15 lines
677 B
AMPL
15 lines
677 B
AMPL
// fleet-ssh-hostcert — boot-time SSH host-certificate client (post-switch-root).
|
|
// Gets the host's per-boot ephemeral SSH host key signed by the fleet SSH CA via
|
|
// the enrol-broker host plane, authenticating with the TPM identity over mTLS —
|
|
// so admins trust every host via one `@cert-authority` line instead of per-boot
|
|
// TOFU (closes F-02 / POA&M P-17). Pure Go (go-tpm, no CGO), one static
|
|
// reproducible binary like fleet-enrol/fleet-agent; deps pinned by go.sum.
|
|
// See docs/ssh-host-certificate-design.md and files/ssh-hostcert/README.md.
|
|
module fleet-ssh-hostcert
|
|
|
|
go 1.26
|
|
|
|
require github.com/google/go-tpm v0.9.8
|
|
|
|
require golang.org/x/sys v0.8.0 // indirect
|