Documentation
¶
Overview ¶
Package ssh implements the local mechanics behind the SSH access commands: generating a keypair, writing the managed ~/.ssh/config block, signing a certificate against the REST API, and relaying a connection through the SSH proxy. It handles both inference model and training job workloads, mirroring truss's proxy_command.py, and holds no knowledge of the command harness: callers pass in plain values and an API client.
Index ¶
- func EnsureKeypair() (keyPath string, reused bool, err error)
- func Proxy(ctx context.Context, hostname string, in io.Reader, out io.Writer) error
- func SafeProfileName(name string) bool
- func Sign(ctx context.Context, mgmt *client.ManagementClient, hostname string) (*managementapi.SignSSHCertificateResponse, error)
- func WriteConfig(keyPath, profile string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureKeypair ¶
EnsureKeypair generates an ed25519 keypair in the baseten SSH directory if none exists. It returns the private key path and whether an existing key was reused.
func Proxy ¶
Proxy connects to the SSH proxy for the workload named by hostname using the JWT cached by Sign, then relays between in and out until either side closes.
func SafeProfileName ¶
SafeProfileName reports whether name can be embedded as a bare token in the shell command lines of the SSH config without quoting. Allowlisting a conservative character set (rather than escaping) eliminates any shell injection surface and avoids POSIX-vs-cmd.exe quoting differences entirely: every allowed character is a safe bare token in any shell. Names that fail this are not pinned into the config.
func Sign ¶
func Sign(ctx context.Context, mgmt *client.ManagementClient, hostname string) (*managementapi.SignSSHCertificateResponse, error)
Sign signs an SSH certificate for the workload named by hostname, writes the cert next to the private key, and caches the JWT and proxy address for the subsequent Proxy call.
func WriteConfig ¶
WriteConfig installs or refreshes the managed block in the SSH config. The generated config invokes `baseten ssh sign|proxy` (assuming baseten is on the PATH). When profile is non-empty it is passed as --default-profile so connections fall back to that profile unless --profile or BASETEN_PROFILE overrides it.
If the managed markers are present the block between them is replaced; otherwise it is appended. Either way, if any Host/Match line outside the managed block already targets *.ssh.baseten.co, the file is left untouched and an error is returned so we never clobber config another tool installed.
Types ¶
This section is empty.
Source Files