f6605653 — eitri

Makefile

Old		New
@@ -40,6 +40,7 @@ build: web
40	go build $(GO_LDFLAGS) -o $(BIN)/eitri-mcp ./cmd/eitri-mcp	40	go build $(GO_LDFLAGS) -o $(BIN)/eitri-mcp ./cmd/eitri-mcp
41	go build $(GO_LDFLAGS) -o $(BIN)/eitri-smoke ./cmd/eitri-smoke	41	go build $(GO_LDFLAGS) -o $(BIN)/eitri-smoke ./cmd/eitri-smoke
42	go build $(GO_LDFLAGS) -o $(BIN)/eitri-site ./cmd/eitri-site	42	go build $(GO_LDFLAGS) -o $(BIN)/eitri-site ./cmd/eitri-site
		43	go build $(GO_LDFLAGS) -o $(BIN)/eitri ./cmd/eitri
43		44
44	test:	45	test:
45	go test -race ./...	46	go test -race ./...

README.md

Old		New
@@ -45,7 +45,7 @@ create), and a content-addressed image cache (each base image is downloaded and
45	\| `eitri-server` \| Control plane: HTTP API, QUIC sync stream, and the SSH-CA jump gate. \|	45	\| `eitri-server` \| Control plane: HTTP API, QUIC sync stream, and the SSH-CA jump gate. \|
46	\| `eitri-agent` \| Host agent: enrolls a host, reconciles its VMs, drives cloud-hypervisor. \|	46	\| `eitri-agent` \| Host agent: enrolls a host, reconciles its VMs, drives cloud-hypervisor. \|
47	\| `eitri-mcp` \| MCP server exposing create/control/destroy VM tools to Claude. \|	47	\| `eitri-mcp` \| MCP server exposing create/control/destroy VM tools to Claude. \|
48	\| `hack/eitri-ssh` \| Client that signs an ephemeral cert with a tenant CA and reaches a guest through the gate. \|	48	\| `eitri` \| Client CLI: signs an ephemeral cert with a tenant CA and reaches a guest through the gate. \|
49		49
50	`eitri-shape` (regenerate the architecture graph) rounds out the binaries.	50	`eitri-shape` (regenerate the architecture graph) rounds out the binaries.
51		51
@@ -56,10 +56,10 @@ its own isolated namespace with its own SSH user CA — eitri holds no tenant us
56	signing key. You reach a guest by name:	56	signing key. You reach a guest by name:
57		57
58	```	58	```
59	eitri-ssh <tenant>.<vm-name>	59	eitri ssh <vm-name>
60	```	60	```
61		61
62	`eitri-ssh` self-signs a short-lived certificate with your tenant's user CA and	62	`eitri ssh` self-signs a short-lived certificate with your tenant's user CA and
63	jumps through the server's gate, which authorizes the connection against the	63	jumps through the server's gate, which authorizes the connection against the
64	tenant derived from the signing CA. Guest host certificates are namespaced the	64	tenant derived from the signing CA. Guest host certificates are namespaced the
65	same way, so names never collide across tenants.	65	same way, so names never collide across tenants.

cmd/eitri/main.go

@@ @@ -0,0 +1,86 @@ @@
+// Command eitri is the end-user client: SSH into fleet VMs through the
+// jump gate with self-signed short-lived certs (eitri ssh) and register
+// tenant user CAs (eitri ca upload). See internal/cli and docs/ssh-access.md.
+package main
+import (
+	"context"
+	"fmt"
+	"os"
+	"github.com/a73x/eitri/internal/cli"
+	"github.com/a73x/eitri/internal/version"
+)
+const usage = `usage:
+  eitri ssh <vm> [ssh args / remote command...]
+  eitri ca upload [<tenant>] <ca-public-key-file>
+  eitri --version
+env: EITRI_URL, EITRI_GATE (required for ssh); EITRI_TOKEN (required for ca);
+     EITRI_CA, EITRI_TENANT, EITRI_KEY, EITRI_KNOWN_HOSTS (optional)`
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "--version" {
+		fmt.Println(version.Version)
+		return
+	}
+	if len(os.Args) < 2 {
+		fmt.Fprintln(os.Stderr, usage)
+		os.Exit(2)
+	}
+	var err error
+	switch os.Args[1] {
+	case "ssh":
+		err = runSSH(os.Args[2:])
+	case "ca":
+		err = runCA(os.Args[2:])
+	default:
+		fmt.Fprintln(os.Stderr, usage)
+		os.Exit(2)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "eitri:", err)
+		os.Exit(1)
+	}
+}
+func runSSH(args []string) error {
+	if len(args) >= 1 && (args[0] == "-h" || args[0] == "--help") {
+		fmt.Println("usage: eitri ssh <vm> [ssh args / remote command...]")
+		return nil
+	}
+	if len(args) < 1 {
+		return fmt.Errorf("usage: eitri ssh <vm> [ssh args / remote command...]")
+	}
+	env, err := cli.FromEnv()
+	if err != nil {
+		return err
+	}
+	return cli.RunSSH(context.Background(), env, args[0], args[1:])
+}
+func runCA(args []string) error {
+	if len(args) < 1 || args[0] != "upload" {
+		return fmt.Errorf("usage: eitri ca upload [<tenant>] <ca-public-key-file>")
+	}
+	rest := args[1:]
+	if len(rest) < 1 || len(rest) > 2 {
+		return fmt.Errorf("usage: eitri ca upload [<tenant>] <ca-public-key-file>")
+	}
+	tenant, pub := "default", rest[0]
+	if len(rest) == 2 {
+		tenant, pub = rest[0], rest[1]
+	}
+	url := os.Getenv("EITRI_URL")
+	token := os.Getenv("EITRI_TOKEN")
+	if url == "" || token == "" {
+		return fmt.Errorf("set EITRI_URL and EITRI_TOKEN (admin bearer token)")
+	}
+	out, err := cli.UploadUserCA(context.Background(), url, token, tenant, pub)
+	if err != nil {
+		return err
+	}
+	fmt.Println(out)
+	return nil
+}

docs/credential-revocation.md

Old		New
@@ -44,7 +44,7 @@ mechanism.
44		44
45	Guest SSH access uses short-lived certificates self-signed with a tenant's own	45	Guest SSH access uses short-lived certificates self-signed with a tenant's own
46	user CA (see [ssh-access.md](ssh-access.md)) — eitri holds no user signing key.	46	user CA (see [ssh-access.md](ssh-access.md)) — eitri holds no user signing key.
47	The short validity you sign with (`eitri-ssh` uses 30 minutes) is the	47	The short validity you sign with (`eitri ssh` uses 30 minutes) is the
48	first line of defense: a leaked cert expires on its own.	48	first line of defense: a leaked cert expires on its own.
49		49
50	Before it does, a specific cert can be revoked at the gate by serial	50	Before it does, a specific cert can be revoked at the gate by serial

docs/quickstart.md

Old		New
@@ -15,9 +15,9 @@ manage them by hand instead, disable it in `/etc/default/eitri-agent`:
15		15
16	Tarballs live at <https://eitri.sh/dl/latest/>. The host bundle	16	Tarballs live at <https://eitri.sh/dl/latest/>. The host bundle
17	(`eitri_<version>_linux_amd64.tar.gz`) has `eitri-server`, `eitri-agent`, and	17	(`eitri_<version>_linux_amd64.tar.gz`) has `eitri-server`, `eitri-agent`, and
18	the agent's systemd unit. The client bundle (`eitri-ssh_<version>.tar.gz`)	18	the agent's systemd unit. The client bundle
19	has `eitri-ssh` and `eitri-ca` for your laptop. arm64 boxes take the arm64	19	(`eitri-cli_<version>_<os>_<arch>.tar.gz`) is the single `eitri` binary for
20	bundle.	20	your laptop, built for linux and macOS. arm64 boxes take the arm64 bundle.
21		21
22	## The server	22	## The server
23		23
@@ -99,14 +99,14 @@ VMs trust your SSH CA from birth, so register one first. eitri gets the
99	public key, never the private one. On your laptop:	99	public key, never the private one. On your laptop:
100		100
101	```sh	101	```sh
102	tar xzf eitri-ssh_*.tar.gz	102	tar xzf eitri-cli__$(uname -s \| tr A-Z a-z)_.tar.gz
103	sudo install -m 0755 eitri-ssh_/eitri-ssh eitri-ssh_/eitri-ca /usr/local/bin/	103	sudo install -m 0755 eitri-cli_*/eitri /usr/local/bin/eitri
104		104
105	export EITRI_URL=http://192.0.2.10:8080	105	export EITRI_URL=http://192.0.2.10:8080
106	export EITRI_TOKEN=<console-login-token>	106	export EITRI_TOKEN=<console-login-token>
107		107
108	ssh-keygen -t ed25519 -N '' -f ~/.ssh/eitri_user_ca -C "my eitri user CA"	108	ssh-keygen -t ed25519 -N '' -f ~/.ssh/eitri_user_ca -C "my eitri user CA"
109	eitri-ca upload default ~/.ssh/eitri_user_ca.pub	109	eitri ca upload default ~/.ssh/eitri_user_ca.pub
110	```	110	```
111		111
112	+ Create VM, pick a host, create. Defaults: 2 vCPUs, 2048 MB, 10 GB, the	112	+ Create VM, pick a host, create. Defaults: 2 vCPUs, 2048 MB, 10 GB, the
@@ -118,11 +118,11 @@ guest boots, then `ready`. Power reads `running`, an IP appears, you're on.
118	```sh	118	```sh
119	export EITRI_GATE=192.0.2.10:2222 # must match ssh_gate_domain	119	export EITRI_GATE=192.0.2.10:2222 # must match ssh_gate_domain
120		120
121	eitri-ssh <vm-name>	121	eitri ssh <vm-name>
122	eitri-ssh <vm-name> uptime	122	eitri ssh <vm-name> uptime
123	```	123	```
124		124
125	`eitri-ssh` is plain ssh in a trenchcoat: it signs a short-lived cert with	125	`eitri ssh` is plain ssh in a trenchcoat: it signs a short-lived cert with
126	your CA, pins eitri's host CA, and jumps the gate to	126	your CA, pins eitri's host CA, and jumps the gate to
127	`ubuntu@default.<vm-name>`. No token. [ssh-access.md](ssh-access.md) shows it	127	`ubuntu@default.<vm-name>`. No token. [ssh-access.md](ssh-access.md) shows it
128	done by hand.	128	done by hand.

docs/shape.html

Old		New
@@ -53,6 +53,15 @@
53	"module": "github.com/a73x/eitri",	53	"module": "github.com/a73x/eitri",
54	"packages": [	54	"packages": [
55	{	55	{
		56	"importPath": "cmd/eitri",
		57	"plane": "binaries",
		58	"synopsis": "Command eitri is the end-user client: SSH into fleet VMs through the jump gate with self-signed short-lived certs (eitri ssh) and register tenant user CAs (eitri ca upload).",
		59	"imports": [
		60	"internal/cli",
		61	"internal/version"
		62	]
		63	},
		64	{
56	"importPath": "cmd/eitri-agent",	65	"importPath": "cmd/eitri-agent",
57	"plane": "binaries",	66	"plane": "binaries",
58	"synopsis": "eitri-agent: BYO-hardware agent.",	67	"synopsis": "eitri-agent: BYO-hardware agent.",
@@ -266,6 +275,14 @@
266	"imports": []	275	"imports": []
267	},	276	},
268	{	277	{
		278	"importPath": "internal/cli",
		279	"plane": "tooling",
		280	"synopsis": "Package cli implements the eitri client binary: self-signed short-lived SSH certs with the tenant's own user CA, host verification pinned to eitri's host CA, sessions through the system ssh, and tenant CA registration.",
		281	"imports": [
		282	"internal/server/api/client"
		283	]
		284	},
		285	{
269	"importPath": "internal/cloudinit",	286	"importPath": "internal/cloudinit",
270	"plane": "wire",	287	"plane": "wire",
271	"synopsis": "Package cloudinit merges eitri's structured VM inputs into user-supplied cloud-init user-data.",	288	"synopsis": "Package cloudinit merges eitri's structured VM inputs into user-supplied cloud-init user-data.",
@@ -345,7 +362,7 @@
345	{	362	{
346	"importPath": "internal/server/api/client",	363	"importPath": "internal/server/api/client",
347	"plane": "control",	364	"plane": "control",
348	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server, smoke gate) goes through.",	365	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server, smoke gate, CLI) goes through.",
349	"imports": [	366	"imports": [
350	"internal/server/api/types"	367	"internal/server/api/types"
351	]	368	]

docs/shape.json

Old		New
@@ -2,6 +2,15 @@
2	"module": "github.com/a73x/eitri",	2	"module": "github.com/a73x/eitri",
3	"packages": [	3	"packages": [
4	{	4	{
		5	"importPath": "cmd/eitri",
		6	"plane": "binaries",
		7	"synopsis": "Command eitri is the end-user client: SSH into fleet VMs through the jump gate with self-signed short-lived certs (eitri ssh) and register tenant user CAs (eitri ca upload).",
		8	"imports": [
		9	"internal/cli",
		10	"internal/version"
		11	]
		12	},
		13	{
5	"importPath": "cmd/eitri-agent",	14	"importPath": "cmd/eitri-agent",
6	"plane": "binaries",	15	"plane": "binaries",
7	"synopsis": "eitri-agent: BYO-hardware agent.",	16	"synopsis": "eitri-agent: BYO-hardware agent.",
@@ -215,6 +224,14 @@
215	"imports": []	224	"imports": []
216	},	225	},
217	{	226	{
		227	"importPath": "internal/cli",
		228	"plane": "tooling",
		229	"synopsis": "Package cli implements the eitri client binary: self-signed short-lived SSH certs with the tenant's own user CA, host verification pinned to eitri's host CA, sessions through the system ssh, and tenant CA registration.",
		230	"imports": [
		231	"internal/server/api/client"
		232	]
		233	},
		234	{
218	"importPath": "internal/cloudinit",	235	"importPath": "internal/cloudinit",
219	"plane": "wire",	236	"plane": "wire",
220	"synopsis": "Package cloudinit merges eitri's structured VM inputs into user-supplied cloud-init user-data.",	237	"synopsis": "Package cloudinit merges eitri's structured VM inputs into user-supplied cloud-init user-data.",
@@ -294,7 +311,7 @@
294	{	311	{
295	"importPath": "internal/server/api/client",	312	"importPath": "internal/server/api/client",
296	"plane": "control",	313	"plane": "control",
297	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server, smoke gate) goes through.",	314	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server, smoke gate, CLI) goes through.",
298	"imports": [	315	"imports": [
299	"internal/server/api/types"	316	"internal/server/api/types"
300	]	317	]

docs/ssh-access.md

Old		New
@@ -28,7 +28,7 @@ ssh-keygen -t ed25519 -N '' -f ~/.ssh/eitri_user_ca -C "my tenant user CA"
28		28
29	export EITRI_URL=https://eitri.example.com	29	export EITRI_URL=https://eitri.example.com
30	export EITRI_TOKEN=<admin-bearer-token>	30	export EITRI_TOKEN=<admin-bearer-token>
31	eitri-ca upload default ~/.ssh/eitri_user_ca.pub	31	eitri ca upload default ~/.ssh/eitri_user_ca.pub
32	```	32	```
33		33
34	The CA's private key never leaves your machine; the server stores only the	34	The CA's private key never leaves your machine; the server stores only the
@@ -42,12 +42,12 @@ tenant the signing CA was uploaded to.
42	export EITRI_URL=https://eitri.example.com	42	export EITRI_URL=https://eitri.example.com
43	export EITRI_GATE=eitri.example.com:2222 # the gate's ssh_listen address	43	export EITRI_GATE=eitri.example.com:2222 # the gate's ssh_listen address
44		44
45	eitri-ssh <vm-name> # opens a shell on the VM	45	eitri ssh <vm-name> # opens a shell on the VM
46	eitri-ssh <vm-name> uptime # runs a command and exits	46	eitri ssh <vm-name> uptime # runs a command and exits
47	```	47	```
48		48
49	You pass the bare `<vm-name>`. VMs are actually dialed by their **gate connect	49	You pass the bare `<vm-name>`. VMs are actually dialed by their **gate connect
50	name** `<tenant>.<vm-name>` (also the VM's host-cert principal); `eitri-ssh`	50	name** `<tenant>.<vm-name>` (also the VM's host-cert principal); `eitri ssh`
51	builds it from `EITRI_TENANT`.	51	builds it from `EITRI_TENANT`.
52		52
53	Environment variables:	53	Environment variables:
@@ -73,7 +73,7 @@ and pins it as `@cert-authority *` in a dedicated known_hosts file, and execs
73		73
74	## Manual flow	74	## Manual flow
75		75
76	The helper is a thin wrapper over three steps you can run by hand:	76	The client is a thin wrapper over three steps you can run by hand:
77		77
78	1. Self-sign a cert for your public key with your tenant CA — no server	78	1. Self-sign a cert for your public key with your tenant CA — no server
79	involved:	79	involved:
@@ -101,7 +101,7 @@ The helper is a thin wrapper over three steps you can run by hand:
101	## Certs are short-lived	101	## Certs are short-lived
102		102
103	Self-signed certs should carry a short validity (`-V +30m` above). When one	103	Self-signed certs should carry a short validity (`-V +30m` above). When one
104	expires, ssh is simply rejected — re-run `eitri-ssh` (or the signing step)	104	expires, ssh is simply rejected — re-run `eitri ssh` (or the signing step)
105	to refresh. A specific cert can also be revoked at the gate by serial before it	105	to refresh. A specific cert can also be revoked at the gate by serial before it
106	expires; see [credential-revocation.md](credential-revocation.md).	106	expires; see [credential-revocation.md](credential-revocation.md).
107		107
@@ -139,7 +139,7 @@ The gate's cert principal is `ssh_gate_domain` (so `$GATE_HOST` must match it),
139	and each VM's cert principal is its `<tenant>.<vm-name>` connect name (so the	139	and each VM's cert principal is its `<tenant>.<vm-name>` connect name (so the
140	inner `ubuntu@<tenant>.<vm-name>` host must match). Because verification is by	140	inner `ubuntu@<tenant>.<vm-name>` host must match). Because verification is by
141	CA, recycling a VM name or IP never produces a host-key-changed warning — the	141	CA, recycling a VM name or IP never produces a host-key-changed warning — the
142	new VM simply presents a fresh CA-signed cert for that name. `eitri-ssh`	142	new VM simply presents a fresh CA-signed cert for that name. `eitri ssh`
143	does all of this for you.	143	does all of this for you.
144		144
145	## Related	145	## Related

go.mod

Old		New
@@ -13,6 +13,7 @@ require (
13	github.com/yuin/goldmark v1.8.4	13	github.com/yuin/goldmark v1.8.4
14	golang.org/x/crypto v0.54.0	14	golang.org/x/crypto v0.54.0
15	golang.org/x/sync v0.20.0	15	golang.org/x/sync v0.20.0
		16	golang.org/x/term v0.45.0
16	google.golang.org/protobuf v1.36.11	17	google.golang.org/protobuf v1.36.11
17	gopkg.in/yaml.v3 v3.0.1	18	gopkg.in/yaml.v3 v3.0.1
18	modernc.org/sqlite v1.52.0	19	modernc.org/sqlite v1.52.0

hack/eitri-ca

Old		New
@@ -1,14 +0,0 @@
1	#!/usr/bin/env bash
2	# eitri-ca — register a BYO user-CA public key with a tenant.
3	# eitri-ca upload [<tenant>] <ca-public-key-file>
4	# Env: EITRI_URL, EITRI_TOKEN (admin). Tenant defaults to "default".
5	set -eu
6	[ "${1:-}" = upload ] \|\| { echo "usage: eitri-ca upload [<tenant>] <ca.pub>" >&2; exit 2; }
7	shift
8	if [ "$#" -eq 2 ]; then TENANT=$1; PUBFILE=$2; else TENANT=default; PUBFILE=$1; fi
9	: "${EITRI_URL:?}" "${EITRI_TOKEN:?}"
10	PUB=$(cat "$PUBFILE")
11	curl -fsS -X POST -H "Authorization: Bearer $EITRI_TOKEN" -H 'Content-Type: application/json' \
12	-d "{\"public_key\":$(printf '%s' "$PUB" \| python3 -c 'import json,sys;print(json.dumps(sys.stdin.read()))')}" \
13	"$EITRI_URL/api/v1/tenants/$TENANT/user-cas"
14	echo

hack/eitri-ssh

Old		New
@@ -1,141 +0,0 @@
1	#!/usr/bin/env bash
2	#
3	# eitri-ssh — self-sign a short-lived SSH user cert with YOUR OWN tenant user CA
4	# and SSH into a VM through the eitri jump gate in one shot. The server never
5	# mints user certs (and never sees your CA's private key) — it only holds the
6	# CA's public key, uploaded once via `eitri-ca upload`.
7	#
8	# Usage:
9	# eitri-ssh <vm-name> [extra ssh args/command...]
10	# eitri-ssh --help
11	#
12	# Environment:
13	# EITRI_URL Base URL of the eitri server (e.g. https://eitri.example.com)
14	# EITRI_GATE Jump gate address for `ssh -J` (e.g. eitri.example.com:2222)
15	# EITRI_CA Path to your tenant user-CA PRIVATE key (default ~/.ssh/eitri_user_ca)
16	# EITRI_TENANT Tenant your user CA was uploaded to (default "default")
17	# EITRI_KEY Optional path to the SSH private key (default ~/.ssh/id_ed25519)
18	# EITRI_KNOWN_HOSTS Optional eitri-managed known_hosts file
19	# (default ~/.ssh/eitri_known_hosts)
20	#
21	# The self-signed cert is written beside the key as "<key>-cert.pub", which
22	# OpenSSH auto-offers. The inner login user is always "ubuntu" (the cert
23	# principal); the outer gate hop accepts any username. Certs are short-lived —
24	# just re-run to refresh.
25	#
26	# VMs are dialed by their gate connect name <tenant>.<vm-name> (which is also
27	# the VM's host-cert principal); eitri-ssh builds it from EITRI_TENANT, so you
28	# pass just the bare <vm-name>.
29	#
30	# Host verification is by CERTIFICATE, not TOFU: the helper fetches eitri's HOST
31	# CA public key (from the same `/api/v1/ssh-ca` endpoint, now serving the host
32	# CA) and pins it as a `@cert-authority *` entry in a DEDICATED known_hosts file
33	# (never your main ~/.ssh/known_hosts — a wildcard cert authority there would
34	# trust eitri's CA for every host you ssh to). Both the gate hop and the VM hop
35	# are then verified against that CA with StrictHostKeyChecking=yes. See
36	# docs/ssh-access.md.
37
38	set -eu
39
40	usage() {
41	sed -n '3,19p' "$0" \| sed 's/^# \{0,1\}//'
42	exit "${1:-0}"
43	}
44
45	case "${1:-}" in
46	-h \| --help \| "") usage 0 ;;
47	esac
48
49	VM=$1
50	shift
51
52	: "${EITRI_URL:?set EITRI_URL to the eitri server base URL}"
53	: "${EITRI_GATE:?set EITRI_GATE to the jump gate host:port}"
54	KEY=${EITRI_KEY:-$HOME/.ssh/id_ed25519}
55	# A DEDICATED known_hosts for the `@cert-authority *` pin — deliberately NOT the
56	# user's main known_hosts, where a wildcard CA would apply to every ssh target.
57	KNOWN_HOSTS=${EITRI_KNOWN_HOSTS:-$HOME/.ssh/eitri_known_hosts}
58	: "${EITRI_CA:=$HOME/.ssh/eitri_user_ca}" # member's user-CA PRIVATE key
59	: "${EITRI_TENANT:=default}"
60
61	# json_field <name>: extract a top-level JSON string field from stdin. Uses jq
62	# when available, else a sed fallback. The capture is NON-GREEDY (`[^"]*`, not
63	# `.*`) so a multi-field body doesn't swallow through to the last quote.
64	# `[^"]*` is safe because the server's JSON string values contain no raw double
65	# quotes; `\n` escapes are unescaped so a multi-line value survives.
66	json_field() {
67	if command -v jq >/dev/null 2>&1; then
68	jq -r ".$1"
69	else
70	sed -n "s/.\"$1\"[[:space:]]:[[:space:]]\"$[^\"]$\".*/\1/p" \| sed 's/\\n/\n/g'
71	fi
72	}
73
74	# 1. Ensure a keypair exists.
75	if [ ! -f "$KEY" ]; then
76	echo "eitri-ssh: generating SSH key at $KEY" >&2
77	ssh-keygen -t ed25519 -N '' -f "$KEY" >/dev/null
78	fi
79
80	# 2. Self-sign a short-lived cert for our public key with OUR OWN user CA — no
81	# server mint involved. The server never sees (or holds) a user private key;
82	# it only ever saw the CA's PUBLIC key at `eitri-ca upload` time.
83	[ -f "$EITRI_CA" ] \|\| { echo "eitri-ssh: no user CA at $EITRI_CA (generate one and 'eitri-ca upload')" >&2; exit 1; }
84	ssh-keygen -s "$EITRI_CA" -I "$(whoami)@$(hostname)" -n ubuntu -V +30m "$KEY.pub" >/dev/null
85
86	# 3. Build the gate connect name <tenant>.<vm>. The gate resolves names WITHIN
87	# a tenant and each VM's host-cert principal is the namespaced name, so the
88	# connect name must carry the tenant prefix. The tenant is no longer told
89	# to us by a mint response — it's just EITRI_TENANT, since our CA already
90	# only signs for the one tenant it was uploaded to.
91	TARGET="$EITRI_TENANT.$VM"
92
93	# 4. Fetch the eitri HOST CA public key and pin it as a `@cert-authority *`
94	# entry so BOTH hops are verified by certificate (no TOFU). The CA endpoint
95	# is public (no token). We overwrite the dedicated known_hosts each run so
96	# it always reflects the current CA — this file holds nothing but the eitri
97	# pin.
98	ca_resp=$(curl -sS -w '\n%{http_code}' "$EITRI_URL/api/v1/ssh-ca")
99	ca_code=${ca_resp##*$'\n'}
100	ca_body=${ca_resp%$'\n'*}
101	if [ "$ca_code" != "200" ]; then
102	echo "eitri-ssh: fetch CA failed (HTTP $ca_code): $ca_body" >&2
103	exit 1
104	fi
105	ca=$(printf '%s' "$ca_body" \| json_field ca)
106	if [ -z "$ca" ] \|\| [ "$ca" = "null" ]; then
107	echo "eitri-ssh: could not extract CA key from response: $ca_body" >&2
108	exit 1
109	fi
110	mkdir -p "$(dirname "$KNOWN_HOSTS")"
111	# Trim any trailing newline the CA line carries, then write the single pin.
112	printf '@cert-authority * %s\n' "$(printf '%s' "$ca" \| tr -d '\r\n')" >"$KNOWN_HOSTS"
113
114	# 5. Hop through the gate to ubuntu@<vm>. Pass through any extra args/command.
115	#
116	# We do NOT use `ssh -J`: command-line `-o` options (host-key checking,
117	# known_hosts, key) reach ONLY the final hop, so on a machine with no tty the
118	# jump hop would fall back to the default policy. Instead we build an explicit
119	# ProxyCommand for the jump hop that carries the SAME host-key options as the
120	# final hop, so BOTH hops verify the presented host cert against the eitri CA
121	# with StrictHostKeyChecking=yes.
122	#
123	# The gate host cert's principal must match $GATE_HOST (eitri's
124	# ssh_gate_domain); each VM's host cert principal is its <tenant>.<vm-name>
125	# connect name, which eitri-ssh builds from EITRI_TENANT. A mismatch is a
126	# hard failure, not a prompt — that is the point.
127	GATE_HOST=${EITRI_GATE%%:*}
128	GATE_PORT=${EITRI_GATE##*:}
129	[ "$GATE_PORT" = "$EITRI_GATE" ] && GATE_PORT=22
130
131	PROXY="ssh -W %h:%p \
132	-o StrictHostKeyChecking=yes \
133	-o UserKnownHostsFile=$KNOWN_HOSTS \
134	-i $KEY -p $GATE_PORT ubuntu@$GATE_HOST"
135
136	exec ssh \
137	-o "ProxyCommand=$PROXY" \
138	-o StrictHostKeyChecking=yes \
139	-o "UserKnownHostsFile=$KNOWN_HOSTS" \
140	-i "$KEY" \
141	"ubuntu@$TARGET" "$@"

internal/arch/execwalk_test.go

Old		New
@@ -46,7 +46,13 @@ func TestExecViolationsDetectsWrappers(t *testing.T) {
46	})	46	})
47		47
48	t.Run("agent: allowed package is exempt and does not taint importers", func(t *testing.T) {	48	t.Run("agent: allowed package is exempt and does not taint importers", func(t *testing.T) {
49	allowed := map[string]bool{m + "/internal/agent/cloudhv": true}	49	allowed := map[string]bool{
		50	m + "/internal/agent/cloudhv": true,
		51	// internal/cli: interactive sessions must be the real OpenSSH
		52	// client (TTY, escapes, agent forwarding); internal/cli execs it
		53	// deliberately.
		54	m + "/internal/cli": true,
		55	}
50	v := execViolations(graph, m, "internal/agent/", allowed)	56	v := execViolations(graph, m, "internal/agent/", allowed)
51	// Includes the documented design decision: spawnhelper (a non-allowed	57	// Includes the documented design decision: spawnhelper (a non-allowed
52	// exec user) is reachable ONLY through cloudhv, so it is sanctioned by	58	// exec user) is reachable ONLY through cloudhv, so it is sanctioned by

internal/cli/ca.go

@@ @@ -0,0 +1,32 @@ @@
+package cli
+import (
+	"context"
+	"fmt"
+	"os"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+// UploadUserCA registers the tenant user-CA public key in pubFile with the
+// server (admin-authenticated). The key is parse-validated locally — garbage
+// is rejected before it leaves the machine — and the returned summary line
+// carries the locally computed fingerprint (identical to the server's echo:
+// both fingerprint the same key).
+func UploadUserCA(ctx context.Context, baseURL, token, tenant, pubFile string) (string, error) {
+	pub, err := os.ReadFile(pubFile)
+	if err != nil {
+		return "", err
+	}
+	pk, _, _, _, err := ssh.ParseAuthorizedKey(pub)
+	if err != nil {
+		return "", fmt.Errorf("%s: not an SSH public key: %w", pubFile, err)
+	}
+	c := &client.Client{BaseURL: baseURL, Token: token}
+	if err := c.UploadUserCA(ctx, tenant, string(pub)); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("registered user CA %s for tenant %s", ssh.FingerprintSHA256(pk), tenant), nil
+}

internal/cli/ca_test.go

@@ @@ -0,0 +1,81 @@ @@
+package cli
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"golang.org/x/crypto/ssh"
+)
+// A real (public) ed25519 key line — uploads are parse-validated locally.
+const testUserCALine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZ8BFXvSU9tCz3sm5uuXG8UXsRWCkEBHYBJk8OjJgeA me@laptop\n"
+func TestUploadUserCA(t *testing.T) {
+	var gotPath, gotAuth, gotKey string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotAuth = r.Header.Get("Authorization")
+		body, _ := io.ReadAll(r.Body)
+		var m map[string]string
+		json.Unmarshal(body, &m)
+		gotKey = m["public_key"]
+		w.Write([]byte(`{"fingerprint":"SHA256:server-echo"}`))
+	}))
+	defer srv.Close()
+	pub := filepath.Join(t.TempDir(), "ca.pub")
+	os.WriteFile(pub, []byte(testUserCALine), 0o644)
+	out, err := UploadUserCA(context.Background(), srv.URL, "tok123", "default", pub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotPath != "/api/v1/tenants/default/user-cas" || gotAuth != "Bearer tok123" {
+		t.Errorf("request: %s %s", gotPath, gotAuth)
+	}
+	if gotKey != testUserCALine {
+		t.Errorf("public_key = %q", gotKey)
+	}
+	// The summary line carries the LOCALLY computed fingerprint of the
+	// uploaded key (same value the server echoes) and the tenant.
+	pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testUserCALine))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out, ssh.FingerprintSHA256(pk)) || !strings.Contains(out, "default") {
+		t.Errorf("out = %q", out)
+	}
+}
+func TestUploadUserCAErrorSurfacesBody(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "tenant not found", http.StatusNotFound)
+	}))
+	defer srv.Close()
+	pub := filepath.Join(t.TempDir(), "ca.pub")
+	os.WriteFile(pub, []byte(testUserCALine), 0o644)
+	_, err := UploadUserCA(context.Background(), srv.URL, "t", "nope", pub)
+	if err == nil || !strings.Contains(err.Error(), "tenant not found") {
+		t.Fatalf("want body in error, got %v", err)
+	}
+}
+func TestUploadUserCARejectsGarbageLocally(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("garbage key must be rejected before any request leaves the machine")
+	}))
+	defer srv.Close()
+	pub := filepath.Join(t.TempDir(), "ca.pub")
+	os.WriteFile(pub, []byte("not a key at all\n"), 0o644)
+	_, err := UploadUserCA(context.Background(), srv.URL, "t", "default", pub)
+	if err == nil || !strings.Contains(err.Error(), "not an SSH public key") {
+		t.Fatalf("want local parse error, got %v", err)
+	}
+}

internal/cli/env.go

@@ @@ -0,0 +1,54 @@ @@
+// Package cli implements the eitri client binary: self-signed short-lived SSH
+// certs with the tenant's own user CA, host verification pinned to eitri's
+// host CA, sessions through the system ssh, and tenant CA registration. It is
+// the compiled successor of the hack/ scripts and keeps their env contract.
+// The crypto boundary is unchanged: eitri never sees a user private key.
+package cli
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+// Env is the client configuration, resolved from EITRI_* variables.
+type Env struct {
+	URL        string // server base URL (required)
+	Gate       string // gate host[:port] (required)
+	CA         string // tenant user-CA private key path
+	Tenant     string
+	Key        string // user SSH private key path
+	KnownHosts string // dedicated pin file — never the user's main known_hosts
+}
+// FromEnv resolves the env contract shared with the former scripts:
+// EITRI_URL and EITRI_GATE are required; the rest default under $HOME/.ssh.
+func FromEnv() (Env, error) {
+	e := Env{
+		URL:        os.Getenv("EITRI_URL"),
+		Gate:       os.Getenv("EITRI_GATE"),
+		CA:         os.Getenv("EITRI_CA"),
+		Tenant:     os.Getenv("EITRI_TENANT"),
+		Key:        os.Getenv("EITRI_KEY"),
+		KnownHosts: os.Getenv("EITRI_KNOWN_HOSTS"),
+	}
+	if e.URL == "" || e.Gate == "" {
+		return Env{}, fmt.Errorf("set EITRI_URL (server base URL) and EITRI_GATE (gate host:port)")
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return Env{}, err
+	}
+	def := func(p *string, name string) {
+		if *p == "" {
+			*p = filepath.Join(home, ".ssh", name)
+		}
+	}
+	def(&e.CA, "eitri_user_ca")
+	def(&e.Key, "id_ed25519")
+	def(&e.KnownHosts, "eitri_known_hosts")
+	if e.Tenant == "" {
+		e.Tenant = "default"
+	}
+	return e, nil
+}

internal/cli/env_test.go

@@ @@ -0,0 +1,41 @@ @@
+package cli
+import (
+	"path/filepath"
+	"testing"
+)
+func TestFromEnvDefaults(t *testing.T) {
+	t.Setenv("EITRI_URL", "http://192.0.2.10:8080")
+	t.Setenv("EITRI_GATE", "192.0.2.10:2222")
+	for _, v := range []string{"EITRI_CA", "EITRI_TENANT", "EITRI_KEY", "EITRI_KNOWN_HOSTS"} {
+		t.Setenv(v, "")
+	}
+	t.Setenv("HOME", "/home/u")
+	e, err := FromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e.URL != "http://192.0.2.10:8080" || e.Gate != "192.0.2.10:2222" {
+		t.Errorf("required fields: %+v", e)
+	}
+	for got, want := range map[string]string{
+		e.CA:         filepath.Join("/home/u", ".ssh", "eitri_user_ca"),
+		e.Tenant:     "default",
+		e.Key:        filepath.Join("/home/u", ".ssh", "id_ed25519"),
+		e.KnownHosts: filepath.Join("/home/u", ".ssh", "eitri_known_hosts"),
+	} {
+		if got != want {
+			t.Errorf("default: got %q want %q", got, want)
+		}
+	}
+}
+func TestFromEnvRequiresURLAndGate(t *testing.T) {
+	t.Setenv("EITRI_URL", "")
+	t.Setenv("EITRI_GATE", "")
+	if _, err := FromEnv(); err == nil {
+		t.Fatal("want error without EITRI_URL/EITRI_GATE")
+	}
+}

internal/cli/mint.go

@@ @@ -0,0 +1,158 @@ @@
+package cli
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/binary"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/term"
+)
+// EnsureKeypair generates an ed25519 keypair at keyPath (+ .pub) if absent.
+// An existing key is never touched. The private key is created O_EXCL so a
+// concurrent first run cannot interleave two generations; the .pub (a
+// convenience copy — minting and ssh derive the public key from the private
+// key) is written after, by whichever call won the create.
+func EnsureKeypair(keyPath string) error {
+	if _, err := os.Stat(keyPath); err == nil {
+		return nil
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return err
+	}
+	block, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(keyPath), 0o700); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if errors.Is(err, os.ErrExist) {
+		return nil // another eitri run won the race; its pair is authoritative
+	}
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(pem.EncodeToMemory(block)); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return err
+	}
+	fmt.Fprintf(os.Stderr, "eitri: generated SSH key at %s\n", keyPath)
+	return os.WriteFile(keyPath+".pub", ssh.MarshalAuthorizedKey(sshPub), 0o644)
+}
+// MintCert self-signs a short-lived user certificate for keyPath's public key
+// with the tenant user CA at caPath, writing <keyPath>-cert.pub (which
+// OpenSSH auto-offers). Mirrors internal/gateclient's mint, but for the
+// user's persistent key and on-disk cert rather than an in-memory ephemeral.
+// The five extensions are ssh-keygen's signing defaults — pty allocation
+// breaks without them.
+func MintCert(caPath, keyPath, keyID string) error {
+	raw, err := os.ReadFile(caPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return fmt.Errorf("no user CA at %s — generate one (ssh-keygen -t ed25519 -f %s) and register it with 'eitri ca upload'", caPath, caPath)
+		}
+		return err
+	}
+	signer, err := ssh.ParsePrivateKey(raw)
+	if err != nil {
+		var pmerr *ssh.PassphraseMissingError
+		if !errors.As(err, &pmerr) {
+			return fmt.Errorf("parse user CA %s: %w", caPath, err)
+		}
+		if !term.IsTerminal(int(os.Stdin.Fd())) {
+			return fmt.Errorf("user CA %s is passphrase-protected; run interactively to enter it", caPath)
+		}
+		fmt.Fprintf(os.Stderr, "passphrase for %s: ", caPath)
+		pw, perr := term.ReadPassword(int(os.Stdin.Fd()))
+		fmt.Fprintln(os.Stderr)
+		if perr != nil {
+			return perr
+		}
+		signer, err = ssh.ParsePrivateKeyWithPassphrase(raw, pw)
+		if err != nil {
+			return fmt.Errorf("parse user CA %s: %w", caPath, err)
+		}
+	}
+	pub, err := userPublicKey(keyPath)
+	if err != nil {
+		return err
+	}
+	var serial uint64
+	if err := binary.Read(rand.Reader, binary.BigEndian, &serial); err != nil {
+		return err
+	}
+	now := time.Now()
+	cert := &ssh.Certificate{
+		Key:             pub,
+		Serial:          serial,
+		CertType:        ssh.UserCert,
+		KeyId:           keyID,
+		ValidPrincipals: []string{"ubuntu"},
+		ValidAfter:      uint64(now.Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(now.Add(30 * time.Minute).Unix()),
+		Permissions: ssh.Permissions{Extensions: map[string]string{
+			"permit-X11-forwarding":   "",
+			"permit-agent-forwarding": "",
+			"permit-port-forwarding":  "",
+			"permit-pty":              "",
+			"permit-user-rc":          "",
+		}},
+	}
+	if err := cert.SignCert(rand.Reader, signer); err != nil {
+		return err
+	}
+	return os.WriteFile(keyPath+"-cert.pub", ssh.MarshalAuthorizedKey(cert), 0o644)
+}
+// userPublicKey derives the user's public key from the private key at
+// keyPath, falling back to <keyPath>.pub when the private key is
+// passphrase-encrypted (ssh prompts for the passphrase itself at connect
+// time; minting only needs the public half).
+func userPublicKey(keyPath string) (ssh.PublicKey, error) {
+	keyRaw, err := os.ReadFile(keyPath)
+	if err != nil {
+		return nil, err
+	}
+	signer, err := ssh.ParsePrivateKey(keyRaw)
+	if err == nil {
+		return signer.PublicKey(), nil
+	}
+	var pmerr *ssh.PassphraseMissingError
+	if !errors.As(err, &pmerr) {
+		return nil, fmt.Errorf("parse %s: %w", keyPath, err)
+	}
+	if pmerr.PublicKey != nil { // openssh format embeds the public key unencrypted
+		return pmerr.PublicKey, nil
+	}
+	pubRaw, err := os.ReadFile(keyPath + ".pub")
+	if err != nil {
+		return nil, fmt.Errorf("%s is passphrase-encrypted and %s.pub is unreadable: %w", keyPath, keyPath, err)
+	}
+	pub, _, _, _, perr := ssh.ParseAuthorizedKey(pubRaw)
+	if perr != nil {
+		return nil, fmt.Errorf("parse %s.pub: %w", keyPath, perr)
+	}
+	return pub, nil
+}

internal/cli/mint_test.go

@@ @@ -0,0 +1,215 @@ @@
+package cli
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/pem"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+	"golang.org/x/crypto/ssh"
+)
+// newCA writes an unencrypted ed25519 CA private key and returns its path
+// and public key.
+func newCA(t *testing.T) (string, ssh.PublicKey) {
+	t.Helper()
+	dir := t.TempDir()
+	caPath := filepath.Join(dir, "ca")
+	if err := EnsureKeypair(caPath); err != nil {
+		t.Fatal(err)
+	}
+	pub, err := os.ReadFile(caPath + ".pub")
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, _, _, _, err := ssh.ParseAuthorizedKey(pub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return caPath, k
+}
+func TestEnsureKeypairGeneratesOnceAndParses(t *testing.T) {
+	key := filepath.Join(t.TempDir(), "id_ed25519")
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	priv1, err := os.ReadFile(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ssh.ParsePrivateKey(priv1); err != nil {
+		t.Fatalf("generated key unparsable: %v", err)
+	}
+	if fi, _ := os.Stat(key); fi.Mode().Perm() != 0o600 {
+		t.Errorf("key mode = %v", fi.Mode().Perm())
+	}
+	// Second call must not touch the existing key.
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	priv2, _ := os.ReadFile(key)
+	if string(priv1) != string(priv2) {
+		t.Error("EnsureKeypair overwrote an existing key")
+	}
+}
+func TestMintCertShape(t *testing.T) {
+	caPath, caPub := newCA(t)
+	key := filepath.Join(t.TempDir(), "id_ed25519")
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	if err := MintCert(caPath, key, "tester@box"); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(key + "-cert.pub")
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, _, _, _, err := ssh.ParseAuthorizedKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cert, ok := k.(*ssh.Certificate)
+	if !ok {
+		t.Fatalf("not a certificate: %T", k)
+	}
+	if cert.CertType != ssh.UserCert || cert.KeyId != "tester@box" {
+		t.Errorf("type/keyid: %v %q", cert.CertType, cert.KeyId)
+	}
+	if len(cert.ValidPrincipals) != 1 || cert.ValidPrincipals[0] != "ubuntu" {
+		t.Errorf("principals: %v", cert.ValidPrincipals)
+	}
+	now := time.Now().Unix()
+	if int64(cert.ValidAfter) > now || int64(cert.ValidBefore) < now+25*60 || int64(cert.ValidBefore) > now+35*60 {
+		t.Errorf("validity window: after=%d before=%d now=%d", cert.ValidAfter, cert.ValidBefore, now)
+	}
+	for _, ext := range []string{"permit-X11-forwarding", "permit-agent-forwarding", "permit-port-forwarding", "permit-pty", "permit-user-rc"} {
+		if _, ok := cert.Permissions.Extensions[ext]; !ok {
+			t.Errorf("missing extension %s (pty allocation breaks without defaults)", ext)
+		}
+	}
+	// Signed by OUR CA.
+	checker := ssh.CertChecker{IsUserAuthority: func(a ssh.PublicKey) bool {
+		return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(a))) ==
+			strings.TrimSpace(string(ssh.MarshalAuthorizedKey(caPub)))
+	}}
+	if err := checker.CheckCert("ubuntu", cert); err != nil {
+		t.Errorf("cert not accepted by its own CA: %v", err)
+	}
+}
+func TestMintCertMissingCA(t *testing.T) {
+	key := filepath.Join(t.TempDir(), "id_ed25519")
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	err := MintCert(filepath.Join(t.TempDir(), "nope"), key, "x")
+	if err == nil || !strings.Contains(err.Error(), "eitri ca upload") {
+		t.Fatalf("want actionable no-CA error, got %v", err)
+	}
+}
+func TestMintCertDerivesPubFromPrivateKey(t *testing.T) {
+	caPath, _ := newCA(t)
+	key := filepath.Join(t.TempDir(), "id_ed25519")
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	// A stale or missing .pub must not matter: the mint derives from the key.
+	if err := os.Remove(key + ".pub"); err != nil {
+		t.Fatal(err)
+	}
+	if err := MintCert(caPath, key, "x"); err != nil {
+		t.Fatalf("mint with missing .pub: %v", err)
+	}
+	raw, err := os.ReadFile(key + "-cert.pub")
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, _, _, _, err := ssh.ParseAuthorizedKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cert := k.(*ssh.Certificate)
+	priv, _ := os.ReadFile(key)
+	signer, _ := ssh.ParsePrivateKey(priv)
+	if string(cert.Key.Marshal()) != string(signer.PublicKey().Marshal()) {
+		t.Error("cert key does not match the private key on disk")
+	}
+}
+func TestMintCertEncryptedCANonInteractive(t *testing.T) {
+	dir := t.TempDir()
+	caPath := filepath.Join(dir, "ca")
+	_, priv, err := ed25519GenerateForTest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	block, err := ssh.MarshalPrivateKeyWithPassphrase(priv, "", []byte("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(caPath, pem.EncodeToMemory(block), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	key := filepath.Join(dir, "id_ed25519")
+	if err := EnsureKeypair(key); err != nil {
+		t.Fatal(err)
+	}
+	// Non-interactive stdin (go test): must fail fast with a helpful error,
+	// never hang on a passphrase prompt.
+	err = MintCert(caPath, key, "x")
+	if err == nil || !strings.Contains(err.Error(), "passphrase") {
+		t.Fatalf("want passphrase-protected error, got %v", err)
+	}
+}
+func TestMintCertEncryptedUserKeyUsesEmbeddedPublicKey(t *testing.T) {
+	caPath, _ := newCA(t)
+	dir := t.TempDir()
+	key := filepath.Join(dir, "id_ed25519")
+	pub, priv, err := ed25519GenerateForTest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Passphrase-encrypted USER key: minting must still work — the openssh
+	// format embeds the public key unencrypted, and only the public half is
+	// needed (ssh prompts for the passphrase itself at connect time).
+	block, err := ssh.MarshalPrivateKeyWithPassphrase(priv, "", []byte("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(key, pem.EncodeToMemory(block), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := MintCert(caPath, key, "x"); err != nil {
+		t.Fatalf("mint with encrypted user key: %v", err)
+	}
+	raw, err := os.ReadFile(key + "-cert.pub")
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, _, _, _, err := ssh.ParseAuthorizedKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(k.(*ssh.Certificate).Key.Marshal()) != string(sshPub.Marshal()) {
+		t.Error("cert key does not match the encrypted private key's public half")
+	}
+}
+func ed25519GenerateForTest() (ed25519.PublicKey, ed25519.PrivateKey, error) {
+	return ed25519.GenerateKey(rand.Reader)
+}

internal/cli/pin.go

@@ @@ -0,0 +1,43 @@ @@
+package cli
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+// WriteHostCAPin fetches eitri's host-CA public key (public endpoint) and
+// overwrites pinPath with the single `@cert-authority *` line. A dedicated
+// file, never the user's main known_hosts: a wildcard cert authority there
+// would trust eitri's CA for every host the user sshes to.
+func WriteHostCAPin(ctx context.Context, baseURL, pinPath string) error {
+	c := &client.Client{BaseURL: baseURL}
+	line, err := c.FetchSSHCALine(ctx)
+	if err != nil {
+		return err
+	}
+	// The client already parse-validated the line; this re-parse feeds the
+	// canonical re-marshal — one clean line whatever whitespace arrived —
+	// while preserving the server's comment (e.g. "eitri-host-ca").
+	caKey, comment, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+	if err != nil {
+		return fmt.Errorf("fetch host CA: not an SSH public key: %w", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(pinPath), 0o700); err != nil {
+		return err
+	}
+	marshaled := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(caKey)))
+	var pin string
+	if comment != "" {
+		pin = "@cert-authority * " + marshaled + " " + comment + "\n"
+	} else {
+		pin = "@cert-authority * " + marshaled + "\n"
+	}
+	return os.WriteFile(pinPath, []byte(pin), 0o644)
+}

internal/cli/pin_test.go

@@ @@ -0,0 +1,58 @@ @@
+package cli
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+)
+func TestWriteHostCAPin(t *testing.T) {
+	// A real (public) ed25519 key line — the pin now refuses unparsable CAs.
+	const caLine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZ8BFXvSU9tCz3sm5uuXG8UXsRWCkEBHYBJk8OjJgeA eitri-host-ca"
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/ssh-ca" {
+			http.NotFound(w, r)
+			return
+		}
+		json.NewEncoder(w).Encode(map[string]string{"ca": caLine + "\r\n"})
+	}))
+	defer srv.Close()
+	pin := filepath.Join(t.TempDir(), "sub", "eitri_known_hosts")
+	// Trailing-slash base URL must work too.
+	if err := WriteHostCAPin(context.Background(), srv.URL+"/", pin); err != nil {
+		t.Fatal(err)
+	}
+	got, err := os.ReadFile(pin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "@cert-authority * " + caLine + "\n"
+	if string(got) != want {
+		t.Errorf("pin = %q, want %q", got, want)
+	}
+	if err := WriteHostCAPin(context.Background(), srv.URL, pin); err != nil {
+		t.Fatal(err)
+	}
+	if b, _ := os.ReadFile(pin); string(b) != want {
+		t.Errorf("pin after rewrite = %q", b)
+	}
+}
+func TestWriteHostCAPinRejectsGarbage(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`{"ca":"not a key at all"}`))
+	}))
+	defer srv.Close()
+	pin := filepath.Join(t.TempDir(), "kh")
+	if err := WriteHostCAPin(context.Background(), srv.URL, pin); err == nil {
+		t.Fatal("want error for unparsable CA")
+	}
+	if _, err := os.Stat(pin); !os.IsNotExist(err) {
+		t.Error("garbage CA must not be written to the pin file")
+	}
+}

internal/cli/sshcmd.go

@@ @@ -0,0 +1,77 @@ @@
+package cli
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"os/user"
+	"strings"
+	"syscall"
+)
+// SSHArgv builds the system-ssh invocation for a session to <tenant>.<vm>.
+// The gate hop rides an explicit ProxyCommand — NOT -J — because command-line
+// -o options reach only the final hop; both hops must verify the presented
+// host certificate against the pinned eitri CA with strict checking. The
+// ProxyCommand value is run by the user's shell, so embedded paths are
+// single-quoted (spaced $HOME paths are normal on macOS). The vm name reaches
+// the shell via ssh's %h expansion; modern OpenSSH rejects hostnames with
+// shell metacharacters itself — that hardening, not this code, is what blocks
+// injection there. This argv shape is load-bearing; change it only with the
+// table tests.
+func SSHArgv(e Env, vm string, extra []string) []string {
+	gateHost, gatePort, err := net.SplitHostPort(e.Gate)
+	if err != nil {
+		gateHost, gatePort = e.Gate, "22"
+	}
+	proxy := fmt.Sprintf(
+		"ssh -W %%h:%%p -o StrictHostKeyChecking=yes -o UserKnownHostsFile=%s -i %s -p %s ubuntu@%s",
+		shq(e.KnownHosts), shq(e.Key), gatePort, gateHost)
+	argv := []string{
+		"ssh",
+		"-o", "ProxyCommand=" + proxy,
+		"-o", "StrictHostKeyChecking=yes",
+		"-o", "UserKnownHostsFile=" + e.KnownHosts,
+		"-i", e.Key,
+		"ubuntu@" + e.Tenant + "." + vm,
+	}
+	return append(argv, extra...)
+}
+// shq single-quotes s for POSIX shell word-splitting (ProxyCommand runs via
+// the user's shell).
+func shq(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+// keyID labels minted certs user@host, matching the scripts' -I value.
+func keyID() string {
+	name := "eitri"
+	if u, err := user.Current(); err == nil && u.Username != "" {
+		name = u.Username
+	}
+	host, _ := os.Hostname()
+	return name + "@" + host
+}
+// RunSSH prepares credentials (keypair, cert, host-CA pin) and replaces this
+// process with the system ssh. Exec (not a child process) so the TTY, signals,
+// and exit code belong to ssh itself.
+func RunSSH(ctx context.Context, e Env, vm string, extra []string) error {
+	if err := EnsureKeypair(e.Key); err != nil {
+		return err
+	}
+	if err := MintCert(e.CA, e.Key, keyID()); err != nil {
+		return err
+	}
+	if err := WriteHostCAPin(ctx, e.URL, e.KnownHosts); err != nil {
+		return err
+	}
+	sshPath, err := exec.LookPath("ssh")
+	if err != nil {
+		return fmt.Errorf("ssh not found on PATH — install an OpenSSH client")
+	}
+	return syscall.Exec(sshPath, SSHArgv(e, vm, extra), os.Environ())
+}

internal/cli/sshcmd_test.go

@@ @@ -0,0 +1,75 @@ @@
+package cli
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+func testEnv() Env {
+	return Env{
+		URL: "http://s:8080", Gate: "gate.example:2222", Tenant: "default",
+		Key: "/home/u/.ssh/id_ed25519", KnownHosts: "/home/u/.ssh/eitri_known_hosts",
+	}
+}
+// The argv shape is load-bearing (two verified hops); pin it exactly.
+func TestSSHArgvTwoVerifiedHops(t *testing.T) {
+	got := SSHArgv(testEnv(), "dev", nil)
+	wantProxy := "ssh -W %h:%p -o StrictHostKeyChecking=yes" +
+		" -o UserKnownHostsFile='/home/u/.ssh/eitri_known_hosts'" +
+		" -i '/home/u/.ssh/id_ed25519' -p 2222 ubuntu@gate.example"
+	want := []string{
+		"ssh",
+		"-o", "ProxyCommand=" + wantProxy,
+		"-o", "StrictHostKeyChecking=yes",
+		"-o", "UserKnownHostsFile=/home/u/.ssh/eitri_known_hosts",
+		"-i", "/home/u/.ssh/id_ed25519",
+		"ubuntu@default.dev",
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("argv:\n got %q\nwant %q", got, want)
+	}
+}
+func TestSSHArgvGateDefaultPort(t *testing.T) {
+	e := testEnv()
+	e.Gate = "gate.example"
+	got := SSHArgv(e, "dev", nil)
+	wantProxy := "ssh -W %h:%p -o StrictHostKeyChecking=yes" +
+		" -o UserKnownHostsFile='/home/u/.ssh/eitri_known_hosts'" +
+		" -i '/home/u/.ssh/id_ed25519' -p 22 ubuntu@gate.example"
+	if got[2] != "ProxyCommand="+wantProxy {
+		t.Errorf("proxy = %q, want %q", got[2], "ProxyCommand="+wantProxy)
+	}
+}
+func TestSSHArgvIPv6Gate(t *testing.T) {
+	e := testEnv()
+	e.Gate = "[::1]:2222"
+	got := SSHArgv(e, "dev", nil)
+	if want := " -p 2222 ubuntu@::1"; !slices.ContainsFunc(got, func(s string) bool {
+		return len(s) > len(want) && s[len(s)-len(want):] == want
+	}) {
+		t.Errorf("ipv6 gate not split host/port correctly: %q", got[2])
+	}
+}
+func TestSSHArgvSpacedPathsAreQuoted(t *testing.T) {
+	e := testEnv()
+	e.Key = "/Users/My Name/.ssh/id_ed25519"
+	got := SSHArgv(e, "dev", nil)
+	if want := "-i '/Users/My Name/.ssh/id_ed25519'"; !slices.ContainsFunc(got, func(s string) bool {
+		return strings.Contains(s, want)
+	}) {
+		t.Errorf("spaced key path not quoted in proxy: %q", got[2])
+	}
+}
+func TestSSHArgvExtraArgsPassThrough(t *testing.T) {
+	got := SSHArgv(testEnv(), "dev", []string{"uptime", "-p"})
+	n := len(got)
+	if got[n-2] != "uptime" || got[n-1] != "-p" {
+		t.Errorf("extra args not trailing: %v", got[n-3:])
+	}
+}

internal/server/api/client/client.go

Old		New
@@ -1,8 +1,8 @@
1	// Package client is THE Go client for the eitri control-plane HTTP API — the	1	// Package client is THE Go client for the eitri control-plane HTTP API — the
2	// one consumer every in-repo caller (MCP server, smoke gate) goes through.	2	// one consumer every in-repo caller (MCP server, smoke gate, CLI) goes
3	// Its method set is exactly what those consumers use, nothing more: a new	3	// through. Its method set is exactly what those consumers use, nothing more:
4	// endpoint call starts by adding a method here (an arch fitness rule enforces	4	// a new endpoint call starts by adding a method here (an arch fitness rule
5	// that no other package speaks the API's HTTP directly).	5	// enforces that no other package speaks the API's HTTP directly).
6	//	6	//
7	// The wire shapes come from internal/server/api/types; the ones consumers	7	// The wire shapes come from internal/server/api/types; the ones consumers
8	// need are re-exported as aliases so callers import only this package.	8	// need are re-exported as aliases so callers import only this package.

internal/server/api/client/client_test.go

Old		New
@@ -22,7 +22,7 @@ import (
22	var _ gateclient.CertAuthority = (*client.Client)(nil)	22	var _ gateclient.CertAuthority = (*client.Client)(nil)
23		23
24	// testCALine is a valid ed25519 authorized_keys line WITH a trailing comment;	24	// testCALine is a valid ed25519 authorized_keys line WITH a trailing comment;
25	// FetchSSHCALine must return it verbatim.	25	// FetchSSHCALine must return it verbatim (the cli's pin file keeps the comment).
26	const testCALine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZK1zVJTG0Opn0BktxOpCYhRXRPMFhZDwoT1PVCM1Sq eitri-host-ca"	26	const testCALine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZK1zVJTG0Opn0BktxOpCYhRXRPMFhZDwoT1PVCM1Sq eitri-host-ca"
27		27
28	// capture records what the handler saw so tests can assert on the request.	28	// capture records what the handler saw so tests can assert on the request.

internal/shape/classify.go

Old		New
@@ -45,7 +45,8 @@ func classify(rel string) Plane {
45	strings.HasPrefix(rel, "internal/covsnap"),	45	strings.HasPrefix(rel, "internal/covsnap"),
46	strings.HasPrefix(rel, "internal/gateclient"),	46	strings.HasPrefix(rel, "internal/gateclient"),
47	strings.HasPrefix(rel, "internal/site"),	47	strings.HasPrefix(rel, "internal/site"),
48	strings.HasPrefix(rel, "internal/shape"):	48	strings.HasPrefix(rel, "internal/shape"),
		49	strings.HasPrefix(rel, "internal/cli"):
49	return PlaneTooling	50	return PlaneTooling
50	default:	51	default:
51	return PlaneUnclassified	52	return PlaneUnclassified

scripts/coverage.sh

Old		New
@@ -39,6 +39,7 @@ declare -A FLOOR=(
39	[internal/transport]=77	39	[internal/transport]=77
40	[internal/shape]=88	40	[internal/shape]=88
41	[internal/site]=80	41	[internal/site]=80
		42	[internal/cli]=60
42	)	43	)
43		44
44	profile="$(mktemp)"	45	profile="$(mktemp)"

scripts/release.sh

Old		New
@@ -1,7 +1,7 @@
1	#!/usr/bin/env bash	1	#!/usr/bin/env bash
2	# Cross-compiled release artifacts for eitri.sh, into dist/<version>/:	2	# Cross-compiled release artifacts for eitri.sh, into dist/<version>/:
3	# eitri_<v>_linux_{amd64,arm64}.tar.gz host bundle: server+agent+systemd unit	3	# eitri_<v>_linux_{amd64,arm64}.tar.gz host bundle: server+agent+systemd unit
4	# eitri-ssh_<v>.tar.gz client bundle: eitri-ssh + eitri-ca (portable bash)	4	# eitri-cli_<v>_<os>_<arch>.tar.gz client CLI (eitri) for linux+darwin
5	# eitri-agent_linux_{amd64,arm64} bare binaries — what the agent	5	# eitri-agent_linux_{amd64,arm64} bare binaries — what the agent
6	# self-updater downloads and sha-verifies	6	# self-updater downloads and sha-verifies
7	# cloud-hypervisor_linux_{amd64,arm64} pinned runtime, mirrored from upstream	7	# cloud-hypervisor_linux_{amd64,arm64} pinned runtime, mirrored from upstream
@@ -36,11 +36,6 @@ if ! git describe --tags --exact-match >/dev/null 2>&1; then
36	echo "release: WARNING — HEAD is not a tag ($VERSION); agents never upgrade to unparsable versions" >&2	36	echo "release: WARNING — HEAD is not a tag ($VERSION); agents never upgrade to unparsable versions" >&2
37	fi	37	fi
38		38
39	[ -x hack/eitri-ssh ] && [ -x hack/eitri-ca ] \|\| {
40	echo "release: hack/eitri-ssh or hack/eitri-ca missing/not executable (client bundle)" >&2
41	exit 1
42	}
43
44	LDFLAGS="-X github.com/a73x/eitri/internal/version.Version=$VERSION"	39	LDFLAGS="-X github.com/a73x/eitri/internal/version.Version=$VERSION"
45	OUT="dist/$VERSION"	40	OUT="dist/$VERSION"
46	rm -rf "$OUT"	41	rm -rf "$OUT"
@@ -63,10 +58,17 @@ for arch in amd64 arm64; do
63	cp "$stage/$bundle/eitri-agent" "$OUT/eitri-agent_linux_${arch}"	58	cp "$stage/$bundle/eitri-agent" "$OUT/eitri-agent_linux_${arch}"
64	done	59	done
65		60
66	stage="$STAGE_ROOT/ssh"	61	# Client CLI, cross-compiled for laptops (pure Go, CGO-free).
67	mkdir -p "$stage/eitri-ssh_$VERSION"	62	for platform in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
68	cp hack/eitri-ssh hack/eitri-ca "$stage/eitri-ssh_$VERSION/"	63	os=${platform%%/} arch=${platform##/}
69	tar -C "$stage" -czf "$OUT/eitri-ssh_$VERSION.tar.gz" "eitri-ssh_$VERSION"	64	bundle="eitri-cli_${VERSION}_${os}_${arch}"
		65	stage="$STAGE_ROOT/cli-$os-$arch"
		66	mkdir -p "$stage/$bundle"
		67	echo "==> building client $platform"
		68	CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags "$LDFLAGS" \
		69	-o "$stage/$bundle/eitri" ./cmd/eitri
		70	tar -C "$stage" -czf "$OUT/$bundle.tar.gz" "$bundle"
		71	done
70		72
71	# Mirror the pinned cloud-hypervisor (agents bootstrap it from the manifest).	73	# Mirror the pinned cloud-hypervisor (agents bootstrap it from the manifest).
72	ch_cache="${CH_CACHE:-$HOME/.cache/eitri/ch}/$CH_VERSION"	74	ch_cache="${CH_CACHE:-$HOME/.cache/eitri/ch}/$CH_VERSION"

web/src/routes/+page.svelte

Old		New
@@ -313,7 +313,7 @@
313	Generate a CA, paste its public key below, then connect:	313	Generate a CA, paste its public key below, then connect:
314	<code>ssh-keygen -t ed25519 -f ~/.ssh/eitri_user_ca</code>	314	<code>ssh-keygen -t ed25519 -f ~/.ssh/eitri_user_ca</code>
315	<code># paste ~/.ssh/eitri_user_ca.pub in the field below, then:</code>	315	<code># paste ~/.ssh/eitri_user_ca.pub in the field below, then:</code>
316	<code>EITRI_CA=~/.ssh/eitri_user_ca eitri-ssh <vm-name></code>	316	<code>EITRI_CA=~/.ssh/eitri_user_ca eitri ssh <vm-name></code>
317	</div>	317	</div>
318	{:else}	318	{:else}
319	<table>	319	<table>