0; } .notice-icon { display: grid; place-items: center; flex: 0 0 14px; height: 14px; margin-top: 2px; border: 1px solid var(--subtle); border-radius: 50%; font: 10px/1 serif; } @@ -143,6 +138,9 @@ code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Libe .advanced-commands summary::marker { color: var(--subtle); } .advanced-commands[open] summary { border-bottom: 1px solid var(--line); } .advanced-commands > .command-list { padding: 15px; } +.trust-steps { margin: 0; padding-left: 22px; color: var(--muted); font-size: 12px; } +.trust-steps li { padding-left: 4px; margin-block: 10px; } +.trust-steps a { color: var(--accent); } .command-note { font-size: 11px; color: var(--subtle); margin: 14px 0 0; } .empty-state { padding: 26px; border: 1px dashed var(--line); border-radius: 10px; color: var(--muted); text-align: center; } .preview-notice { margin: 24px 0 0; padding: 12px 16px; border: 1px solid var(--accent-line); border-radius: 8px; background: var(--accent-soft); color: var(--accent); font-size: 12px; } @@ -204,16 +202,14 @@ dialog::backdrop { background: rgb(10 22 15 / 52%); } .section-heading h2 { font-size: 21px; } .section-actions { width: 100%; justify-content: space-between; } .commands-section > .section-heading > .text-link { margin-top: -3px; } - .key-card, .command-card { padding: 14px; } + .command-card { padding: 14px; } .command-list { grid-template-columns: minmax(0, 1fr); gap: 12px; } .card-heading { gap: 8px; } - .fingerprint { font-size: 10px; } pre { padding-left: 12px; padding-block: 16px; } .copy-button { width: 40px; height: 40px; } .copy-button::before { top: 11px; } .copy-button::after { top: 15px; } .copy-button[data-state="success"]::before { top: 10px; } - .copy-all { width: auto; } .public-notice { font-size: 11px; } .site-footer { flex-direction: column; align-items: flex-start; gap: 12px; padding: 22px 0 26px; } dialog { padding: 20px; } @@ -224,5 +220,5 @@ dialog::backdrop { background: rgb(10 22 15 / 52%); } .page-shell { width: 100%; } .hero { padding-block: 24px; } pre { white-space: pre-wrap; overflow-wrap: anywhere; } - .key-card, .command-card { break-inside: avoid; } + .command-card { break-inside: avoid; } } diff --git a/site/index.html b/site/index.html index 5175c61..d4a3056 100644 --- a/site/index.html +++ b/site/index.html @@ -4,13 +4,13 @@ - -SSH KEY DISTRIBUTION
核对公钥，选择命令，配置 SSH。
查看当前公钥来源与内容版本，按需部署。
查看发布状态，选择命令，配置 SSH。
查看当前公钥来源与内容版本，按需部署。
01 / PUBLIC KEYS
部署前，请核对指纹及密钥归属。
01 / RELEASE STATUS
首页仅展示来源、状态、数量与内容摘要，不展示公钥列表、指纹或注释。
@@KEYS_NOTICE@@
-这里展示的是公开密钥。私钥应始终由你保管，本页面不会要求上传或输入私钥。
公钥不是秘密：原始 API 与公开 Git / Gist 仍可能提供公钥内容。私钥应留在离线环境，本页面不会要求上传或输入私钥。
02 / QUICK START
以下命令会在你执行后修改服务器配置。请先检查脚本，并保留当前 SSH 会话以验证新连接。
02 / QUICK START
首次安装的快捷命令会立即执行下载脚本。推荐先检查并独立核验安装脚本；高信任安装可按下方指引操作。修改 SSH 配置时保留当前会话以验证新连接。
每条命令独立使用。高级选项涉及 SSH 登录策略或卸载，请阅读说明后操作。
+每条命令独立使用。同步、预览及高级命令须先安装。脚本一旦落盘，日常同步不会替换可执行代码或本地信任指纹；更新脚本须在服务器重新安装。
03 / LOCAL TRUST
签名文件存在，不代表 Worker 已验证签名。客户端验签默认关闭，须在服务器本地明确启用。