@andrewheberle/serverless-ssh-ca 0.22.0 → 0.23.0

package/dist/ssh/certificate.d.ts

@@ -0,0 +1,93 @@
+import { PublicKey } from "./keys.js";
+import { type Signer } from "./signer.js";
+/**
+ * Encoding, decoding and signing of OpenSSH certificates as described in
+ * PROTOCOL.certkeys from OpenSSH
+ */
+/** Whether a certificate is for a user or a host */
+export type CertificateKind = "user" | "host";
+/** The fields of a certificate that are set by the CA */
+export type CertificateFields = {
+    /** Whether the certificate is for a user or a host */
+    kind: CertificateKind;
+    /** The public key being certified */
+    publicKey: PublicKey;
+    /** The serial number of the certificate */
+    serial: bigint;
+    /** The key ID of the certificate, which is logged by sshd when it is used */
+    keyId: string;
+    /** The users or hosts the certificate is valid for */
+    principals: string[];
+    /** The time from which the certificate is valid, to the second */
+    validAfter: Date;
+    /** The time until which the certificate is valid, to the second */
+    validBefore: Date;
+    /** The names of the extensions to include, which have no data */
+    extensions: string[];
+};
+/**
+ * Thrown when a certificate cannot be parsed
+ */
+export declare class CertificateParseError extends Error {
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * A signed OpenSSH certificate
+ */
+export declare class SshCertificate {
+    /** The wire encoding of the certificate */
+    readonly bytes: Uint8Array;
+    /** The certificate type, for example "ssh-ed25519-cert-v01@openssh.com" */
+    readonly type: string;
+    readonly kind: CertificateKind;
+    /** The public key being certified */
+    readonly publicKey: PublicKey;
+    readonly serial: bigint;
+    readonly keyId: string;
+    readonly principals: string[];
+    readonly validAfter: Date;
+    readonly validBefore: Date;
+    /** The names of the extensions on the certificate */
+    readonly extensions: string[];
+    /** The wire encoding of the public key of the CA that signed the certificate */
+    readonly signatureKey: Uint8Array;
+    /** The signature of the CA in the SSH wire format */
+    readonly signature: Uint8Array;
+    /**
+     * Decodes a certificate from its wire encoding. This does not verify the
+     * signature on the certificate.
+     *
+     * @param bytes The wire encoding of the certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be decoded or its type is not supported
+     */
+    constructor(bytes: Uint8Array);
+    /**
+     * Parses a certificate in OpenSSH format, `${type} ${base64}[ ${comment}]`,
+     * as found in `-cert.pub` files. This does not verify the signature on the
+     * certificate.
+     *
+     * @param text The certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be parsed or its type is not supported
+     */
+    static parse(text: string): SshCertificate;
+    /**
+     * Returns whether the certificate was signed by a CA key
+     *
+     * @param ca The public key of the CA
+     */
+    isSignedBy(ca: PublicKey): Promise<boolean>;
+    /**
+     * Returns the certificate in OpenSSH format, as used for `-cert.pub` files
+     */
+    toString(): string;
+}
+/**
+ * Creates and signs an OpenSSH certificate
+ *
+ * @param fields The fields of the certificate
+ * @param signer The CA key to sign the certificate with
+ * @returns The signed certificate
+ * @throws Error when the type of the public key being certified is not supported
+ */
+export declare const signCertificate: (fields: CertificateFields, signer: Signer) => Promise<SshCertificate>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/ssh/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../src/ssh/certificate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAiB,SAAS,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AAEH,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAO7C,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAC/B,sDAAsD;IACtD,IAAI,EAAE,eAAe,CAAA;IACrB,qCAAqC;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,sDAAsD;IACtD,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,kEAAkE;IAClE,UAAU,EAAE,IAAI,CAAA;IAChB,mEAAmE;IACnE,WAAW,EAAE,IAAI,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AA+BD;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,cAAc;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAE9B;;;;;;OAMG;IACH,YAAY,KAAK,EAAE,UAAU,EA+B5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAmBzC;IAED;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAShD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAEjB;CACD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,WAAkB,iBAAiB,UAAU,MAAM,KAAG,OAAO,CAAC,cAAc,CAuBvG,CAAA"}

package/dist/ssh/certificate.js

@@ -0,0 +1,178 @@
+import * as P from "micro-packed";
+import { decodePublicKey, PublicKeyFieldCounts, SSHBytes, SSHOptions, SSHText, SSHTextList, } from "./encoding.js";
+import { base64 } from "@scure/base";
+import { KeyParseError, PublicKey } from "./keys.js";
+import { verify } from "./signer.js";
+const CertificateKinds = {
+    user: 1,
+    host: 2,
+};
+// the fields of a certificate that follow its type, which are given the
+// number of fields in the public key of the certificate
+const fields = (keyFields) => ({
+    nonce: SSHBytes,
+    key: P.array(keyFields, SSHBytes),
+    serial: P.U64BE,
+    kind: P.U32BE,
+    keyId: SSHText,
+    principals: SSHTextList,
+    validAfter: P.U64BE,
+    validBefore: P.U64BE,
+    criticalOptions: SSHOptions,
+    extensions: SSHOptions,
+    reserved: SSHBytes,
+    signatureKey: SSHBytes,
+});
+const certificateType = (keyType) => `${keyType}-cert-v01@openssh.com`;
+// a certificate without and with its signature, tagged by the certificate type
+const ToBeSigned = P.tag(SSHText, Object.fromEntries(Object.entries(PublicKeyFieldCounts).map(([keyType, count]) => [certificateType(keyType), P.struct(fields(count))])));
+const Certificate = P.tag(SSHText, Object.fromEntries(Object.entries(PublicKeyFieldCounts).map(([keyType, count]) => [certificateType(keyType), P.struct({ ...fields(count), signature: SSHBytes })])));
+const toSeconds = (date) => BigInt(Math.floor(date.getTime() / 1000));
+/**
+ * Thrown when a certificate cannot be parsed
+ */
+export class CertificateParseError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = "CertificateParseError";
+        this.cause = cause;
+        Object.setPrototypeOf(this, CertificateParseError.prototype);
+    }
+}
+/**
+ * A signed OpenSSH certificate
+ */
+export class SshCertificate {
+    /** The wire encoding of the certificate */
+    bytes;
+    /** The certificate type, for example "ssh-ed25519-cert-v01@openssh.com" */
+    type;
+    kind;
+    /** The public key being certified */
+    publicKey;
+    serial;
+    keyId;
+    principals;
+    validAfter;
+    validBefore;
+    /** The names of the extensions on the certificate */
+    extensions;
+    /** The wire encoding of the public key of the CA that signed the certificate */
+    signatureKey;
+    /** The signature of the CA in the SSH wire format */
+    signature;
+    /**
+     * Decodes a certificate from its wire encoding. This does not verify the
+     * signature on the certificate.
+     *
+     * @param bytes The wire encoding of the certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be decoded or its type is not supported
+     */
+    constructor(bytes) {
+        let decoded;
+        try {
+            decoded = Certificate.decode(bytes);
+        }
+        catch (err) {
+            throw new CertificateParseError("certificate could not be decoded", err);
+        }
+        const { TAG, data } = decoded;
+        const kind = Object.keys(CertificateKinds).find((k) => CertificateKinds[k] === data.kind);
+        if (kind === undefined) {
+            throw new CertificateParseError(`unknown certificate kind: ${data.kind}`);
+        }
+        const publicKeyType = TAG.replace(/-cert-v01@openssh\.com$/, "");
+        try {
+            this.publicKey = new PublicKey(P.struct({ type: SSHText, key: P.array(data.key.length, SSHBytes) }).encode({ type: publicKeyType, key: data.key }));
+        }
+        catch (err) {
+            throw new CertificateParseError(err instanceof KeyParseError ? err.message : "certificate public key could not be decoded", err);
+        }
+        this.bytes = bytes;
+        this.type = TAG;
+        this.kind = kind;
+        this.serial = data.serial;
+        this.keyId = data.keyId;
+        this.principals = data.principals;
+        this.validAfter = new Date(Number(data.validAfter) * 1000);
+        this.validBefore = new Date(Number(data.validBefore) * 1000);
+        this.extensions = data.extensions.map((e) => e.name);
+        this.signatureKey = data.signatureKey;
+        this.signature = data.signature;
+    }
+    /**
+     * Parses a certificate in OpenSSH format, `${type} ${base64}[ ${comment}]`,
+     * as found in `-cert.pub` files. This does not verify the signature on the
+     * certificate.
+     *
+     * @param text The certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be parsed or its type is not supported
+     */
+    static parse(text) {
+        const [type, data] = text.trim().split(/\s+/);
+        if (type === undefined || type === "" || data === undefined) {
+            throw new CertificateParseError("certificate was not in OpenSSH format");
+        }
+        let bytes;
+        try {
+            bytes = base64.decode(data);
+        }
+        catch (err) {
+            throw new CertificateParseError("certificate was not valid base64", err);
+        }
+        const certificate = new SshCertificate(bytes);
+        if (certificate.type !== type) {
+            throw new CertificateParseError(`certificate type ${type} did not match encoded type ${certificate.type}`);
+        }
+        return certificate;
+    }
+    /**
+     * Returns whether the certificate was signed by a CA key
+     *
+     * @param ca The public key of the CA
+     */
+    async isSignedBy(ca) {
+        if (!ca.equals(new PublicKey(this.signatureKey))) {
+            return false;
+        }
+        // the signature is the last field, so everything before it is signed
+        const signed = this.bytes.subarray(0, this.bytes.length - 4 - this.signature.length);
+        return await verify(ca, this.signature, new Uint8Array(signed));
+    }
+    /**
+     * Returns the certificate in OpenSSH format, as used for `-cert.pub` files
+     */
+    toString() {
+        return `${this.type} ${base64.encode(this.bytes)}`;
+    }
+}
+/**
+ * Creates and signs an OpenSSH certificate
+ *
+ * @param fields The fields of the certificate
+ * @param signer The CA key to sign the certificate with
+ * @returns The signed certificate
+ * @throws Error when the type of the public key being certified is not supported
+ */
+export const signCertificate = async (fields, signer) => {
+    const { type, fields: key } = decodePublicKey(fields.publicKey.blob);
+    const value = {
+        nonce: crypto.getRandomValues(new Uint8Array(32)),
+        key,
+        serial: fields.serial,
+        kind: CertificateKinds[fields.kind],
+        keyId: fields.keyId,
+        principals: fields.principals,
+        validAfter: toSeconds(fields.validAfter),
+        validBefore: toSeconds(fields.validBefore),
+        criticalOptions: [],
+        // options must be in lexical order and may each appear only once
+        extensions: [...new Set(fields.extensions)].sort().map((name) => ({ name, data: new Uint8Array(0) })),
+        reserved: new Uint8Array(0),
+        signatureKey: signer.publicKey,
+    };
+    const tbs = ToBeSigned.encode({ TAG: certificateType(type), data: value });
+    const signature = await signer.sign(new Uint8Array(tbs));
+    return new SshCertificate(Certificate.encode({ TAG: certificateType(type), data: { ...value, signature } }));
+};
+//# sourceMappingURL=certificate.js.map

package/dist/ssh/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../src/ssh/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EACN,eAAe,EACf,oBAAoB,EACpB,QAAQ,EACR,UAAU,EACV,OAAO,EACP,WAAW,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAE,MAAM,EAAe,MAAM,aAAa,CAAA;AAUjD,MAAM,gBAAgB,GAA8C;IACnE,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACP,CAAA;AAsBD,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC;IACtC,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,CAAC,CAAC,KAAK;IACb,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,CAAC,CAAC,KAAK;IACnB,WAAW,EAAE,CAAC,CAAC,KAAK;IACpB,eAAe,EAAE,UAAU;IAC3B,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,YAAY,EAAE,QAAQ;CACtB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,OAAO,uBAAuB,CAAA;AAEtF,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CACnD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACnH,CAAC,CAAA;AACF,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CACpD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC/I,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;AAEnF;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAC1B,2CAA2C;IAClC,KAAK,CAAY;IAC1B,2EAA2E;IAClE,IAAI,CAAQ;IACZ,IAAI,CAAiB;IAC9B,qCAAqC;IAC5B,SAAS,CAAW;IACpB,MAAM,CAAQ;IACd,KAAK,CAAQ;IACb,UAAU,CAAU;IACpB,UAAU,CAAM;IAChB,WAAW,CAAM;IAC1B,qDAAqD;IAC5C,UAAU,CAAU;IAC7B,gFAAgF;IACvE,YAAY,CAAY;IACjC,qDAAqD;IAC5C,SAAS,CAAY;IAE9B;;;;;;OAMG;IACH,YAAY,KAAiB;QAC5B,IAAI,OAA0C,CAAA;QAC9C,IAAI,CAAC;YACJ,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QAC7B,MAAM,IAAI,GAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;QAChH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC;YACJ,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAA;QACjI,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACJ,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,IAAI,+BAA+B,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,WAAW,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,EAAa;QAC7B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACb,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAEpF,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAyB,EAAE,MAAc,EAA2B,EAAE;IAC3G,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG;QACb,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjD,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACxC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAC1C,eAAe,EAAE,EAAE;QACnB,iEAAiE;QACjE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,QAAQ,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAA;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAExD,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;AAC7G,CAAC,CAAA"}

package/dist/ssh/encoding.d.ts

@@ -0,0 +1,41 @@
+import * as P from "micro-packed";
+/**
+ * Coders for the SSH wire format (RFC 4251 section 5)
+ */
+/** A string of bytes, prefixed by its length as a uint32 */
+export declare const SSHBytes: P.CoderType<P.Bytes>;
+/** A UTF-8 string, prefixed by its length as a uint32 */
+export declare const SSHText: P.CoderType<string>;
+/** A list of strings packed into a string, as used for certificate principals */
+export declare const SSHTextList: P.CoderType<string[]>;
+/**
+ * A list of named options packed into a string, as used for certificate
+ * critical options and extensions
+ */
+export declare const SSHOptions: P.CoderType<P.StructInput<{
+    name: string;
+    data: P.Bytes;
+}>[]>;
+/**
+ * An mpint holding an unsigned integer, decoded to and encoded from its
+ * big-endian bytes without leading zeros.
+ *
+ * An mpint has no leading zero bytes, other than one to keep the value
+ * positive when the high bit of the first byte is set.
+ */
+export declare const SSHUnsignedMpint: P.CoderType<Uint8Array<ArrayBufferLike>>;
+/** The number of fields that follow the type in the wire encoding of a public key of each type */
+export declare const PublicKeyFieldCounts: Readonly<Record<string, number>>;
+/**
+ * Splits the wire encoding of a public key into its type and the encoded
+ * fields that follow it
+ *
+ * @param blob The wire encoding of the public key
+ * @returns The key type and its fields
+ * @throws Error when the key type is not supported or the encoding is invalid
+ */
+export declare const decodePublicKey: (blob: Uint8Array) => {
+    type: string;
+    fields: Uint8Array[];
+};
+//# sourceMappingURL=encoding.d.ts.map

package/dist/ssh/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/ssh/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAEjC;;GAEG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,sBAAmB,CAAA;AAExC,yDAAyD;AACzD,eAAO,MAAM,OAAO,qBAAoB,CAAA;AAExC,iFAAiF;AACjF,eAAO,MAAM,WAAW,uBAA4C,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,UAAU;;;KAGnB,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,0CAoB3B,CAAA;AAEF,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMjE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,SAAU,UAAU,KAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,EAAE,CAAA;CAUtF,CAAA"}

package/dist/ssh/encoding.js

@@ -0,0 +1,70 @@
+import * as P from "micro-packed";
+/**
+ * Coders for the SSH wire format (RFC 4251 section 5)
+ */
+/** A string of bytes, prefixed by its length as a uint32 */
+export const SSHBytes = P.bytes(P.U32BE);
+/** A UTF-8 string, prefixed by its length as a uint32 */
+export const SSHText = P.string(P.U32BE);
+/** A list of strings packed into a string, as used for certificate principals */
+export const SSHTextList = P.prefix(P.U32BE, P.array(null, SSHText));
+/**
+ * A list of named options packed into a string, as used for certificate
+ * critical options and extensions
+ */
+export const SSHOptions = P.prefix(P.U32BE, P.array(null, P.struct({
+    name: SSHText,
+    data: SSHBytes,
+})));
+/**
+ * An mpint holding an unsigned integer, decoded to and encoded from its
+ * big-endian bytes without leading zeros.
+ *
+ * An mpint has no leading zero bytes, other than one to keep the value
+ * positive when the high bit of the first byte is set.
+ */
+export const SSHUnsignedMpint = P.apply(SSHBytes, {
+    encode: (mpint) => {
+        let start = 0;
+        while (start < mpint.length && mpint[start] === 0) {
+            start++;
+        }
+        return mpint.subarray(start);
+    },
+    decode: (value) => {
+        let start = 0;
+        while (start < value.length && value[start] === 0) {
+            start++;
+        }
+        const trimmed = value.subarray(start);
+        return trimmed.length > 0 && trimmed[0] & 0x80
+            ? P.utils.concatBytes(new Uint8Array([0]), trimmed)
+            : trimmed;
+    },
+});
+/** The number of fields that follow the type in the wire encoding of a public key of each type */
+export const PublicKeyFieldCounts = {
+    "ssh-ed25519": 1, // public key
+    "ecdsa-sha2-nistp256": 2, // curve, public key
+    "ecdsa-sha2-nistp384": 2,
+    "ecdsa-sha2-nistp521": 2,
+    "ssh-rsa": 2, // e, n
+};
+/**
+ * Splits the wire encoding of a public key into its type and the encoded
+ * fields that follow it
+ *
+ * @param blob The wire encoding of the public key
+ * @returns The key type and its fields
+ * @throws Error when the key type is not supported or the encoding is invalid
+ */
+export const decodePublicKey = (blob) => {
+    const type = SSHText.decode(blob, { allowUnreadBytes: true });
+    const count = PublicKeyFieldCounts[type];
+    if (count === undefined) {
+        throw new Error(`unsupported public key type: ${type}`);
+    }
+    const { fields } = P.struct({ type: SSHText, fields: P.array(count, SSHBytes) }).decode(blob);
+    return { type, fields };
+};
+//# sourceMappingURL=encoding.js.map

package/dist/ssh/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/ssh/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAEjC;;GAEG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAExC,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAExC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAClE,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,QAAQ;CACd,CAAC,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,KAAiB,EAAc,EAAE;QACzC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,CAAA;QACR,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,EAAE,CAAC,KAAiB,EAAc,EAAE;QACzC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE,CAAA;QACR,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAErC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI;YAC9C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YACnD,CAAC,CAAC,OAAO,CAAA;IACX,CAAC;CACD,CAAC,CAAA;AAEF,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACrE,aAAa,EAAE,CAAC,EAAE,aAAa;IAC/B,qBAAqB,EAAE,CAAC,EAAE,oBAAoB;IAC9C,qBAAqB,EAAE,CAAC;IACxB,qBAAqB,EAAE,CAAC;IACxB,SAAS,EAAE,CAAC,EAAE,OAAO;CACrB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAgB,EAA0C,EAAE;IAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE7F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACxB,CAAC,CAAA"}

package/dist/ssh/keys.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Thrown when a key cannot be parsed
+ */
+export declare class KeyParseError extends Error {
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * Thrown when a private key is of a type that cannot be used to sign
+ */
+export declare class UnsupportedKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * An SSH public key
+ */
+export declare class PublicKey {
+    /** The key type, for example "ssh-ed25519" */
+    readonly type: string;
+    /** The wire encoding of the key (RFC 4253 section 6.6) */
+    readonly blob: Uint8Array;
+    /** The comment of the key, if any */
+    readonly comment: string | undefined;
+    /**
+     * @param blob The wire encoding of the key
+     * @param comment The comment of the key
+     * @throws {@link KeyParseError} when the key cannot be decoded or its type is not supported
+     */
+    constructor(blob: Uint8Array, comment?: string);
+    /**
+     * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     *
+     * @param text The public key
+     * @throws {@link KeyParseError} when the key cannot be parsed or its type is not supported
+     */
+    static parse(text: string): PublicKey;
+    /**
+     * Returns the SHA256 fingerprint of the key, as shown by `ssh-keygen -l`,
+     * for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs"
+     */
+    fingerprint(): string;
+    /**
+     * Returns whether this is the same key as another, ignoring comments
+     */
+    equals(other: PublicKey): boolean;
+    /**
+     * Returns a copy of the key with a different comment
+     */
+    withComment(comment: string | undefined): PublicKey;
+    /**
+     * Returns the key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     */
+    toString(): string;
+}
+/** The ECDSA curves that can be used to sign */
+export type EcdsaCurve = "nistp256" | "nistp384" | "nistp521";
+/**
+ * A private key that can be used to sign, with its key material as a JWK for
+ * WebCrypto
+ */
+export type PrivateKey = {
+    readonly type: "ed25519";
+    readonly publicKey: PublicKey;
+    readonly jwk: JsonWebKey;
+} | {
+    readonly type: "ecdsa";
+    readonly curve: EcdsaCurve;
+    readonly publicKey: PublicKey;
+    readonly jwk: JsonWebKey;
+};
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
+ * created by `ssh-keygen`
+ *
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
+ * @returns The private key
+ * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
+ * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ */
+export declare const parsePrivateKey: (text: string) => PrivateKey;
+//# sourceMappingURL=keys.d.ts.map

package/dist/ssh/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAMD;;GAEG;AACH,qBAAa,SAAS;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAEpC;;;;OAIG;IACH,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAQ7C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmBpC;IAED;;;OAGG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEhC;IAED;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACD;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;AAQ7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,GAAG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,CAAA;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,UA2F9C,CAAA"}