passwd-sso-cli 0.4.50 → 0.4.56

package/dist/lib/ssh-agent-protocol.js

@@ -2,16 +2,21 @@
  * SSH agent protocol constants and framing helpers.
  *
  * Implements the subset of the SSH agent protocol needed for key listing
- * and signing operations. Reference: draft-miller-ssh-agent.
+ * and signing operations. Reference: RFC 9987 (SSH Agent Protocol).
  */
 // ─── Message types ────────────────────────────────────────────
 /** Client → Agent */
 export const SSH2_AGENTC_REQUEST_IDENTITIES = 11;
 export const SSH2_AGENTC_SIGN_REQUEST = 13;
+export const SSH_AGENTC_REMOVE_ALL_IDENTITIES = 19;
+export const SSH_AGENTC_EXTENSION = 27;
 /** Agent → Client */
 export const SSH2_AGENT_FAILURE = 5;
+export const SSH_AGENT_SUCCESS = 6;
 export const SSH2_AGENT_IDENTITIES_ANSWER = 12;
 export const SSH2_AGENT_SIGN_RESPONSE = 14;
+export const SSH_AGENT_EXTENSION_FAILURE = 28;
+export const SSH_AGENT_EXTENSION_RESPONSE = 29;
 // ─── Signature algorithm flags (SSH2_AGENTC_SIGN_REQUEST flags field) ─
 export const SSH_AGENT_RSA_SHA2_256 = 2;
 export const SSH_AGENT_RSA_SHA2_512 = 4;
@@ -105,4 +110,36 @@ export function buildSignResponse(signature) {
     sigString.copy(body, 1);
     return frameMessage(body);
 }
+/**
+ * Build an SSH_AGENT_SUCCESS response (RFC 9987 §4.1).
+ */
+export function buildSuccess() {
+    const body = Buffer.alloc(1);
+    body[0] = SSH_AGENT_SUCCESS;
+    return frameMessage(body);
+}
+/**
+ * Build an SSH_AGENT_EXTENSION_RESPONSE (RFC 9987 §4.7).
+ *
+ * @param payload The extension-specific response payload bytes
+ */
+export function buildExtensionResponse(payload) {
+    const body = Buffer.alloc(1 + payload.length);
+    body[0] = SSH_AGENT_EXTENSION_RESPONSE;
+    payload.copy(body, 1);
+    return frameMessage(body);
+}
+/**
+ * Parse an SSH_AGENTC_EXTENSION message buffer.
+ *
+ * @param msgBuf The full message body (msgBuf[0] is the SSH_AGENTC_EXTENSION type byte).
+ * @returns The extension name (utf-8) and the remaining bytes after the name string.
+ */
+export function readExtensionRequest(msgBuf) {
+    // msgBuf[0] = type byte (SSH_AGENTC_EXTENSION); extension name starts at offset 1
+    const { data, nextOffset } = readString(msgBuf, 1);
+    const extName = data.toString("utf-8");
+    const rest = msgBuf.subarray(nextOffset);
+    return { extName, rest };
+}
 //# sourceMappingURL=ssh-agent-protocol.js.map

package/dist/lib/ssh-agent-socket.d.ts

@@ -1,9 +1,49 @@
 /**
  * SSH agent Unix domain socket server.
  *
- * Creates a Unix socket that implements the SSH agent protocol,
- * serving keys from the passwd-sso vault.
+ * Creates a Unix socket that implements the SSH agent protocol (RFC 9987),
+ * serving keys from the passwd-sso vault. Supports:
+ *   - REQUEST_IDENTITIES (11)
+ *   - SIGN_REQUEST (13) — with per-signature server authorization
+ *   - REMOVE_ALL_IDENTITIES (19)
+ *   - EXTENSION (27): query, session-bind@openssh.com
  */
+import type { Socket } from "node:net";
+import type { SessionBinding } from "./ssh-session-bind.js";
+import { authorizeSign as defaultAuthorizeSign } from "./ssh-sign-authorizer.js";
+import { confirmSign as defaultConfirmSign } from "./ssh-confirm.js";
+/** Per-connection state: the verified session-bind from session-bind@openssh.com */
+export type ConnectionContext = {
+    binding: SessionBinding | null;
+};
+type AuthorizeFn = typeof defaultAuthorizeSign;
+type ConfirmFn = typeof defaultConfirmSign;
+/**
+ * Inject authorize/confirm dependencies.
+ * Must be called before the first connection. Mirrors the setEncryptionKey pattern.
+ */
+export declare function setAgentDeps(deps: {
+    authorizeSign?: AuthorizeFn;
+    confirmSign?: ConfirmFn;
+}): void;
+/**
+ * Handle a single SSH agent protocol message.
+ * Exported for unit testing (mirrors agent-decrypt.ts).
+ */
+export declare function handleMessage(msgBuf: Buffer, ctx: ConnectionContext): Promise<Buffer>;
+/**
+ * Handle a connected client socket with sequential, in-order message processing.
+ *
+ * RFC 9987 requires replies in the same order as requests. The async sign path
+ * (authorize + optional confirm) would allow a second reply to overtake the
+ * first if handled concurrently. We prevent this with a single-in-flight drain:
+ * the data handler enqueues complete frames into a per-connection buffer, then
+ * the drain loop processes one frame at a time, awaiting each reply before
+ * dequeuing the next.
+ *
+ * Exported for unit testing (mirrors agent-decrypt.ts).
+ */
+export declare function handleConnection(socket: Socket): void;
 /**
  * Start the SSH agent socket server.
  *
@@ -18,3 +58,4 @@ export declare function stopAgent(): void;
  * Get the current socket path, or null if not running.
  */
 export declare function getSocketPath(): string | null;
+export {};

package/dist/lib/ssh-agent-socket.js

@@ -1,54 +1,39 @@
 /**
  * SSH agent Unix domain socket server.
  *
- * Creates a Unix socket that implements the SSH agent protocol,
- * serving keys from the passwd-sso vault.
+ * Creates a Unix socket that implements the SSH agent protocol (RFC 9987),
+ * serving keys from the passwd-sso vault. Supports:
+ *   - REQUEST_IDENTITIES (11)
+ *   - SIGN_REQUEST (13) — with per-signature server authorization
+ *   - REMOVE_ALL_IDENTITIES (19)
+ *   - EXTENSION (27): query, session-bind@openssh.com
  */
 import { createServer } from "node:net";
 import { mkdirSync, lstatSync, chmodSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { readUint32, readString, SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENTC_SIGN_REQUEST, buildFailure, buildIdentitiesAnswer, buildSignResponse, } from "./ssh-agent-protocol.js";
-import { getLoadedKeys, findKeyByBlob, signData } from "./ssh-key-agent.js";
-let server = null;
-let socketPath = null;
+import { readUint32, readString, encodeString, SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENTC_SIGN_REQUEST, SSH_AGENTC_REMOVE_ALL_IDENTITIES, SSH_AGENTC_EXTENSION, buildFailure, buildSuccess, buildIdentitiesAnswer, buildSignResponse, buildExtensionResponse, readExtensionRequest, } from "./ssh-agent-protocol.js";
+import { getLoadedKeys, findKeyByBlob, signData, clearKeys, } from "./ssh-key-agent.js";
+import { parseSessionBind, verifySessionBind, fingerprintPublicKey, } from "./ssh-session-bind.js";
+import { authorizeSign as defaultAuthorizeSign } from "./ssh-sign-authorizer.js";
+import { confirmSign as defaultConfirmSign } from "./ssh-confirm.js";
+let _authorizeSign = defaultAuthorizeSign;
+let _confirmSign = defaultConfirmSign;
 /**
- * Get the socket directory path.
- * Prefers $XDG_RUNTIME_DIR/passwd-sso/, falls back to /tmp/passwd-sso-<uid>/
+ * Inject authorize/confirm dependencies.
+ * Must be called before the first connection. Mirrors the setEncryptionKey pattern.
  */
-function getSocketDir() {
-    const xdg = process.env.XDG_RUNTIME_DIR;
-    if (xdg)
-        return join(xdg, "passwd-sso");
-    const uid = process.getuid?.();
-    if (uid === undefined) {
-        throw new Error("Cannot determine user ID for socket directory");
-    }
-    return join("/tmp", `passwd-sso-${uid}`);
-}
-/**
- * Create the socket directory with proper permissions.
- * Validates ownership and mode to prevent symlink attacks.
- */
-function ensureSocketDir(dir) {
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    // Verify ownership and permissions (TOCTOU mitigation — lstatSync to avoid following symlinks)
-    const stat = lstatSync(dir);
-    if (!stat.isDirectory()) {
-        throw new Error(`Socket path ${dir} is not a directory (possible symlink attack)`);
-    }
-    const uid = process.getuid?.();
-    if (uid !== undefined && stat.uid !== uid) {
-        throw new Error(`Socket directory ${dir} is owned by uid ${stat.uid}, expected ${uid}`);
-    }
-    const mode = stat.mode & 0o7777;
-    if (mode !== 0o700) {
-        throw new Error(`Socket directory ${dir} has mode ${mode.toString(8)}, expected 700`);
-    }
+export function setAgentDeps(deps) {
+    if (deps.authorizeSign !== undefined)
+        _authorizeSign = deps.authorizeSign;
+    if (deps.confirmSign !== undefined)
+        _confirmSign = deps.confirmSign;
 }
+// ─── Message handler ───────────────────────────────────────────
 /**
  * Handle a single SSH agent protocol message.
+ * Exported for unit testing (mirrors agent-decrypt.ts).
  */
-function handleMessage(msgBuf) {
+export async function handleMessage(msgBuf, ctx) {
     if (msgBuf.length < 1)
         return buildFailure();
     const msgType = msgBuf[0];
@@ -67,56 +52,168 @@ function handleMessage(msgBuf) {
                 const { data: keyBlob, nextOffset: afterKey } = readString(msgBuf, offset);
                 offset = afterKey;
                 // Read data to sign
-                const { data, nextOffset: afterData } = readString(msgBuf, offset);
+                const { data: dataToSign, nextOffset: afterData } = readString(msgBuf, offset);
                 offset = afterData;
                 // Read flags
-                const flags = offset + 4 <= msgBuf.length
-                    ? readUint32(msgBuf, offset)
-                    : 0;
-                // Find the key
+                const flags = offset + 4 <= msgBuf.length ? readUint32(msgBuf, offset) : 0;
+                // Resolve key
                 const key = findKeyByBlob(keyBlob);
                 if (!key)
                     return buildFailure();
-                // Perform signing
-                const signature = signData(key, data, flags);
+                // Per-key confirmation gate
+                if (key.requireReprompt) {
+                    const label = key.comment || key.entryId;
+                    const allowed = await _confirmSign(label);
+                    if (!allowed)
+                        return buildFailure();
+                }
+                // Per-signature server authorization
+                const fingerprint = fingerprintPublicKey(key.publicKeyBlob);
+                const authorized = await _authorizeSign({
+                    keyId: key.entryId,
+                    fingerprint,
+                    binding: ctx.binding,
+                });
+                if (!authorized)
+                    return buildFailure();
+                // Perform signing locally
+                const signature = signData(key, dataToSign, flags);
                 return buildSignResponse(signature);
             }
             catch {
                 return buildFailure();
             }
         }
+        case SSH_AGENTC_REMOVE_ALL_IDENTITIES: {
+            clearKeys();
+            return buildSuccess();
+        }
+        case SSH_AGENTC_EXTENSION: {
+            const { extName, rest } = readExtensionRequest(msgBuf);
+            if (extName === "query") {
+                // Advertise supported extension names as a sequence of SSH strings.
+                // OpenSSH PROTOCOL.agent: query response body = concatenated string(name) entries.
+                const payload = Buffer.concat([
+                    encodeString("query"),
+                    encodeString("session-bind@openssh.com"),
+                ]);
+                return buildExtensionResponse(payload);
+            }
+            if (extName === "session-bind@openssh.com") {
+                try {
+                    const parsed = parseSessionBind(rest);
+                    if (!verifySessionBind(parsed))
+                        return buildFailure();
+                    ctx.binding = {
+                        hostKeyFingerprint: fingerprintPublicKey(parsed.hostKeyBlob),
+                        forwarded: parsed.isForwarding,
+                    };
+                    return buildSuccess();
+                }
+                catch {
+                    return buildFailure();
+                }
+            }
+            // Unknown extension — RFC 9987 requires an empty SSH_AGENT_FAILURE.
+            return buildFailure();
+        }
         default:
             return buildFailure();
     }
 }
+// ─── Connection handler ────────────────────────────────────────
 /**
- * Handle data from a connected client.
- * SSH agent protocol uses length-prefixed messages.
+ * Handle a connected client socket with sequential, in-order message processing.
+ *
+ * RFC 9987 requires replies in the same order as requests. The async sign path
+ * (authorize + optional confirm) would allow a second reply to overtake the
+ * first if handled concurrently. We prevent this with a single-in-flight drain:
+ * the data handler enqueues complete frames into a per-connection buffer, then
+ * the drain loop processes one frame at a time, awaiting each reply before
+ * dequeuing the next.
+ *
+ * Exported for unit testing (mirrors agent-decrypt.ts).
  */
-function handleConnection(socket) {
+export function handleConnection(socket) {
+    const ctx = { binding: null };
     let buffer = Buffer.alloc(0);
-    socket.on("data", (chunk) => {
-        buffer = Buffer.concat([buffer, chunk]);
-        // Process complete messages
-        while (buffer.length >= 4) {
-            const msgLen = readUint32(buffer, 0);
-            // Reject absurdly large messages (DoS protection)
-            if (msgLen > 256 * 1024) {
-                socket.destroy();
-                return;
+    let isProcessing = false;
+    async function drain() {
+        if (isProcessing)
+            return;
+        isProcessing = true;
+        try {
+            while (buffer.length >= 4) {
+                const msgLen = readUint32(buffer, 0);
+                // Reject absurdly large messages before dequeuing (DoS protection)
+                if (msgLen > 256 * 1024) {
+                    socket.destroy();
+                    buffer = Buffer.alloc(0);
+                    return;
+                }
+                if (buffer.length < 4 + msgLen)
+                    break; // Need more data
+                const msgBuf = buffer.subarray(4, 4 + msgLen);
+                buffer = buffer.subarray(4 + msgLen);
+                let reply;
+                try {
+                    reply = await handleMessage(msgBuf, ctx);
+                }
+                catch {
+                    reply = buildFailure();
+                }
+                socket.write(reply);
             }
-            if (buffer.length < 4 + msgLen)
-                break; // Need more data
-            const msgBuf = buffer.subarray(4, 4 + msgLen);
-            buffer = buffer.subarray(4 + msgLen);
-            const response = handleMessage(msgBuf);
-            socket.write(response);
         }
+        finally {
+            isProcessing = false;
+        }
+    }
+    socket.on("data", (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        void drain();
     });
     socket.on("error", () => {
         // Silently handle client disconnects
     });
 }
+// ─── Server lifecycle ──────────────────────────────────────────
+let server = null;
+let socketPath = null;
+/**
+ * Get the socket directory path.
+ * Prefers $XDG_RUNTIME_DIR/passwd-sso/, falls back to /tmp/passwd-sso-<uid>/
+ */
+function getSocketDir() {
+    const xdg = process.env.XDG_RUNTIME_DIR;
+    if (xdg)
+        return join(xdg, "passwd-sso");
+    const uid = process.getuid?.();
+    if (uid === undefined) {
+        throw new Error("Cannot determine user ID for socket directory");
+    }
+    return join("/tmp", `passwd-sso-${uid}`);
+}
+/**
+ * Create the socket directory with proper permissions.
+ * Validates ownership and mode to prevent symlink attacks.
+ */
+function ensureSocketDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Verify ownership and permissions (TOCTOU mitigation — lstatSync to avoid following symlinks)
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory()) {
+        throw new Error(`Socket path ${dir} is not a directory (possible symlink attack)`);
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && stat.uid !== uid) {
+        throw new Error(`Socket directory ${dir} is owned by uid ${stat.uid}, expected ${uid}`);
+    }
+    const mode = stat.mode & 0o7777;
+    if (mode !== 0o700) {
+        throw new Error(`Socket directory ${dir} has mode ${mode.toString(8)}, expected 700`);
+    }
+}
 /**
  * Start the SSH agent socket server.
  *

package/dist/lib/ssh-confirm.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Per-signature confirmation gate for SSH keys with requireReprompt = true.
+ *
+ * When a key entry requires confirmation, this module prompts the user on the
+ * controlling terminal before each signature. If no TTY is available the
+ * request is denied (fail-closed) with a logged explanation.
+ *
+ * Precedent: unlock.ts uses process.stdin.isTTY for the same TTY-detection
+ * pattern. Prompt and isTTY are injectable via deps so tests need no real TTY.
+ */
+/**
+ * Optional dependency overrides, primarily for testing.
+ */
+export interface ConfirmDeps {
+    /** Override for process.stdin.isTTY */
+    isTTY?: boolean;
+    /** Override for the readline prompt function */
+    prompt?: (question: string) => Promise<string>;
+}
+/**
+ * Ask the user to confirm an SSH signing operation on the controlling TTY.
+ *
+ * Returns true only when the user explicitly answers "y" or "yes"
+ * (case-insensitive). Any other answer, Ctrl-C, or absence of a TTY → false.
+ */
+export declare function confirmSign(keyLabel: string, deps?: ConfirmDeps): Promise<boolean>;

package/dist/lib/ssh-confirm.js

@@ -0,0 +1,46 @@
+/**
+ * Per-signature confirmation gate for SSH keys with requireReprompt = true.
+ *
+ * When a key entry requires confirmation, this module prompts the user on the
+ * controlling terminal before each signature. If no TTY is available the
+ * request is denied (fail-closed) with a logged explanation.
+ *
+ * Precedent: unlock.ts uses process.stdin.isTTY for the same TTY-detection
+ * pattern. Prompt and isTTY are injectable via deps so tests need no real TTY.
+ */
+import { createInterface } from "node:readline";
+/**
+ * Ask the user to confirm an SSH signing operation on the controlling TTY.
+ *
+ * Returns true only when the user explicitly answers "y" or "yes"
+ * (case-insensitive). Any other answer, Ctrl-C, or absence of a TTY → false.
+ */
+export async function confirmSign(keyLabel, deps) {
+    const hasTTY = deps?.isTTY ?? process.stdin.isTTY;
+    if (!hasTTY) {
+        process.stderr.write(`SSH signing with "${keyLabel}" requires confirmation but no TTY is available. ` +
+            "Run the agent in the foreground (not via eval) to allow per-key confirmation.\n");
+        return false;
+    }
+    const promptFn = deps?.prompt ?? defaultPrompt;
+    const answer = await promptFn(`Allow SSH signing with "${keyLabel}"? [y/N] `);
+    const trimmed = answer.trim().toLowerCase();
+    return trimmed === "y" || trimmed === "yes";
+}
+/**
+ * Default readline-based prompt over process.stdin / process.stdout.
+ * Mirrors the pattern used in unlock.ts (readPassphrase).
+ */
+function defaultPrompt(question) {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+//# sourceMappingURL=ssh-confirm.js.map

package/dist/lib/ssh-key-agent.d.ts

@@ -8,6 +8,8 @@ import type { KeyObject } from "node:crypto";
 export interface LoadedSshKey {
     /** Entry ID from the vault */
     entryId: string;
+    /** Whether each signature requires explicit user confirmation */
+    requireReprompt: boolean;
     /** PEM-encoded private key */
     pem: string;
     /** Optional passphrase for encrypted keys */
@@ -24,9 +26,9 @@ export interface LoadedSshKey {
 /**
  * Load a PEM private key into memory.
  *
- * @returns The public key blob for identity listing
+ * @returns The loaded key record
  */
-export declare function loadKey(entryId: string, pem: string, publicKeyBlob: Buffer, comment: string, passphrase?: string): Promise<LoadedSshKey>;
+export declare function loadKey(entryId: string, pem: string, publicKeyBlob: Buffer, comment: string, passphrase?: string, requireReprompt?: boolean): Promise<LoadedSshKey>;
 /**
  * Get all loaded keys for identity listing.
  */

package/dist/lib/ssh-key-agent.js

@@ -11,9 +11,9 @@ const loadedKeys = new Map();
 /**
  * Load a PEM private key into memory.
  *
- * @returns The public key blob for identity listing
+ * @returns The loaded key record
  */
-export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase) {
+export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase, requireReprompt) {
     let keyObject;
     try {
         keyObject = createPrivateKey({
@@ -26,8 +26,11 @@ export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase)
         keyObject = await parseOpenSshPrivateKey(pem, passphrase);
     }
     const keyType = detectKeyType(keyObject);
+    // Non-boolean requireReprompt (serializer regression) defaults deny-side to true.
+    const reprompt = typeof requireReprompt === "boolean" ? requireReprompt : true;
     const loaded = {
         entryId,
+        requireReprompt: reprompt,
         pem,
         passphrase,
         publicKeyBlob,

package/dist/lib/ssh-session-bind.d.ts

@@ -0,0 +1,77 @@
+/**
+ * SSH session-bind@openssh.com extension parser and verifier.
+ *
+ * Parses and cryptographically verifies the session-bind extension payload
+ * so the agent can record the host-key fingerprint and forwarding flag for
+ * audit metadata without trusting unauthenticated client assertions.
+ *
+ * Reference: RFC 9987 §4.7 + OpenSSH PROTOCOL.agent
+ */
+import type { KeyObject } from "node:crypto";
+/** Verified session-binding metadata, usable as audit context. */
+export type SessionBinding = {
+    /** SHA256 fingerprint of the host public key ("SHA256:<base64nopad>") */
+    hostKeyFingerprint: string;
+    /** True if the agent is operating over a forwarded connection */
+    forwarded: boolean;
+};
+/**
+ * Parse the payload of a session-bind@openssh.com extension message.
+ *
+ * The contents (after the extension name string) are:
+ *   string  hostkey          (SSH wire-format public key blob)
+ *   string  session-identifier
+ *   string  signature        (SSH wire-format signature blob)
+ *   bool    is_forwarding    (1 byte: 0x01 = true, 0x00 = false)
+ *
+ * @param rest Bytes immediately following the extension name string
+ */
+export declare function parseSessionBind(rest: Buffer): {
+    hostKeyBlob: Buffer;
+    sessionId: Buffer;
+    signature: Buffer;
+    isForwarding: boolean;
+};
+type ParsedPublicKey = {
+    key: KeyObject;
+    keyType: string;
+};
+/**
+ * Convert an SSH wire-format public key blob into a Node.js KeyObject.
+ *
+ * Supported types:
+ *   - ssh-ed25519
+ *   - ssh-rsa
+ *   - ecdsa-sha2-nistp256 / nistp384 / nistp521
+ *
+ * Throws an Error for unsupported key types so the caller (verifySessionBind)
+ * can catch it and return false.
+ */
+export declare function sshWirePublicKeyToKeyObject(blob: Buffer): ParsedPublicKey;
+/**
+ * Verify that the session-bind signature is valid.
+ *
+ * The host proves session control by signing the session identifier with the
+ * host private key. This binds the agent connection to a specific SSH session
+ * and host, preventing forwarded-agent hijack attacks.
+ *
+ * Algorithm binding (RFC 9987 §3.2): the signature algorithm name embedded in
+ * the signature blob must be consistent with the host-key type. Inconsistent
+ * algorithm names are rejected to prevent downgrade attacks.
+ *
+ * Returns false (never throws) on any parse error, unsupported type, or
+ * invalid signature.
+ */
+export declare function verifySessionBind(parsed: {
+    hostKeyBlob: Buffer;
+    sessionId: Buffer;
+    signature: Buffer;
+    isForwarding: boolean;
+}): boolean;
+/**
+ * Compute the standard OpenSSH SHA256 fingerprint of a public key blob.
+ *
+ * Format: "SHA256:<base64-no-padding>" (matches `ssh-keygen -l -E sha256` output).
+ */
+export declare function fingerprintPublicKey(blob: Buffer): string;
+export {};