sliftutils 1.7.126 → 1.7.128

package/bin/testnotify.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Sends one message to a webhook, to prove notifications work.
+require("typenode");
+
+require("../security/notifications/testNotify").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.126",
+    "version": "1.7.128",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -33,7 +33,8 @@
         "securessh": "node ./bin/securessh.js",
         "signfiles": "node ./bin/signfiles.js",
         "derivekey": "node ./bin/derivekey.js",
-        "unrevoke": "node ./bin/unrevoke.js"
+        "unrevoke": "node ./bin/unrevoke.js",
+        "testnotify": "node ./bin/testnotify.js"
     },
     "bin": {
         "filehoster": "./bin/filehoster.js",
@@ -56,7 +57,8 @@
         "signfiles": "./bin/signfiles.js",
         "derivekey": "./bin/derivekey.js",
         "portsecuredaemon": "./bin/portsecuredaemon.js",
-        "unrevoke": "./bin/unrevoke.js"
+        "unrevoke": "./bin/unrevoke.js",
+        "testnotify": "./bin/testnotify.js"
     },
     "dependencies": {
         "@types/chrome": "^0.0.237",

package/security/authorizedKeys/authorizedKeys.ts

@@ -2,11 +2,6 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 
-// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
-// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
-// must agree on which keys a repo produces - if you change one, make the matching change in the
-// other.
-
 export function normalizeKeys(contents: string) {
     return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
 }
@@ -23,14 +18,26 @@ export function keyFingerprint(keyLine: string) {
     return "SHA256:" + crypto.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
 }
 
+export const NO_RESTRICTION = "ANY ADDRESS (no from= restriction)";
+
+/** The addresses a key may be used from, one by one, or undefined when the key carries no from=
+    at all. Undefined and an empty list are very different things, so they stay distinguishable. */
+export function keyRestrictionList(keyLine: string) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return undefined;
+    }
+    return match[1].split(",").map(entry => entry.trim()).filter(entry => entry);
+}
+
 /** The addresses a key may be used from, which is the part of an authorized_keys line that
     decides how much a stolen key is worth. A key with no restriction says so loudly. */
 export function keyRestriction(keyLine: string) {
-    let match = keyLine.match(/from="([^"]*)"/);
-    if (!match) {
-        return "ANY ADDRESS (no from= restriction)";
+    let list = keyRestrictionList(keyLine);
+    if (!list) {
+        return NO_RESTRICTION;
     }
-    return match[1];
+    return list.join(",");
 }
 
 /** Enough to recognise whose key this is without printing the whole blob. */
@@ -46,6 +53,39 @@ export function summarizeKey(keyLine: string) {
     return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
 }
 
+/** What a set of keys has to satisfy before it is worth signing, as a list of complaints.
+
+    Every key needs a from=, because an unrestricted key can never be caught being used from the
+    wrong place, and being caught is the only thing that triggers a revocation.
+
+    No two keys may allow the same addresses, because that is one person holding two keys: revoking
+    one of them leaves the other working, so the revocation achieves nothing. */
+export function findKeyProblems(keys: string[]) {
+    let problems: string[] = [];
+    let byRestriction = new Map<string, string[]>();
+    for (let key of keys) {
+        let restriction = keyRestrictionList(key);
+        if (!restriction) {
+            problems.push(`no from= restriction, so it can be used from anywhere:\n      ${summarizeKey(key)}`);
+            continue;
+        }
+        // Sorted, so the same addresses written in a different order still count as the same.
+        let identity = [...restriction].sort().join(",");
+        byRestriction.set(identity, [...(byRestriction.get(identity) || []), key]);
+    }
+    for (let [restriction, sharing] of byRestriction) {
+        if (sharing.length < 2) {
+            continue;
+        }
+        problems.push(
+            `${sharing.length} keys allow exactly the same addresses (${restriction}), which is one`
+            + ` person holding more than one key:\n`
+            + sharing.map(key => `      ${summarizeKey(key)}`).join("\n")
+        );
+    }
+    return problems;
+}
+
 /** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
     file and otherwise concatenates every .pub at the top level. */
 export async function readRepoKeys(repoPath: string) {

package/security/authorizedKeys/daemon/authLog.ts

@@ -1,5 +1,7 @@
 import crypto from "crypto";
+import { watch } from "fs";
 import fs from "fs/promises";
+import path from "path";
 import { spawnPromise } from "../../helpers/spawn";
 import { AUTH_LOG_PATH } from "./paths";
 import { getState, saveState } from "./state";
@@ -15,11 +17,29 @@ const SIGNATURE_LENGTH = 512;
 
 export type RefusedAttempt = { fingerprint: string; attempt: Attempt };
 
+// The two halves of one refusal are separate log lines, written milliseconds apart, and a watcher
+// woken by the first of them reads only as far as that. So the halves are kept between reads and
+// paired when both have arrived, keyed by the connection's process id.
+let refusals = new Map<string, { user: string; ip: string; required: string; line: string }[]>();
+let fingerprints = new Map<string, { fingerprint: string; port: string }>();
+// A half that never finds its other half would otherwise sit there forever. Maps keep insertion
+// order, so the oldest are the ones to drop.
+const MAX_HALVES = 500;
+
+function forget(half: Map<string, unknown>) {
+    while (half.size > MAX_HALVES) {
+        let oldest = half.keys().next().value;
+        if (oldest === undefined) {
+            return;
+        }
+        half.delete(oldest);
+    }
+}
+
 /** Pairs each refusal with the fingerprint sshd logged for the same connection. A refusal we
-    cannot tie to a key is dropped: revoking the wrong key would lock out the wrong person. */
+    cannot tie to a key is held rather than acted on: revoking the wrong key would lock out the
+    wrong person, and the line naming the key usually arrives a moment later. */
 export function parseAuthLog(contents: string) {
-    let refusals = new Map<string, { user: string; ip: string; required: string; line: string }[]>();
-    let fingerprints = new Map<string, { fingerprint: string; port: string }>();
     for (let line of contents.split("\n")) {
         let processMatch = line.match(PROCESS_ID);
         if (!processMatch) {
@@ -40,10 +60,11 @@ export function parseAuthLog(contents: string) {
     }
 
     let attempts: RefusedAttempt[] = [];
-    for (let [processId, entries] of refusals) {
+    for (let [processId, entries] of [...refusals]) {
         let key = fingerprints.get(processId);
         if (!key) {
-            console.log(`A refused attempt named no key, so nothing is being revoked for it: ${entries[0].line}`);
+            // The line naming the key has not been written yet, or not been read yet. Kept for the
+            // next read rather than thrown away.
             continue;
         }
         for (let entry of entries) {
@@ -58,7 +79,12 @@ export function parseAuthLog(contents: string) {
                 },
             });
         }
+        // Paired, so neither half is needed again.
+        refusals.delete(processId);
+        fingerprints.delete(processId);
     }
+    forget(refusals);
+    forget(fingerprints);
     return attempts;
 }
 
@@ -115,3 +141,46 @@ export async function readNewAuthLog() {
         await handle.close();
     }
 }
+
+/** Reacts when sshd writes, rather than on a timer. A refused login is worth acting on at once,
+    and nothing is gained by hearing about it up to a minute later.
+
+    The directory is watched rather than the file. A watch on the file follows the inode, so it
+    goes silent the moment the log is rotated out from under it, while the directory keeps
+    reporting both the writes and the rotation. */
+export function watchAuthLog(onChange: () => Promise<void>) {
+    let running = false;
+    let againWhenDone = false;
+    let run = async () => {
+        // One at a time. Whatever arrives mid run is covered by a single further pass, rather than
+        // by however many events happened to fire.
+        if (running) {
+            againWhenDone = true;
+            return;
+        }
+        running = true;
+        try {
+            await onChange();
+        } catch (e) {
+            console.log(`Reading ${AUTH_LOG_PATH} failed. ${e}`);
+        }
+        running = false;
+        if (againWhenDone) {
+            againWhenDone = false;
+            void run();
+        }
+    };
+
+    let name = path.basename(AUTH_LOG_PATH);
+    try {
+        watch(path.dirname(AUTH_LOG_PATH), (type, changed) => {
+            if (changed === name) {
+                void run();
+            }
+        });
+        console.log(`Watching ${AUTH_LOG_PATH} for refused logins`);
+    } catch (e) {
+        console.log(`Cannot watch ${AUTH_LOG_PATH}, so refused logins will not be noticed. ${e}`);
+    }
+    return run;
+}

package/security/authorizedKeys/daemon/changes.ts

@@ -0,0 +1,26 @@
+// Why root's authorized_keys is about to change, collected as it happens.
+//
+// Nothing announces itself at the moment it decides something. A revocation arriving, a key being
+// revoked here, an unrevoke taking effect, a repo moving on: each of those says what it is and
+// leaves it here. The file is then written, and only if it actually came out different does any of
+// it get reported, in one message.
+//
+// Doing it the other way round is what produced several messages for one event, and messages about
+// removing a key that had already gone.
+
+let reasons: string[] = [];
+
+export function addChangeReason(reason: string) {
+    // The same reason twice in one pass says nothing the once did not.
+    if (!reasons.includes(reason)) {
+        reasons.push(reason);
+    }
+}
+
+/** The reasons gathered since the last write, and clears them. Called whether or not anything
+    changed, so reasons that came to nothing cannot show up against some later change. */
+export function takeChangeReasons() {
+    let taken = reasons;
+    reasons = [];
+    return taken;
+}

package/security/authorizedKeys/daemon/daemon.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import os from "os";
 import { configureDiscordNotifications, DEFAULT_WEBHOOK_FILE_PATH } from "../../notifications/discord";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, legacySourceKeyPath, sourceKeyPath, sourceRepoPath } from "../sources";
 import { cloneRepo, syncRepo } from "./git";
 import {
     CHECK_INTERVAL,
@@ -14,9 +14,10 @@ import { enforceRootKeys } from "./rootKeys";
 import { enforceSSHDConfig } from "./sshdConfig";
 import { getState, loadState, saveState, sourceState } from "./state";
 import { resolveSourceKeys } from "./trust";
-import { parseAuthLog, readNewAuthLog } from "./authLog";
+import { parseAuthLog, readNewAuthLog, watchAuthLog } from "./authLog";
 import { absorbRevocations, applyUnrevokes, recordRevocation, removeRevokedKeys, syncRevokeRepo } from "./revocation";
 import { keyFingerprint } from "../authorizedKeys";
+import { addChangeReason } from "./changes";
 import { checkOtherUserKeys, seedUserKeys } from "./userKeys";
 
 // portsecure authorized-keys daemon.
@@ -26,19 +27,21 @@ import { checkOtherUserKeys, seedUserKeys } from "./userKeys";
 //
 // The complete list of things that send a Discord message. Nothing else may be added to it
 // without the user asking for that specific case - everything else goes to the log.
-//   1. root's authorized_keys was changed outside portsecure, and was reverted.
-//   2. root's authorized_keys was updated because a source changed.
-//   3. Another user's authorized_keys changed.
+//
+// Anything that changes which keys root may use says nothing at the time. It leaves its reason
+// with addChangeReason, the file is written, and if it came out different that one message carries
+// the difference and every reason behind it. Announcing at the point of deciding is what produced
+// several messages for one event, and messages about removing a key that was already gone.
+//   1. root's authorized_keys changed, with what changed and why: a key revoked here, a revocation
+//      published elsewhere, an unrevoke taking effect, a source moving on.
+//   2. root's authorized_keys was edited by something else, and was put back.
+//   3. Another user's authorized_keys changed. A different file, and not one we manage.
 //   4. A source's history was rewritten.
 //   5. A source started being signed by a different key, so its new keys are being held.
 //   6. A source is now signed when it was not before, applied right away.
 //   7. A source changed without its signature being updated, so the change is ignored.
 //   8. A source has a corrupted signature, so its contents are ignored.
 //   9. The webhook file itself changed, reported to the webhook being replaced.
-//  10. A key was revoked here, after being used from an address it is not allowed from.
-//  11. A revoked key was removed from root's authorized_keys, said once per key.
-//  12. An unrevoke was published, and is being held for an hour.
-//  13. An unrevoke was applied once that hour passed.
 
 export type DaemonConfig = {
     repoSources: string[];
@@ -71,10 +74,11 @@ async function loadConfig(): Promise<DaemonConfig> {
         process.exit(1);
     }
     for (let repoURL of parsed.repoSources) {
-        try {
-            await fs.access(sourceKeyPath(repoURL));
-        } catch (e) {
-            console.error(`portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}, ${e}`);
+        if (!await findSourceKey(repoURL)) {
+            console.error(
+                `portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}`
+                + ` or ${legacySourceKeyPath(repoURL)}, neither exists`
+            );
             process.exit(1);
         }
     }
@@ -157,24 +161,41 @@ async function queueRefusedKeys(allowedKeys: string[]) {
     await saveState();
 }
 
+// The log watcher and the periodic check both reach this, and two of them pushing to the same
+// revoke repo at once would only fight each other.
+let writingQueued = false;
+
 /** Writes down everything queued that we have not managed to write down yet. */
 async function writeQueuedRevocations() {
     let state = getState();
-    if (!state.pendingRevocations.length) {
+    if (!state.pendingRevocations.length || writingQueued) {
         return;
     }
-    let remaining = [];
-    for (let pending of state.pendingRevocations) {
-        if (state.revocations[pending.fingerprint]) {
-            continue;
-        }
-        let recorded = await recordRevocation({ ...pending, hostLabel: config.hostLabel });
-        if (!recorded && !state.revocations[pending.fingerprint]) {
-            remaining.push(pending);
+    writingQueued = true;
+    try {
+        let remaining = [];
+        for (let pending of state.pendingRevocations) {
+            if (state.revocations[pending.fingerprint]) {
+                continue;
+            }
+            let recorded = await recordRevocation({ ...pending, hostLabel: config.hostLabel });
+            if (!recorded && !state.revocations[pending.fingerprint]) {
+                remaining.push(pending);
+            }
         }
+        state.pendingRevocations = remaining;
+        await saveState();
+    } finally {
+        writingQueued = false;
     }
-    state.pendingRevocations = remaining;
-    await saveState();
+}
+
+/** Everything the arrival of a refused login needs: read what is new, queue it, write it down.
+    Kept small, and off the merged key set the periodic check rebuilds, so reacting to a log line
+    cannot race that check. */
+async function onAuthLogChanged() {
+    await queueRefusedKeys(getState().appliedKeys);
+    await writeQueuedRevocations();
 }
 
 /** Syncs one source. Returns whether the merged keys need reapplying. */
@@ -193,7 +214,7 @@ async function pollSource(repoURL: string) {
         // Availability over tidiness: throw the working copy away and start again.
         console.log(`Discarding the checkout of ${repoURL} and cloning from scratch`);
         try {
-            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: sourceKeyPath(repoURL) });
+            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: await findSourceKey(repoURL) || sourceKeyPath(repoURL) });
             repoFailureCounts[repoURL] = 0;
             return true;
         } catch (cloneError) {
@@ -212,6 +233,9 @@ async function pollSource(repoURL: string) {
     if (!result.changed) {
         return false;
     }
+    // Said when the file is written, and only if it came out different. A commit that does not
+    // touch the keys is not worth telling anyone about.
+    addChangeReason(`\`${repoURL}\` moved to \`${result.remoteSha.slice(0, 12)}\`.`);
     sourceState(repoURL).lastSha = result.remoteSha;
     return true;
 }
@@ -238,12 +262,11 @@ async function everyCheck() {
     await applyUnrevokes(config.repoSources);
 
     let mergedKeys = await readAllowedKeys();
-    await queueRefusedKeys(mergedKeys);
+    // The log is watched, not polled. This is only the retry for anything that could not be
+    // written down when it happened, because the revoke repo was unreachable.
     await writeQueuedRevocations();
 
-    // The repo is checked first, so a change that came from it is reported as an update rather
-    // than as somebody having edited the file locally.
-    await enforceRootKeys({ keys: await removeRevokedKeys(mergedKeys), reason: anyChanged && "repo" || "manual" });
+    await enforceRootKeys(await removeRevokedKeys(mergedKeys));
     await checkOtherUserKeys();
     await enforceSSHDConfig();
 }
@@ -292,12 +315,17 @@ export async function main() {
         await syncRevokeRepo(repoURL);
     }
     await absorbRevocations(config.repoSources);
-    await enforceRootKeys({ keys: await removeRevokedKeys(await readAllowedKeys()), reason: "repo" });
+    await enforceRootKeys(await removeRevokedKeys(await readAllowedKeys()));
     await enforceSSHDConfig();
 
     // configureDiscordNotifications watches the webhook file on its own, so there is nothing to
     // schedule for it here.
     startInterval({ name: "check", intervalTime: CHECK_INTERVAL, run: everyCheck });
+
+    // A refused login is acted on when sshd writes it. The one pass here covers anything written
+    // while the daemon was not running.
+    let readAuthLogNow = watchAuthLog(onAuthLogChanged);
+    await readAuthLogNow();
 }
 
 process.on("uncaughtException", e => console.log(`Uncaught exception, staying up. ${e && e.stack || e}`));

package/security/authorizedKeys/daemon/git.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import path from "path";
 import { spawnPromise } from "../../helpers/spawn";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
 import { GIT_TIMEOUT, MAX_ERROR_BODY_LENGTH } from "./paths";
 import { sourceState } from "./state";
 
@@ -68,7 +68,7 @@ export async function currentBranch(config: { repoPath: string; keyPath: string
 
 async function ensureSourceRepo(repoURL: string) {
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     if (!await repoIsUsable({ repoPath, keyPath })) {
         await cloneRepo({ repoURL, repoPath, keyPath });
     }
@@ -82,7 +82,7 @@ async function ensureSourceRepo(repoURL: string) {
 export async function syncRepo(repoURL: string) {
     await ensureSourceRepo(repoURL);
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     let branch = sourceState(repoURL).branch;
     let localSha = (await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
 

package/security/authorizedKeys/daemon/revocation.ts

@@ -1,11 +1,14 @@
 import fs from "fs/promises";
 import path from "path";
 import { keyFingerprint, summarizeKey } from "../authorizedKeys";
-import { deriveRevokeKey, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { deriveRevokeKey, findRevokeKey, REVOKE_KEY_LABEL, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
 import { cloneRepo, repoIsUsable, runGit } from "./git";
+import { messageTimestamp } from "../../notifications/discord";
 import { UNREVOKE_DELAY } from "./paths";
 import { notify } from "./notify";
+import { addChangeReason } from "./changes";
+import { describeAllEnded, endAllSSHSessions } from "./sessions";
 import { getState, saveState } from "./state";
 
 // One revocation per key, ever. Naming the file after the fingerprint is what makes that true:
@@ -37,14 +40,20 @@ async function pathExists(filePath: string) {
 /** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
     nothing extra is stored anywhere it could be taken from. */
 async function ensureRevokeKey(sourceURL: string) {
-    let keyPath = revokeKeyPath(sourceURL);
-    if (await pathExists(keyPath)) {
-        return keyPath;
+    let existing = await findRevokeKey(sourceURL);
+    if (existing) {
+        return existing;
+    }
+    let sourceKey = await findSourceKey(sourceURL);
+    if (!sourceKey) {
+        throw new Error(`Expected a key for ${sourceURL} at ${sourceKeyPath(sourceURL)}, no such file exists`);
     }
-    let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(sourceURL), "utf8"));
+    let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+    let keyPath = revokeKeyPath(sourceURL);
     await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
     await fs.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
-    console.log(`Derived the revoke key for ${sourceURL}`);
+    await fs.writeFile(`${keyPath}.pub`, `${derived.publicKey} ${REVOKE_KEY_LABEL}\n`, { mode: 0o644 });
+    console.log(`Derived the revoke key for ${sourceURL} into ${keyPath}`);
     return keyPath;
 }
 
@@ -162,7 +171,7 @@ export async function recordRevocation(config: {
     }
 
     let repoPath = revokeRepoPath(sourceURL);
-    let keyPath = revokeKeyPath(sourceURL);
+    let keyPath = await ensureRevokeKey(sourceURL);
     let directory = path.join(repoPath, REVOCATIONS_DIR);
     await fs.mkdir(directory, { recursive: true });
     await fs.writeFile(path.join(directory, `${revocationId}.json`), JSON.stringify({
@@ -186,16 +195,21 @@ export async function recordRevocation(config: {
     }
     state.revocations[fingerprint] = {
         fingerprint, revocationId, unrevokeSeenAt: 0, unrevokeId: "", unrevoked: false,
-        reportedRemoved: false,
+        // The message below already says this machine has stopped accepting the key, so the one
+        // about noticing a revocation would only repeat it.
+        reportedRemoved: true,
     };
     await saveState();
-    await notify(
-        `revoked \`${keyLine && summarizeKey(keyLine) || fingerprint}\` (\`${fingerprint}\`) after it was`
-        + ` used from \`${attempt.ip}\`, which its from= restriction does not allow (user`
-        + ` \`${attempt.user}\`, allowed \`${attempt.required}\`). Every machine will stop accepting it.`
-        + `\n\nIf this really was an attack, IMMEDIATELY remove that key from \`${sourceURL}\`.`
-        + `\nIf it was legitimate use, run this in \`${sourceURL}\` and deploy it as normal:`
-        + `\n\`\`\`\nyarn unrevoke\nyarn signfiles git\n\`\`\``
+    let ended = describeAllEnded(await endAllSSHSessions());
+    // Said when the file is written, not here, so one event produces one message.
+    addChangeReason(
+        `**AUTHENTICATED ACCESS FROM AN UNAPPROVED IP: \`${attempt.ip}\`** The key was correct, so`
+        + ` either someone else has this key, or a developer's IP has changed.`
+        + `\nkey \`${keyLine && summarizeKey(keyLine) || fingerprint}\` (\`${fingerprint}\`)`
+        + `\ntried as user \`${attempt.user}\`, and is only allowed from \`${attempt.required}\``
+        + `\nThat key is now revoked everywhere.${ended}`
+        + `\nIf this really was an attack, IMMEDIATELY remove that key from \`${sourceURL}\`.`
+        + `\nIf it was legitimate use, run this in \`${sourceURL}\`: \`yarn unrevoke git\``
     );
     return true;
 }
@@ -249,9 +263,11 @@ export async function applyUnrevokes(sourceURLs: string[]) {
             revocation.unrevokeSeenAt = Date.now();
             revocation.unrevokeId = unrevokeId;
             await saveState();
-            await notify(
-                `an unrevoke for \`${revocation.fingerprint}\` was published as \`${unrevokeId}\`.`
-                + ` It will be applied in ${Math.round(UNREVOKE_DELAY / 60000)} minutes, not now.`
+            // Nothing has changed yet, so nobody is told. Whoever published it was already told it
+            // takes an hour, and every machine seeing the same unrevoke would say so separately.
+            console.log(
+                `Holding the unrevoke ${unrevokeId} for ${revocation.fingerprint} until`
+                + ` ${messageTimestamp(new Date(revocation.unrevokeSeenAt + UNREVOKE_DELAY))}`
             );
             continue;
         }
@@ -261,10 +277,8 @@ export async function applyUnrevokes(sourceURLs: string[]) {
         revocation.unrevoked = true;
         revocation.reportedRemoved = false;
         await saveState();
-        await notify(
-            `the unrevoke of \`${revocation.fingerprint}\` has been applied. The key is accepted again`
-            + ` if it is still in a keys repo.`
-        );
+        // Only means anything if the key comes back into the file, so it is said there.
+        addChangeReason(`the unrevoke of \`${revocation.fingerprint}\` has taken effect, ${unrevokeId}.`);
     }
 }
 
@@ -285,22 +299,37 @@ export async function removeRevokedKeys(keys: string[]) {
     }
     let state = getState();
     let allowed: string[] = [];
+    let dropped: string[] = [];
     for (let key of keys) {
         let fingerprint = keyFingerprint(key);
         if (!fingerprint || !revoked.has(fingerprint)) {
             allowed.push(key);
             continue;
         }
-        // Said once, when the key actually goes, rather than every check for as long as it is gone.
+        dropped.push(fingerprint);
         let revocation = state.revocations[fingerprint];
-        if (revocation && !revocation.reportedRemoved) {
-            revocation.reportedRemoved = true;
-            await saveState();
-            await notify(
-                `\`${fingerprint}\` is revoked, so it has been removed from root's authorized_keys`
-                + ` and this machine no longer accepts it.`
-            );
+        if (!revocation || revocation.reportedRemoved) {
+            continue;
         }
+        revocation.reportedRemoved = true;
+        await saveState();
+        // Nothing to do if the key is not in the file. It left long ago, and this is a machine that
+        // restarted and read the revocation back out of the repo.
+        if (!state.appliedKeys.includes(key)) {
+            continue;
+        }
+        // Whatever that key is holding open goes with it.
+        let ended = describeAllEnded(await endAllSSHSessions());
+        addChangeReason(`a revocation for \`${fingerprint}\` was published elsewhere.${ended}`);
+    }
+    // Said on every check, not once. A key being held out of authorized_keys is the current state
+    // of the machine, and someone reading the log to work out why a key does not work should find
+    // the answer there rather than having to know what to search the history for.
+    if (dropped.length) {
+        console.log(
+            `Dropped ${dropped.length} revoked key(s) from the merged set, ${allowed.length} left.`
+            + ` Revoked: ${dropped.join(", ")}`
+        );
     }
     return allowed;
 }