adding ssh host signing

2026-07-11 16:20:21 +09:30
parent b5d6c790c4
commit 2e318fba00
24 changed files with 1626 additions and 90 deletions
@@ -0,0 +1,14 @@
+// fleet-ssh-hostcert — boot-time SSH host-certificate client (post-switch-root).
+// Gets the host's per-boot ephemeral SSH host key signed by the fleet SSH CA via
+// the enrol-broker host plane, authenticating with the TPM identity over mTLS —
+// so admins trust every host via one `@cert-authority` line instead of per-boot
+// TOFU (closes F-02 / POA&M P-17). Pure Go (go-tpm, no CGO), one static
+// reproducible binary like fleet-enrol/fleet-agent; deps pinned by go.sum.
+// See docs/ssh-host-certificate-design.md and files/ssh-hostcert/README.md.
+module fleet-ssh-hostcert
+
+go 1.26
+
+require github.com/google/go-tpm v0.9.8
+
+require golang.org/x/sys v0.8.0 // indirect