initial

2 files changed, 90 insertions, 0 deletions

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..909b444
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,74 @@
+SHELL = bash
+.DELETE_ON_ERROR: y
+SUDO != [ "$$(id -u)" = 0 ] || echo sudo
+
+.DEFAULT_TARGET = testall
+
+target = testfile
+
+signature = $(target).sig
+
+hostname != hostname
+identity = root@$(hostname)
+quoted_identity != printf %q $(identity)
+
+.PHONY: test validate
+
+testall: $(signature) check-novalidate find-principals verify
+
+validate: $(signature) verify
+
+testfile:
+        echo hello world > $@
+
+hostkey = /etc/ssh/ssh_host_ed25519_key
+key = $(hostkey)
+
+%.sig: % | /usr/bin/ssh-keygen
+        $(SUDO) ssh-keygen -n file -I $(quoted_identity) -f $(key) -Y sign $^
+        $(MAKE) verify
+
+dirs = $(dir $(hostkey))
+$(dirs):
+        mkdir -p $@
+
+$(hostkey): | /usr/sbin/sshd /usr/bin/ssh-keygen $(dir $(hostkey))
+        test -e $@ || $(SUDO) ssh-keygen -t ed25519 -N '' -f $@
+
+.PHONY: check-novalidate verify find-principals clean
+clean:
+        rm -f test test.sig
+check-novalidate: $(signature) | /usr/bin/ssh-keygen
+        ssh-keygen -n file -s $(signature) -f $(key).pub \
+          -Y $@ < $(target)
+
+find-principals: $(signature) | /usr/bin/ssh-keygen
+        ssh-keygen -n file -s $(signature) -f $(allowed) \
+          -Y $@ < $(target)
+
+allowed = <(printf '"%s" ' $(quoted_identity); cat $(key).pub)
+
+verify: | /usr/bin/ssh-keygen /usr/bin/basez
+        ssh-keygen -n file -I $(quoted_identity) -f $(allowed) -s $(signature) \
+          -Y $@ < $(target)
+        ssh-keygen -r . -f $(key).pub
+        ssh-keygen -e -f $(key).pub
+        ssh-keygen -t ed25519 -i -f <(ssh-keygen -e -f $(key).pub) | \
+          sed -ne 's/^ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI/I/p' | \
+          basez -d | tail -c32 | basez -x
+
+/usr/bin/apt:
+        $(warning Please install OpenSSH through your system package manager.)
+        @false
+
+apt_dep_bins = /usr/bin/ssh-keygen /usr/sbin/sshd
+apt_dep_bins += /usr/bin/basez
+#apt_dep_bins += /usr/bin/sipcalc
+
+apt_deps = openssh-client openssh-server
+apt_deps += basez
+#apt_deps += sipcalc
+
+$(apt_dep_bins): | /usr/bin/apt
+        $(SUDO) apt install --no-upgrade $(apt_deps)
+
diff --git a/extract-ed25519-pubkey b/extract-ed25519-pubkey
new file mode 100755
index 0000000..ed66db4
--- /dev/null
+++ b/extract-ed25519-pubkey
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+read_ssh_key()
+{
+    ssh-keygen -i -f <(ssh-keygen -e -f <(cat "$@"))
+}
+
+extract_ed25519()
+{
+    sed -ne 's/^ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI/I/p' |
+    basez -d | tail -c32 | basez -x
+}
+
+read_ssh_key "$@" | extract_ed25519