Add Go implementation of sshsignhost #1

Merged

benvin merged 4 commits from benvin/scaffold-sshsignhost into main 2026-09-19 12:46:03 +10:00

Conversation 0 Commits 4 Files Changed 19

+1885 -1

unkin-agent commented 2026-09-19 10:35:10 +10:00

Member

Copy Link

Copy Source

Puppet calls sshsignhost through generate() with combine: true, so the Python helper's stderr prints corrupt the JSON parsejson() reads, and its missing HTTP timeouts let a black-holed Vault hang a catalog compile forever.

• sign SSH host certificates via Vault approle or kubernetes auth
• emit only {"signed_key": ...} on stdout, errors on stderr, non-zero exit
• forward valid_principals to Vault unsplit; bound every call by a timeout
• keep TLS verification skippable via tls_skip_verify (default true)
• release with goreleaser: RPM at /usr/local/bin plus raw binaries and checksums on the Gitea release, RPM pushed to artifactapi on a v* tag
• sign a host key against a dev-mode Vault in CI and via make integration-test

Puppet calls sshsignhost through generate() with combine: true, so the Python helper's stderr prints corrupt the JSON parsejson() reads, and its missing HTTP timeouts let a black-holed Vault hang a catalog compile forever. - sign SSH host certificates via Vault approle or kubernetes auth - emit only {"signed_key": ...} on stdout, errors on stderr, non-zero exit - forward valid_principals to Vault unsplit; bound every call by a timeout - keep TLS verification skippable via tls_skip_verify (default true) - release with goreleaser: RPM at /usr/local/bin plus raw binaries and checksums on the Gitea release, RPM pushed to artifactapi on a v* tag - sign a host key against a dev-mode Vault in CI and via make integration-test

unkin-agent added 1 commit 2026-09-19 10:35:10 +10:00

Add Go implementation of sshsignhost ... 67426b9e6e

Puppet's generate() splices stderr into stdout, so the Python helper's
error prints and its absent HTTP timeouts can corrupt a catalog compile or
hang it forever.

- sign SSH host certificates via Vault approle or kubernetes auth
- emit only {"signed_key": ...} on stdout, errors on stderr, non-zero exit
- forward valid_principals to Vault unsplit; bound every call by a timeout
- keep TLS verification skippable via tls_skip_verify (default true)
- package the binary and completions as an RPM; add PR and tag pipelines

unkin-agent added 1 commit 2026-09-19 12:13:42 +10:00

Drive releases with goreleaser and test against a real Vault ... fde942d831

Replace the nfpm/build-rpm.sh release path with a single goreleaser
config producing the RPM, the raw sshsignhost-<os>-<arch> binaries the
puppetserver-compiler initContainer fetches, tarballs and checksums; the
tag pipeline runs goreleaser then PUTs the RPM to artifactapi.

Add an integration suite behind the 'integration' build tag that
provisions an ssh CA mount, host role and approle on a dev-mode Vault
and signs a host key through the built binary with Puppet's exact argv,
asserting an empty stderr and a decoded host certificate.

unkin-agent added 1 commit 2026-09-19 12:18:10 +10:00

Declare the vault service port and bound integration HTTP calls 36c506918d

unkin-agent added 1 commit 2026-09-19 12:34:11 +10:00

Run dev-mode Vault inside the integration step f2389b49a7

benvin merged commit 057d0cd2c8 into main 2026-09-19 12:46:03 +10:00

benvin deleted branch benvin/scaffold-sshsignhost 2026-09-19 12:46:03 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/sshsignhost#1