Documentation
¶
Overview ¶
Package gitsshkey holds the SSH deploy key path for private git repos: key generation, strict pinned host key checking, and the go-git auth method. Nothing here shells out or writes the private key to disk.
Index ¶
- Constants
- Variables
- func AuthMethod(privatePEM []byte, pinnedHostKey string) (transport.AuthMethod, error)
- func DeployKeyAuth(ctx context.Context, s SecretReader, secretsKey string) (transport.AuthMethod, error)
- func Fingerprint(authorizedKey string) (string, error)
- func Host(repoURL string) (string, error)
- func HostKeyCallback(pinned string) (ssh.HostKeyCallback, error)
- func InstallGuard(o GuardOptions)
- func IsSSHURL(repoURL string) bool
- func NewGuardedTransport(o GuardOptions) transport.Transport
- func PublicKeyOf(privatePEM []byte) (string, error)
- func ScanHostKey(ctx context.Context, hostPort string, timeout time.Duration, allow []string) (string, error)
- type GuardOptions
- type Pair
- type SecretReader
Constants ¶
const ( PrivateKeyField = "ssh_private_key" HostKeyField = "ssh_host_key" )
Secret field names of an app's stored deploy key and pinned host key.
Variables ¶
var ErrAuthRequired = errors.New("gitsshkey: ssh repository needs a deploy key with a pinned host key")
ErrAuthRequired is returned for an ssh session with no deploy key, so the transport never falls back to the host's ssh-agent or known_hosts.
var ErrBlockedScanTarget = errors.New("gitsshkey: scan target is an internal address")
ErrBlockedScanTarget marks a host key scan refused because the resolved address is internal and not on the operator allowlist.
Functions ¶
func AuthMethod ¶
func AuthMethod(privatePEM []byte, pinnedHostKey string) (transport.AuthMethod, error)
AuthMethod builds the go-git auth for a clone: the deploy key held in memory plus the pinned host key check. User is "git" for every major forge.
func DeployKeyAuth ¶
func DeployKeyAuth(ctx context.Context, s SecretReader, secretsKey string) (transport.AuthMethod, error)
DeployKeyAuth loads the deploy key stored under secretsKey. No stored key is ErrAuthRequired; a stored but unreadable key is an error without detail.
func Fingerprint ¶
Fingerprint returns the SHA256 fingerprint of an authorized_keys line.
func Host ¶
Host returns the host:port an SSH repo URL dials, defaulting to port 22. It uses go-git's own endpoint parser so the scanner and the cloner always agree on the target.
func HostKeyCallback ¶
func HostKeyCallback(pinned string) (ssh.HostKeyCallback, error)
HostKeyCallback accepts only the pinned key(s). An empty pin is an error, never a fallback to accepting anything.
func InstallGuard ¶
func InstallGuard(o GuardOptions)
InstallGuard makes every go-git ssh fetch in the process go through the guarded transport, and removes the agent and ssh_config fallbacks.
func IsSSHURL ¶
IsSSHURL reports whether go-git would use its ssh transport for repoURL. It is deliberately broader than Host's validation so a malformed ssh URL still counts as ssh and cannot slip past a fail-closed auth check.
func NewGuardedTransport ¶
func NewGuardedTransport(o GuardOptions) transport.Transport
NewGuardedTransport wraps go-git's ssh transport: it requires an explicit deploy key with a pinned host key and dials only a checked, pinned address.
func PublicKeyOf ¶
PublicKeyOf derives the shareable public key from a stored private key.
func ScanHostKey ¶
func ScanHostKey(ctx context.Context, hostPort string, timeout time.Duration, allow []string) (string, error)
ScanHostKey fetches the server's host key for an explicit trust on first use. The caller records the returned key and shows its fingerprint. allow lists internal CIDRs or IPs the operator permits scanning.
Types ¶
type GuardOptions ¶
type GuardOptions struct {
// Allow lists internal IPs or CIDRs a fetch may reach, like ScanHostKey's.
Allow func() []string
// AllowPrivate opens loopback, private and CGNAT ranges; metadata stays refused.
AllowPrivate func() bool
ResolveTimeout time.Duration
// Next is the real ssh transport; tests replace it to observe sessions.
Next transport.Transport
}
GuardOptions configures the guarded ssh transport. Allow and AllowPrivate are read on every session so a settings change applies without a restart.
Source Files