sliftutils 1.7.124 → 1.7.126

package/security/authorizedKeys/daemon/revocation.ts

@@ -0,0 +1,306 @@
+import fs from "fs/promises";
+import path from "path";
+import { keyFingerprint, summarizeKey } from "../authorizedKeys";
+import { deriveRevokeKey, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
+import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { cloneRepo, repoIsUsable, runGit } from "./git";
+import { UNREVOKE_DELAY } from "./paths";
+import { notify } from "./notify";
+import { getState, saveState } from "./state";
+
+// One revocation per key, ever. Naming the file after the fingerprint is what makes that true:
+// a second attempt from a different address lands on a name that already exists.
+const REVOCATIONS_DIR = "revocations";
+const UNREVOKES_DIR = "unrevoked";
+
+export type Attempt = {
+    ip: string;
+    user: string;
+    port: string;
+    required: string;
+    line: string;
+};
+
+export function revocationIdOf(fingerprint: string) {
+    return fingerprint.replace(/^SHA256:/, "").replace(/[^A-Za-z0-9]+/g, "-");
+}
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
+    nothing extra is stored anywhere it could be taken from. */
+async function ensureRevokeKey(sourceURL: string) {
+    let keyPath = revokeKeyPath(sourceURL);
+    if (await pathExists(keyPath)) {
+        return keyPath;
+    }
+    let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(sourceURL), "utf8"));
+    await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
+    await fs.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
+    console.log(`Derived the revoke key for ${sourceURL}`);
+    return keyPath;
+}
+
+/** Brings the revoke checkout up to date. Returns false when it cannot be reached, so a missing
+    revoke repo degrades to "keep what we already know" rather than stopping everything. */
+export async function syncRevokeRepo(sourceURL: string) {
+    let repoURL = revokeRepoURL(sourceURL);
+    let repoPath = revokeRepoPath(sourceURL);
+    let keyPath = await ensureRevokeKey(sourceURL);
+    try {
+        if (!await repoIsUsable({ repoPath, keyPath })) {
+            await cloneRepo({ repoURL, repoPath, keyPath });
+            return true;
+        }
+        let localHead = await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+        if (localHead.status !== 0) {
+            // A revoke repo with no commits yet. Nothing has ever been revoked, which is the state
+            // every one of these starts in, so there is nothing to pull and nothing to say.
+            return true;
+        }
+        let head = (await runGit({ args: ["rev-parse", "--abbrev-ref", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
+        let localSha = localHead.stdout.trim();
+        // A ref listing is a few hundred bytes and no objects, so the usual case of nothing having
+        // been revoked anywhere costs almost nothing.
+        let listing = (await runGit({ args: ["ls-remote", "origin", head], cwd: repoPath, keyPath })).stdout;
+        let remoteSha = (listing.split(/\s+/)[0] || "").trim();
+        if (remoteSha && remoteSha === localSha) {
+            return true;
+        }
+        await runGit({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
+        await runGit({ args: ["reset", "--hard", `origin/${head}`], cwd: repoPath, keyPath });
+        await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+        return true;
+    } catch (e) {
+        console.log(`Could not sync ${repoURL}. ${e}`);
+        return false;
+    }
+}
+
+export async function readRevocationFiles(sourceURL: string) {
+    let directory = path.join(revokeRepoPath(sourceURL), REVOCATIONS_DIR);
+    if (!await pathExists(directory)) {
+        return [];
+    }
+    let revocations: { fingerprint: string; revocationId: string }[] = [];
+    for (let name of (await fs.readdir(directory)).sort()) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            if (parsed.fingerprint) {
+                revocations.push({ fingerprint: parsed.fingerprint, revocationId: parsed.revocationId || name.replace(/\.json$/, "") });
+            }
+        } catch (e) {
+            console.log(`Ignoring unreadable revocation ${name}. ${e}`);
+        }
+    }
+    return revocations;
+}
+
+/** Unrevokes live in the source repo, so they are covered by its signature. */
+export async function readUnrevokeIds(sourceURL: string) {
+    let directory = path.join(sourceRepoPath(sourceURL), UNREVOKES_DIR);
+    if (!await pathExists(directory)) {
+        return new Map<string, string>();
+    }
+    let ids = new Map<string, string>();
+    for (let name of (await fs.readdir(directory)).sort()) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let revocationId of parsed.revocationIds || []) {
+                ids.set(revocationId, name.replace(/\.json$/, ""));
+            }
+        } catch (e) {
+            console.log(`Ignoring unreadable unrevoke ${name}. ${e}`);
+        }
+    }
+    return ids;
+}
+
+/** Writes a revocation, unless this key is already revoked. Checked twice: against what this
+    machine already knows, which needs no network, and again against the repo after pulling it,
+    so a flood of unknown keys cannot turn into a flood of commits. */
+export async function recordRevocation(config: {
+    sourceURL: string;
+    fingerprint: string;
+    keyLine: string;
+    attempt: Attempt;
+    hostLabel: string;
+}) {
+    let { sourceURL, fingerprint, keyLine, attempt, hostLabel } = config;
+    let state = getState();
+    if (state.revocations[fingerprint]) {
+        return false;
+    }
+    if (!await syncRevokeRepo(sourceURL)) {
+        console.log(`Cannot record the revocation of ${fingerprint}, ${revokeRepoURL(sourceURL)} is unreachable`);
+        return false;
+    }
+    let revocationId = revocationIdOf(fingerprint);
+    let alreadyThere = (await readRevocationFiles(sourceURL)).some(entry => entry.fingerprint === fingerprint);
+    if (alreadyThere) {
+        // Another machine got there first, which is the normal outcome when several see the same
+        // attempt. Record it locally so we never look again.
+        state.revocations[fingerprint] = {
+            fingerprint, revocationId, unrevokeSeenAt: 0, unrevokeId: "", unrevoked: false,
+            reportedRemoved: false,
+        };
+        await saveState();
+        return false;
+    }
+
+    let repoPath = revokeRepoPath(sourceURL);
+    let keyPath = revokeKeyPath(sourceURL);
+    let directory = path.join(repoPath, REVOCATIONS_DIR);
+    await fs.mkdir(directory, { recursive: true });
+    await fs.writeFile(path.join(directory, `${revocationId}.json`), JSON.stringify({
+        revocationId,
+        fingerprint,
+        key: keyLine,
+        revokedAt: new Date().toISOString(),
+        revokedBy: hostLabel,
+        reason: "used from an address its from= restriction does not allow",
+        attempt,
+    }, undefined, 4) + "\n");
+
+    await runGit({ args: ["add", "-A"], cwd: repoPath, keyPath });
+    await runGit({ args: ["-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", `revoke ${revocationId}`], cwd: repoPath, keyPath });
+    let push = await runGit({ args: ["push", "origin", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+    if (push.status !== 0) {
+        // Most likely another machine pushed the same revocation first. The next check will pull
+        // it and record it, so there is nothing to retry here.
+        console.log(`Could not push the revocation of ${fingerprint}, will pick it up on the next check. ${(push.stdout + push.stderr).trim()}`);
+        return false;
+    }
+    state.revocations[fingerprint] = {
+        fingerprint, revocationId, unrevokeSeenAt: 0, unrevokeId: "", unrevoked: false,
+        reportedRemoved: false,
+    };
+    await saveState();
+    await notify(
+        `revoked \`${keyLine && summarizeKey(keyLine) || fingerprint}\` (\`${fingerprint}\`) after it was`
+        + ` used from \`${attempt.ip}\`, which its from= restriction does not allow (user`
+        + ` \`${attempt.user}\`, allowed \`${attempt.required}\`). Every machine will stop accepting it.`
+        + `\n\nIf this really was an attack, IMMEDIATELY remove that key from \`${sourceURL}\`.`
+        + `\nIf it was legitimate use, run this in \`${sourceURL}\` and deploy it as normal:`
+        + `\n\`\`\`\nyarn unrevoke\nyarn signfiles git\n\`\`\``
+    );
+    return true;
+}
+
+/** Takes everything the revoke repos list into local state. Once here a revocation never leaves,
+    even if the file is deleted: the key that writes revocations is on every server, so an attacker
+    holding it could otherwise erase the record that locked them out. */
+export async function absorbRevocations(sourceURLs: string[]) {
+    let state = getState();
+    let changed = false;
+    for (let sourceURL of sourceURLs) {
+        for (let entry of await readRevocationFiles(sourceURL)) {
+            if (state.revocations[entry.fingerprint]) {
+                continue;
+            }
+            state.revocations[entry.fingerprint] = {
+                fingerprint: entry.fingerprint,
+                revocationId: entry.revocationId,
+                unrevokeSeenAt: 0,
+                unrevokeId: "",
+                unrevoked: false,
+                reportedRemoved: false,
+            };
+            changed = true;
+        }
+    }
+    if (changed) {
+        await saveState();
+    }
+}
+
+/** An unrevoke is held for an hour before it counts, so a signing key that was itself compromised
+    cannot instantly undo the revocation that shut it out. */
+export async function applyUnrevokes(sourceURLs: string[]) {
+    let state = getState();
+    let unrevokeIds = new Map<string, string>();
+    for (let sourceURL of sourceURLs) {
+        for (let [revocationId, unrevokeId] of await readUnrevokeIds(sourceURL)) {
+            unrevokeIds.set(revocationId, unrevokeId);
+        }
+    }
+    for (let revocation of Object.values(state.revocations)) {
+        if (revocation.unrevoked) {
+            continue;
+        }
+        let unrevokeId = unrevokeIds.get(revocation.revocationId);
+        if (!unrevokeId) {
+            continue;
+        }
+        if (!revocation.unrevokeSeenAt) {
+            revocation.unrevokeSeenAt = Date.now();
+            revocation.unrevokeId = unrevokeId;
+            await saveState();
+            await notify(
+                `an unrevoke for \`${revocation.fingerprint}\` was published as \`${unrevokeId}\`.`
+                + ` It will be applied in ${Math.round(UNREVOKE_DELAY / 60000)} minutes, not now.`
+            );
+            continue;
+        }
+        if (Date.now() - revocation.unrevokeSeenAt < UNREVOKE_DELAY) {
+            continue;
+        }
+        revocation.unrevoked = true;
+        revocation.reportedRemoved = false;
+        await saveState();
+        await notify(
+            `the unrevoke of \`${revocation.fingerprint}\` has been applied. The key is accepted again`
+            + ` if it is still in a keys repo.`
+        );
+    }
+}
+
+export function revokedFingerprints() {
+    return new Set(
+        Object.values(getState().revocations)
+            .filter(revocation => !revocation.unrevoked)
+            .map(revocation => revocation.fingerprint)
+    );
+}
+
+/** Drops revoked keys from the merged set, and says so the first time a key actually disappears -
+    which is the thing worth knowing, rather than the mere existence of a revocation. */
+export async function removeRevokedKeys(keys: string[]) {
+    let revoked = revokedFingerprints();
+    if (!revoked.size) {
+        return keys;
+    }
+    let state = getState();
+    let allowed: string[] = [];
+    for (let key of keys) {
+        let fingerprint = keyFingerprint(key);
+        if (!fingerprint || !revoked.has(fingerprint)) {
+            allowed.push(key);
+            continue;
+        }
+        // Said once, when the key actually goes, rather than every check for as long as it is gone.
+        let revocation = state.revocations[fingerprint];
+        if (revocation && !revocation.reportedRemoved) {
+            revocation.reportedRemoved = true;
+            await saveState();
+            await notify(
+                `\`${fingerprint}\` is revoked, so it has been removed from root's authorized_keys`
+                + ` and this machine no longer accepts it.`
+            );
+        }
+    }
+    return allowed;
+}

package/security/authorizedKeys/daemon/rootKeys.ts

@@ -0,0 +1,135 @@
+import fs from "fs/promises";
+import path from "path";
+import { keyFingerprint, keyRestriction, summarizeKey } from "../authorizedKeys";
+import { KEYS_HISTORY_PATH, ROOT_AUTHORIZED_KEYS } from "./paths";
+import { notify } from "./notify";
+
+const KEY_FILE_HEADER = "# Managed by portsecure. Manual changes are reverted and reported.";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** Keys are matched by the key itself, not by the text of the line, so changing which addresses a
+    key may be used from reads as that one key changing rather than as one key leaving and another
+    arriving. A line we cannot read a key out of falls back to the whole line. */
+function keyIdentity(keyLine: string) {
+    return keyFingerprint(keyLine) || keyLine;
+}
+
+export function describeKeyDifference(config: { before: string[]; after: string[] }) {
+    let { before, after } = config;
+    let beforeByKey = new Map(before.map(key => [keyIdentity(key), key]));
+    let afterByKey = new Map(after.map(key => [keyIdentity(key), key]));
+
+    let lines: string[] = [];
+    for (let [identity, keyLine] of afterByKey) {
+        if (!beforeByKey.has(identity)) {
+            lines.push(`+ added   ${summarizeKey(keyLine)}\n          from ${keyRestriction(keyLine)}`);
+        }
+    }
+    for (let [identity, keyLine] of beforeByKey) {
+        if (!afterByKey.has(identity)) {
+            lines.push(`- removed ${summarizeKey(keyLine)}\n          from ${keyRestriction(keyLine)}`);
+        }
+    }
+    for (let [identity, previousLine] of beforeByKey) {
+        let currentLine = afterByKey.get(identity);
+        if (!currentLine || currentLine === previousLine) {
+            continue;
+        }
+        let previousFrom = keyRestriction(previousLine);
+        let currentFrom = keyRestriction(currentLine);
+        if (previousFrom !== currentFrom) {
+            lines.push(
+                `~ changed ${summarizeKey(currentLine)}\n          from ${previousFrom}\n`
+                + `            to ${currentFrom}`
+            );
+            continue;
+        }
+        lines.push(
+            `~ changed ${summarizeKey(currentLine)}\n          from ${currentFrom}\n`
+            + `          its options or comment changed`
+        );
+    }
+    if (!lines.length) {
+        return "(no keys differ)";
+    }
+    return lines.join("\n");
+}
+
+export async function readAuthorizedKeysFile(filePath: string) {
+    if (!await pathExists(filePath)) {
+        return [];
+    }
+    let contents = await fs.readFile(filePath, "utf8");
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+
+export async function writeAuthorizedKeysFile(config: { filePath: string; keys: string[] }) {
+    let { filePath, keys } = config;
+    let directory = path.dirname(filePath);
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    await fs.chmod(directory, 0o700);
+    // Written to a temporary file first, so an interrupted write can never leave root with a
+    // truncated authorized_keys and no way back in.
+    let temporaryPath = `${filePath}.portsecure-tmp`;
+    await fs.writeFile(temporaryPath, `${KEY_FILE_HEADER}\n${keys.join("\n")}\n`, { mode: 0o600 });
+    await fs.rename(temporaryPath, filePath);
+}
+
+/** Keeps a copy of whatever is about to be overwritten, named for the moment it was replaced.
+    Recovers a key that was clobbered by mistake, and doubles as the history of who had access.
+    The very first archive is the most valuable one, since it holds the keys from before portsecure
+    took the file over. */
+export async function archiveAuthorizedKeys(config: { filePath: string; reason: string }) {
+    let { filePath, reason } = config;
+    if (!await pathExists(filePath)) {
+        return "";
+    }
+    let contents = await fs.readFile(filePath, "utf8");
+    await fs.mkdir(KEYS_HISTORY_PATH, { recursive: true, mode: 0o700 });
+    await fs.chmod(KEYS_HISTORY_PATH, 0o700);
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let archivePath = path.join(KEYS_HISTORY_PATH, `${stamp}-${reason}.authorized_keys`);
+    let attempt = 1;
+    while (await pathExists(archivePath)) {
+        attempt++;
+        archivePath = path.join(KEYS_HISTORY_PATH, `${stamp}-${reason}-${attempt}.authorized_keys`);
+    }
+    await fs.writeFile(archivePath, contents, { mode: 0o600 });
+    return archivePath;
+}
+
+/** Puts the allowed keys back in place if anything else changed them. */
+export async function enforceRootKeys(config: { keys: string[]; reason: string }) {
+    let { keys, reason } = config;
+    if (!keys.length) {
+        // No sources, or none of them readable. Writing an empty file would lock everyone out, so
+        // whatever access is already in place stays exactly as it is.
+        console.log(`No keys came from any source, leaving ${ROOT_AUTHORIZED_KEYS} as it is`);
+        return;
+    }
+    let currentKeys = await readAuthorizedKeysFile(ROOT_AUTHORIZED_KEYS);
+    let matches = currentKeys.length === keys.length && currentKeys.every((key, index) => key === keys[index]);
+    if (matches) {
+        return;
+    }
+    let archivePath = await archiveAuthorizedKeys({ filePath: ROOT_AUTHORIZED_KEYS, reason });
+    await writeAuthorizedKeysFile({ filePath: ROOT_AUTHORIZED_KEYS, keys });
+    let difference = describeKeyDifference({ before: currentKeys, after: keys });
+    let archiveNote = archivePath && `\nThe previous file is kept at \`${archivePath}\`.` || "";
+    if (reason === "repo") {
+        await notify(`root's authorized_keys was updated from the keys repo.\n\`\`\`\n${difference}\n\`\`\`${archiveNote}`);
+        return;
+    }
+    await notify(
+        `root's authorized_keys was changed outside portsecure and has been reverted to the keys repo.`
+        + `\n\`\`\`\n${difference}\n\`\`\`${archiveNote}`
+    );
+}

package/security/authorizedKeys/daemon/sshdConfig.ts

@@ -0,0 +1,85 @@
+import fs from "fs/promises";
+import { spawnPromise } from "../../helpers/spawn";
+import { MAX_ERROR_BODY_LENGTH, SSHD_CONFIG_PATH, SSHD_DROPIN_DIR, SSHD_DROPIN_PATH } from "./paths";
+
+// VERBOSE is what makes sshd name the key a refused attempt used, which is the whole basis for
+// revoking it. Without it the log says an attempt was refused but not by whom.
+const SSHD_DROPIN_CONTENTS = `# Managed by portsecure. Manual changes are reverted and reported.
+# Keys come from the portsecure repo, so no other authentication method may be used.
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+PubkeyAuthentication yes
+PermitRootLogin prohibit-password
+LogLevel VERBOSE
+`;
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+async function sshdConfigIncludesDropinDir() {
+    let contents = await fs.readFile(SSHD_CONFIG_PATH, "utf8");
+    return contents.split("\n").some(line => {
+        let trimmed = line.trim();
+        return trimmed.startsWith("Include") && trimmed.includes("sshd_config.d");
+    });
+}
+
+async function restartSSHD() {
+    for (let unit of ["ssh", "sshd"]) {
+        let result = await spawnPromise({ command: "systemctl", args: ["reload-or-restart", unit] });
+        if (result.status === 0) {
+            return unit;
+        }
+    }
+    throw new Error(`Expected to reload ssh or sshd, neither unit could be reloaded`);
+}
+
+/** Turns off every non key based way in. Validates before reloading, because a bad sshd config
+    that gets applied is exactly how a machine becomes unreachable. */
+export async function enforceSSHDConfig() {
+    let existing = "";
+    if (await pathExists(SSHD_DROPIN_PATH)) {
+        existing = await fs.readFile(SSHD_DROPIN_PATH, "utf8");
+    }
+    let includeMissing = !await sshdConfigIncludesDropinDir();
+    if (existing === SSHD_DROPIN_CONTENTS && !includeMissing) {
+        return;
+    }
+
+    let originalConfig = await fs.readFile(SSHD_CONFIG_PATH, "utf8");
+    await fs.mkdir(SSHD_DROPIN_DIR, { recursive: true });
+    await fs.writeFile(SSHD_DROPIN_PATH, SSHD_DROPIN_CONTENTS, { mode: 0o644 });
+    if (includeMissing) {
+        // sshd takes the first value it sees for most keywords, so the include has to come before
+        // any setting it is meant to override.
+        await fs.writeFile(SSHD_CONFIG_PATH, `Include ${SSHD_DROPIN_DIR}/*.conf\n${originalConfig}`);
+    }
+
+    let validation = await spawnPromise({ command: "sshd", args: ["-t"] });
+    if (validation.error) {
+        validation = await spawnPromise({ command: "/usr/sbin/sshd", args: ["-t"] });
+    }
+    if (validation.status !== 0) {
+        // Roll back rather than leave a config that sshd would refuse on its next start.
+        await fs.rm(SSHD_DROPIN_PATH, { force: true });
+        if (includeMissing) {
+            await fs.writeFile(SSHD_CONFIG_PATH, originalConfig);
+        }
+        console.log(
+            `sshd rejected the portsecure config, rolled it back. `
+            + `${(validation.stdout + validation.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+        return;
+    }
+
+    let unit = await restartSSHD();
+    console.log(`Password authentication disabled, reloaded ${unit}`);
+}

package/security/authorizedKeys/daemon/state.ts

@@ -0,0 +1,108 @@
+import fs from "fs/promises";
+import path from "path";
+import { STATE_PATH } from "./paths";
+
+/** What we last decided to trust for one source, kept on disk so nobody can tell us a different
+    story about what we saw last time. */
+export type SourceState = {
+    lastSha: string;
+    branch: string;
+    accepted: boolean;
+    acceptedSigner: string;
+    acceptedKeys: string[];
+    acceptedManifestHash: string;
+    acceptedSignatureHash: string;
+    pendingSigner: string;
+    pendingSince: number;
+    reportedProblem: string;
+};
+
+/** A key this machine has stopped accepting. Kept even when the revoke repo no longer lists it:
+    the deploy key that writes revocations lives on every server, so an attacker who took one could
+    otherwise delete the revocation that locked them out. */
+export type RevocationState = {
+    fingerprint: string;
+    revocationId: string;
+    // Set once an unrevoke has been seen, so the wait can be served out across restarts.
+    unrevokeSeenAt: number;
+    unrevokeId: string;
+    unrevoked: boolean;
+    // Whether we have said that this key actually left root's authorized_keys. The removal is the
+    // thing worth reporting, and it is worth reporting exactly once.
+    reportedRemoved: boolean;
+};
+
+/** A refusal we saw but could not write down yet. Held until it is recorded, because the log is
+    read once and moves on: losing one of these to a repo that happened to be unreachable would
+    leave a key that was misused accepted forever. */
+export type PendingRevocation = {
+    fingerprint: string;
+    keyLine: string;
+    sourceURL: string;
+    attempt: { ip: string; user: string; port: string; required: string; line: string };
+};
+
+export type DaemonState = {
+    sources: { [repoURL: string]: SourceState };
+    userKeyHashes: { [userName: string]: string };
+    revocations: { [fingerprint: string]: RevocationState };
+    pendingRevocations: PendingRevocation[];
+    // Where we had read up to in the auth log, so a restart does not re-report old attempts.
+    authLogOffset: number;
+    authLogSignature: string;
+};
+
+let state: DaemonState = {
+    sources: {},
+    userKeyHashes: {},
+    revocations: {},
+    pendingRevocations: [],
+    authLogOffset: 0,
+    authLogSignature: "",
+};
+
+export function getState() {
+    return state;
+}
+
+/** Per source progress, created on first use so a newly added source starts clean. */
+export function sourceState(repoURL: string) {
+    let existing = state.sources[repoURL];
+    if (existing) {
+        return existing;
+    }
+    let created: SourceState = {
+        lastSha: "",
+        branch: "",
+        accepted: false,
+        acceptedSigner: "",
+        acceptedKeys: [],
+        acceptedManifestHash: "",
+        acceptedSignatureHash: "",
+        pendingSigner: "",
+        pendingSince: 0,
+        reportedProblem: "",
+    };
+    state.sources[repoURL] = created;
+    return created;
+}
+
+export async function loadState() {
+    let contents;
+    try {
+        contents = await fs.readFile(STATE_PATH, "utf8");
+    } catch (e) {
+        return;
+    }
+    try {
+        state = Object.assign(state, JSON.parse(contents));
+    } catch (e) {
+        // Corrupt state only costs us one duplicate notification, so it is not worth failing over.
+        console.log(`Ignoring unreadable state file ${STATE_PATH}. ${e}`);
+    }
+}
+
+export async function saveState() {
+    await fs.mkdir(path.dirname(STATE_PATH), { recursive: true });
+    await fs.writeFile(STATE_PATH, JSON.stringify(state, undefined, 4), { mode: 0o600 });
+}