sliftutils 1.7.126 → 1.7.128

package/security/authorizedKeys/secureSSH.ts

@@ -3,12 +3,13 @@ import os from "os";
 import path from "path";
 import { DEFAULT_WEBHOOK_FILE_PATH, parseWebhookFile } from "../notifications/discord";
 import { normalizeKeys, readRepoKeys, summarizeKey } from "./authorizedKeys";
-import { sourceKeyPath, sourceRepoPath } from "./sources";
+import { findSourceKey, KEYS_DIR_NAME, sourceKeyPath, sourceName, sourceRepoPath } from "./sources";
 import { deriveRevokeKey, REVOKE_KEY_LABEL, revokeRepoURL } from "./revokeSource";
+import { legacySourceKeyPath } from "./sources";
 import { revokedKeysInRepo } from "./unrevoke";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
-import { readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, writeRemoteFile } from "../helpers/remoteSSH";
+import { describeHost, readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, THIS_MACHINE, writeRemoteFile } from "../helpers/remoteSSH";
 
 const SERVICE_SOURCE = path.join(__dirname, "daemon", "portsecure.service");
 // The daemon runs from a checkout of this repo on the host, rather than from a copy we upload, so
@@ -22,12 +23,16 @@ const ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 const SERVICE_NAME = "portsecure";
 const MAX_ERROR_BODY_LENGTH = 500;
 const VERBS = ["add", "remove", "list", "update"];
-// The repo url is optional, and defaults to the repo the command is run from.
+// The host is optional, and without one everything happens on this machine. The repo url is
+// optional too, and defaults to the repo the command is run from.
 const USAGE = `Usage:
-  yarn securessh <host> add <repo-private-key> [repo-url]
-  yarn securessh <host> remove [repo-url]
-  yarn securessh <host> list
-  yarn securessh <host> update`;
+  yarn securessh [host] add <repo-private-key> [repo-url]
+  yarn securessh [host] remove [repo-url]
+  yarn securessh [host] list
+  yarn securessh [host] update
+
+With no host it acts on this machine, and still installs from github rather than from wherever
+this was run.`;
 
 async function pathExists(filePath: string) {
     try {
@@ -121,6 +126,27 @@ async function fingerprintKeys(keys: string[]) {
     return fingerprints;
 }
 
+/** Where the daemon on that machine keeps its keys: the home of the user it runs as. Asked of the
+    machine itself, because the answer is not the same everywhere and certainly not the same as the
+    home of whoever is running this. */
+async function daemonKeysDir(host: string) {
+    let result = await runOverSSH({
+        host,
+        script: `${SUDO_PREAMBLE}\n$SUDO getent passwd root | cut -d: -f6`,
+    });
+    let home = result.stdout.trim();
+    if (!home) {
+        throw new Error(`Expected ${describeHost(host)} to report a home directory for root, it reported nothing`);
+    }
+    return `${home}/${KEYS_DIR_NAME}`;
+}
+
+/** The public half of a private key, as ssh-keygen derives it. */
+async function publicKeyOf(privateKeyPath: string) {
+    let result = await runLocal({ command: "ssh-keygen", args: ["-y", "-f", privateKeyPath] });
+    return `${result.stdout.trim()}\n`;
+}
+
 async function cloneRepoForInspection(config: { repoURL: string; keyPath: string }) {
     let { repoURL, keyPath } = config;
     let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-repo-"));
@@ -176,7 +202,20 @@ async function ensureRevokeReposExist(repoSources: string[]) {
         let revokeURL = revokeRepoURL(repoURL);
         let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-revoke-"));
         let checkoutPath = path.join(temporaryDirectory, "repo");
-        let clone = await runLocal({ command: "git", args: ["clone", revokeURL, checkoutPath], allowFailure: true });
+        // On a machine that is already a portsecure host, the source's deploy key is right there,
+        // and the key derived from it is the one credential that repo is guaranteed to accept.
+        // Anywhere else, a person is running this and has their own access.
+        let ownKey = "";
+        let localSourceKey = await findSourceKey(repoURL);
+        if (localSourceKey) {
+            let derived = deriveRevokeKey(await fs.readFile(localSourceKey, "utf8"));
+            ownKey = path.join(temporaryDirectory, "key");
+            await fs.writeFile(ownKey, derived.privateKeyFile, { mode: 0o600 });
+        }
+        let cloneRevoke = async (allowFailure: boolean) => ownKey
+            && await gitWithKey({ keyPath: ownKey, args: ["clone", revokeURL, checkoutPath], allowFailure })
+            || await runLocal({ command: "git", args: ["clone", revokeURL, checkoutPath], allowFailure });
+        let clone = await cloneRevoke(true);
         if (clone.status !== 0) {
             await fs.rm(temporaryDirectory, { recursive: true, force: true });
             throw new Error(
@@ -194,10 +233,15 @@ async function ensureRevokeReposExist(repoSources: string[]) {
             for (let args of [
                 ["-C", checkoutPath, "add", "-A"],
                 ["-C", checkoutPath, "-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", "initialise revoke repo"],
-                ["-C", checkoutPath, "push", "origin", "HEAD"],
             ]) {
                 await runLocal({ command: "git", args });
             }
+            let push = ["-C", checkoutPath, "push", "origin", "HEAD"];
+            if (ownKey) {
+                await gitWithKey({ keyPath: ownKey, args: push });
+            } else {
+                await runLocal({ command: "git", args: push });
+            }
         }
         await fs.rm(temporaryDirectory, { recursive: true, force: true });
         console.log(`${revokeURL} is ready`);
@@ -296,14 +340,24 @@ async function installDaemon(config: { host: string; hostLabel: string; repoSour
 
     // The checkout is brought to the latest commit rather than a copy being pushed, so what runs on
     // the host is exactly what is on github.
-    console.log(`Updating ${REMOTE_CHECKOUT_PATH} on ${host}`);
+    console.log(`Updating ${REMOTE_CHECKOUT_PATH} on ${describeHost(host)}`);
     await runOverSSH({
         host,
         script: `${SUDO_PREAMBLE}
 set -e
 $SUDO mkdir -p "${path.posix.dirname(REMOTE_CHECKOUT_PATH)}"
 if $SUDO test -d "${REMOTE_CHECKOUT_PATH}/.git"; then
+    # Stashed first, the way machine-alwaysup does it. Anything sitting modified in a host's
+    # checkout is either an accident or somebody editing the daemon in place, and either way it is
+    # worth keeping rather than quietly erasing. The identity is passed inline because a host has
+    # no git config of its own and stash writes a commit.
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" add --all
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" -c user.email=portsecure@localhost -c user.name=portsecure stash
     $SUDO git -C "${REMOTE_CHECKOUT_PATH}" fetch --prune origin
+    # A stash and a pull cannot cross a branch that has diverged, and a drifted checkout must not be
+    # able to leave a host running old code, so it is put on the remote's state rather than merged
+    # with it. set-head so that is the remote's default branch now, not the one it had at clone.
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" remote set-head origin --auto
     $SUDO git -C "${REMOTE_CHECKOUT_PATH}" reset --hard origin/HEAD
 else
     $SUDO rm -rf "${REMOTE_CHECKOUT_PATH}"
@@ -368,7 +422,7 @@ async function requireRemoteWebhook(host: string) {
         throw new Error(
             `Expected a Discord webhook at ${DEFAULT_WEBHOOK_FILE_PATH} on ${host}, no such file exists.`
             + ` The daemon will not start without one.\n`
-            + `Set it up first:\n  yarn setupnotify ${host} <discord-webhook-url>`
+            + `Set it up first:\n  yarn setupnotify ${host} <discord-webhook-url>`.replace(" <discord", host && " <discord" || "<discord")
         );
     }
     return parseWebhookFile({ contents, sourceName: `${host}:${DEFAULT_WEBHOOK_FILE_PATH}` });
@@ -392,18 +446,22 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
 
     let remoteConfig = await readRemoteConfig(host);
     if (remoteConfig.repoSources.includes(repoURL)) {
-        console.log(`${host} already has ${repoURL}, refreshing its key and the daemon.`);
+        console.log(`${describeHost(host)} already has ${repoURL}, refreshing its key and the daemon.`);
     }
 
-    // The merged result is what root ends up with, so our own key has to be somewhere in it.
-    console.log(`Checking our access to ${host} survives the merged keys`);
-    let ourFingerprint = await findAuthenticatingFingerprint(host);
+    // The merged result is what root ends up with, so our own key has to be somewhere in it. On
+    // this machine there is no ssh session to preserve, so there is nothing to check.
+    let ourFingerprint = "";
+    if (host) {
+        console.log(`Checking our access to ${describeHost(host)} survives the merged keys`);
+        ourFingerprint = await findAuthenticatingFingerprint(host);
+    }
     let inspectionPath = await cloneRepoForInspection({ repoURL, keyPath });
     let newKeys = await readRepoKeys(inspectionPath);
     // Whatever is applied on the host came from the existing sources, so it stays in the merge.
     let existingKeys = normalizeKeys(await readRemoteFile({ host, filePath: ROOT_AUTHORIZED_KEYS }) || "");
     let mergedFingerprints = await fingerprintKeys([...existingKeys, ...newKeys]);
-    if (!mergedFingerprints.includes(ourFingerprint)) {
+    if (ourFingerprint && !mergedFingerprints.includes(ourFingerprint)) {
         throw new Error(
             `Expected the key we use for ${host} to be in the merged keys, it is not.\n`
             + `Ours:   ${ourFingerprint}\n`
@@ -412,7 +470,9 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
             + ` lock you out of ${host}. Add your public key to ${repoURL} first.`
         );
     }
-    console.log(`Our key ${ourFingerprint} is in the merged keys, access will survive.`);
+    if (ourFingerprint) {
+        console.log(`Our key ${ourFingerprint} is in the merged keys, access will survive.`);
+    }
 
     await ensureRevokeRepo({ keyPath, repoURL });
 
@@ -428,20 +488,33 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     }
 
     let webhookURL = await requireRemoteWebhook(host);
-    console.log(`${host} notifies ${webhookURL}`);
+    console.log(`${describeHost(host)} notifies ${webhookURL}`);
 
+    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
+    // rather than worked out here: this may be running on a machine with no such user, and with a
+    // home directory in an entirely different shape.
+    let hostKeysDirectory = await daemonKeysDir(host);
     await writeRemoteFile({
         host,
-        filePath: sourceKeyPath(repoURL),
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
         contents: await fs.readFile(keyPath, "utf8"),
         fileMode: "600",
         directoryMode: "700",
     });
+    // The public half too, so the deploy key that a repo was given can be looked up on the machine
+    // using it, rather than only in whatever github shows.
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
+        contents: await publicKeyOf(keyPath),
+        fileMode: "644",
+        directoryMode: "700",
+    });
 
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
     repoSources.push(repoURL);
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
-    console.log(`${repoURL} added to ${host}. ${repoSources.length} source(s) now merged.`);
+    console.log(`${repoURL} added to ${describeHost(host)}. ${repoSources.length} source(s) now merged.`);
 }
 
 async function removeSource(config: { host: string; repoURL: string }) {
@@ -455,9 +528,10 @@ async function removeSource(config: { host: string; repoURL: string }) {
     }
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
 
-    if (repoSources.length) {
+    // On this machine there is no ssh session to preserve, so there is nothing to check.
+    if (repoSources.length && host) {
         // The keys left over are what root gets, so our own key has to be among them.
-        console.log(`Checking our access to ${host} survives without ${repoURL}`);
+        console.log(`Checking our access to ${describeHost(host)} survives without ${repoURL}`);
         let ourFingerprint = await findAuthenticatingFingerprint(host);
         let remainingKeys: string[] = [];
         for (let source of repoSources) {
@@ -481,51 +555,19 @@ async function removeSource(config: { host: string; repoURL: string }) {
     await runOverSSH({
         host,
         script: `${SUDO_PREAMBLE}
-$SUDO rm -f "${sourceKeyPath(repoURL)}"
+$SUDO rm -f "${sourceKeyPath(repoURL)}" "${sourceKeyPath(repoURL)}.pub" "${legacySourceKeyPath(repoURL)}"
 $SUDO rm -rf "${sourceRepoPath(repoURL)}"`,
     });
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
-    console.log(`${repoURL} removed from ${host}. ${repoSources.length} source(s) left.`);
+    console.log(`${repoURL} removed from ${describeHost(host)}. ${repoSources.length} source(s) left.`);
 }
 
 /** Answers "who can log into this box, and which repo says so". The paths the daemon uses are
     left out on purpose, they are plumbing rather than something to act on. */
-/** The daemon is installed from this checkout, so the checkout is brought up to date first.
-    Anything that stops the pull - a conflict, local commits, no upstream - stops the update too,
-    rather than quietly installing whatever happened to be on disk. */
-async function pullLocalCheckout() {
-    let topLevel = await spawnPromise({ command: "git", args: ["rev-parse", "--show-toplevel"], cwd: __dirname });
-    if (topLevel.status !== 0) {
-        throw new Error(
-            `Expected ${__dirname} to be inside a git checkout, it is not.`
-            + ` update installs the daemon from this checkout, so it has to be one.`
-        );
-    }
-    let repoPath = topLevel.stdout.trim();
-    let pull = await spawnPromise({ command: "git", args: ["pull", "--ff-only"], cwd: repoPath });
-    if (pull.status !== 0) {
-        throw new Error(
-            `Expected git pull in ${repoPath} to succeed, it did not, so nothing was installed.\n`
-            + `${(pull.stdout + pull.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
-        );
-    }
-    // The host installs from github, not from here, so local commits that have not been pushed
-    // are not what it will run.
-    let local = await spawnPromise({ command: "git", args: ["rev-parse", "HEAD"], cwd: repoPath });
-    let remote = await spawnPromise({ command: "git", args: ["rev-parse", "@{u}"], cwd: repoPath });
-    if (local.stdout.trim() !== remote.stdout.trim()) {
-        console.log(`WARNING: ${repoPath} has commits that are not pushed. The host installs from github,`);
-        console.log(`         so it will run the pushed version, not what is here.`);
-    }
-    console.log(`Pulled ${repoPath}`);
-}
 
 /** Pushes the current daemon onto a host that already has one, for when this code has moved on.
     Nothing about which keys the host trusts is touched. */
 async function updateDaemon(host: string) {
-    // Pulled before anything else, so a checkout that cannot be brought up to date fails here
-    // rather than after we have already started changing the host.
-    await pullLocalCheckout();
     let contents = await readRemoteFile({ host, filePath: REMOTE_CONFIG_PATH });
     if (!contents) {
         throw new Error(
@@ -538,16 +580,21 @@ async function updateDaemon(host: string) {
     await requireRemoteWebhook(host);
     await ensureRevokeReposExist(repoSources);
     await installDaemon({ host, hostLabel: parsed.hostLabel || host, repoSources });
-    console.log(`Updated the daemon on ${host}. ${repoSources.length} source(s), unchanged.`);
+    console.log(`Updated the daemon on ${describeHost(host)}, and restarted it.`);
+    console.log(`Its ${repoSources.length} key source(s) were left as they are, along with the keys and`);
+    console.log(`signers it has already accepted. Only the daemon itself changed:`);
+    for (let repoURL of repoSources) {
+        console.log(`  ${repoURL}`);
+    }
 }
 
 async function listSources(host: string) {
     let remoteConfig = await readRemoteConfig(host);
     if (!remoteConfig.repoSources.length) {
-        console.log(`${host} has no key sources. root's authorized_keys is left exactly as it is.`);
+        console.log(`${describeHost(host)} has no key sources. root's authorized_keys is left exactly as it is.`);
         return;
     }
-    console.log(`${host} lets root log in with the keys from ${remoteConfig.repoSources.length} repo(s):`);
+    console.log(`${describeHost(host)} lets root log in with the keys from ${remoteConfig.repoSources.length} repo(s):`);
     let merged = new Set<string>();
     for (let repoURL of remoteConfig.repoSources) {
         let keys = await readRemoteSourceKeys({ host, repoURL });
@@ -578,11 +625,16 @@ function parseArgs(argv: string[]) {
         throw new Error(`Expected one of ${VERBS.join(", ")}, was ${verbs.join(" and ")}\n${USAGE}`);
     }
     let verb = verbs[0];
-    let [host, ...rest] = argv.filter(arg => arg !== verb);
-    if (!host) {
-        throw new Error(`Expected a host, was nothing\n${USAGE}`);
-    }
-    return { verb, host, rest };
+    let positional = argv.filter(arg => arg !== verb);
+    // A host, when there is one, comes first and is a bare name or address. Everything else that
+    // can appear here is a path or a repo url, and those all carry a slash, which is what tells
+    // them apart. So no host at all means this machine.
+    let host = THIS_MACHINE;
+    if (positional.length && !/[\/~\\]/.test(positional[0])) {
+        host = positional[0];
+        positional = positional.slice(1);
+    }
+    return { verb, host, rest: positional };
 }
 
 export async function main() {

package/security/authorizedKeys/sources.ts

@@ -1,10 +1,22 @@
-// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of everything here, so it can
-// resolve the same locations with no dependencies. Both sides must derive identical paths from a
-// repo url - if you change one, make the matching change in the other.
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
 
-export const REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
+// PORTED CODE: nothing here is duplicated any more, the daemon imports it directly. Kept in one
+// place because the daemon and the deploy have to agree on where a source's key and checkout live.
+
+// The user's own folder, so this works the same on a machine that has no /etc. The daemon runs as
+// root, so on a host this is root's home.
+export const KEYS_DIR_NAME = "authorized_keys";
+// Where keys used to go. Still read, so a host set up before this keeps working, but nothing is
+// written here any more.
+export const LEGACY_REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
 export const REPOS_DIR = "/var/lib/portsecure/authorized-keys-repos";
 
+export function keysDir() {
+    return path.join(os.homedir(), KEYS_DIR_NAME);
+}
+
 /** A repo url reduced to something usable as a file name. Derived rather than configured, so the
     daemon and the deploy script always agree on where a source's key and checkout live. */
 export function sourceName(repoURL: string) {
@@ -12,9 +24,39 @@ export function sourceName(repoURL: string) {
 }
 
 export function sourceKeyPath(repoURL: string) {
-    return `${REPO_KEYS_DIR}/${sourceName(repoURL)}`;
+    return path.join(keysDir(), sourceName(repoURL));
+}
+
+export function legacySourceKeyPath(repoURL: string) {
+    return `${LEGACY_REPO_KEYS_DIR}/${sourceName(repoURL)}`;
 }
 
 export function sourceRepoPath(repoURL: string) {
     return `${REPOS_DIR}/${sourceName(repoURL)}`;
 }
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** The key for a source, wherever it happens to be. The user folder is where they go now, and the
+    old location is still read so a host that predates the move keeps working. */
+export async function findKey(config: { current: string; legacy: string }) {
+    let { current, legacy } = config;
+    if (await pathExists(current)) {
+        return current;
+    }
+    if (await pathExists(legacy)) {
+        return legacy;
+    }
+    return "";
+}
+
+export async function findSourceKey(repoURL: string) {
+    return await findKey({ current: sourceKeyPath(repoURL), legacy: legacySourceKeyPath(repoURL) });
+}

package/security/authorizedKeys/unrevoke.ts

@@ -3,18 +3,22 @@ import os from "os";
 import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
 import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
-import { revokeRepoURL } from "./revokeSource";
+import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
+import { findSourceKey } from "./sources";
+import { signRepo } from "../signedFiles/signFiles";
 import { readRepoKeys } from "./authorizedKeys";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
 
 const UNREVOKES_DIR = "unrevoked";
 const REVOCATIONS_DIR = "revocations";
-const USAGE = `Usage: yarn unrevoke [keys-repo]
+const GIT_KEYWORD = "git";
+const COMMIT_MESSAGE = "unrevoke keys";
+const USAGE = `Usage: yarn unrevoke [keys-repo] [${GIT_KEYWORD}]
 
 Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
 naming every revocation in it, so the keys are accepted again once each machine's hour long wait
-passes.
+passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it too.
 
 Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
 for a key you still want.`;
@@ -28,17 +32,25 @@ export type Revocation = {
     attempt?: { ip?: string; user?: string; required?: string };
 };
 
-/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
-    credentials this machine already has - the derived deploy key is for servers, and a person
-    running this has their own access to the repo. */
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory.
+
+    A person running this has their own access to the repo, so their credentials are what is used.
+    On a machine that is already a portsecure host there may be no such credentials, but the source
+    deploy key is right there, and the key derived from it is one that repo definitely accepts. */
 export async function readRemoteRevocations(config: { sourceURL: string }) {
     let { sourceURL } = config;
     let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "unrevoke-"));
     let repoPath = path.join(temporaryDirectory, "repo");
-    let clone = await spawnPromise({
-        command: "git",
-        args: ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath],
-    });
+    let cloneArgs = ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath];
+    let sourceKey = await findSourceKey(sourceURL);
+    if (sourceKey) {
+        let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+        let derivedKeyPath = path.join(temporaryDirectory, "key");
+        await fs.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+        let sshCommand = `ssh -i ${derivedKeyPath} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+        cloneArgs = ["-c", `core.sshCommand=${sshCommand}`, ...cloneArgs];
+    }
+    let clone = await spawnPromise({ command: "git", args: cloneArgs });
     if (clone.status !== 0) {
         await fs.rm(temporaryDirectory, { recursive: true, force: true });
         throw new Error(
@@ -92,17 +104,24 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
     repo that actually holds keys and has an origin to clone from. */
 async function resolveKeysRepo(named: string | undefined) {
     let cwd = named && expandHome(named) || undefined;
-    let repoPath = (await runPromise("git rev-parse --show-toplevel", { quiet: true, cwd })).trim();
-    if (!repoPath) {
-        throw new Error(`Expected ${named || "the current directory"} to be inside a git repo, it is not.\n${USAGE}`);
+    // spawnPromise rather than runPromise, because these two are read for their value. runPromise
+    // returns stdout and stderr joined, so one git warning ends up glued to the front of the path.
+    let topLevel = await spawnPromise({ command: "git", args: ["rev-parse", "--show-toplevel"], cwd });
+    let repoPath = topLevel.stdout.trim();
+    if (topLevel.status !== 0 || !repoPath) {
+        throw new Error(
+            `Expected ${named || "the current directory"} to be inside a git repo, it is not.\n`
+            + `${(topLevel.stdout + topLevel.stderr).trim()}\n${USAGE}`
+        );
     }
     try {
         await readRepoKeys(repoPath);
     } catch (e) {
         throw new Error(`Expected ${repoPath} to be a keys repo, it holds no keys.\n${e}\n${USAGE}`);
     }
-    let originURL = (await runPromise("git remote get-url origin", { quiet: true, cwd: repoPath })).trim();
-    if (!originURL) {
+    let origin = await spawnPromise({ command: "git", args: ["remote", "get-url", "origin"], cwd: repoPath });
+    let originURL = origin.stdout.trim();
+    if (origin.status !== 0 || !originURL) {
         throw new Error(`Expected ${repoPath} to have an origin remote, it has none.\n${USAGE}`);
     }
     return { repoPath, originURL };
@@ -110,10 +129,12 @@ async function resolveKeysRepo(named: string | undefined) {
 
 export async function main() {
     let argv = process.argv.slice(2);
-    if (argv.length > 1) {
-        throw new Error(`Expected at most a keys repo, was ${argv.length} argument(s)\n${USAGE}`);
+    let pushToGit = argv.includes(GIT_KEYWORD);
+    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
+    if (positional.length > 1) {
+        throw new Error(`Expected at most a keys repo, was ${positional.length} argument(s)\n${USAGE}`);
     }
-    let { repoPath, originURL } = await resolveKeysRepo(argv[0]);
+    let { repoPath, originURL } = await resolveKeysRepo(positional[0]);
 
     let revocations = await readRemoteRevocations({ sourceURL: originURL });
     if (!revocations.length) {
@@ -144,6 +165,20 @@ export async function main() {
     for (let revocation of revocations) {
         console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
     }
-    console.log(`Each machine waits an hour after seeing it before the keys work again.`);
-    console.log(`Sign and publish it with:\n  yarn signfiles git`);
+
+    // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
+    // all, and the repo would sit there looking done while every machine ignored it.
+    await signRepo({ repoPath });
+
+    if (!pushToGit) {
+        console.log(`\nCommit and push it, and each machine will wait an hour after seeing it before`);
+        console.log(`those keys work again:`);
+        console.log(`\`\`\`\ngit add -A\ngit commit -m "${COMMIT_MESSAGE}"\ngit push\n\`\`\``);
+        return;
+    }
+    await runPromise(`git add -A`, { cwd: repoPath });
+    await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
+    await runPromise(`git push`, { cwd: repoPath });
+    console.log(`\nCommitted and pushed. Each machine waits an hour after seeing it before those`);
+    console.log(`keys work again.`);
 }

package/security/helpers/remoteSSH.ts

@@ -8,28 +8,39 @@ const MAX_ERROR_BODY_LENGTH = 500;
 // /etc is root owned, so fall back to sudo whenever the SSH user is not root.
 export const SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
 
+/** No host means this machine, so the very same script runs with nothing in front of it. Local and
+    remote then do exactly the same thing, rather than being two pieces of code that have to be kept
+    saying the same thing. */
+export const THIS_MACHINE = "";
+
+export function describeHost(host: string) {
+    return host || "this machine";
+}
+
 /** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
     config, so BatchMode makes a missing setup fail immediately instead of prompting. */
 export async function runOverSSH(config: { host: string; script: string; input?: string; allowFailure?: boolean }) {
     let { host, script, input, allowFailure } = config;
     let result = await spawnPromise({
-        command: "ssh",
-        args: [
+        command: host && "ssh" || "sh",
+        args: host && [
             "-o", "BatchMode=yes",
             "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
             host,
             script,
-        ],
+        ] || ["-c", script],
         input,
         inheritStderr: !allowFailure,
     });
     if (result.error) {
-        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+        throw new Error(`Expected to run against ${describeHost(host)}, failed with ${result.error.message}`);
     }
     if (result.status !== 0 && !allowFailure) {
+        let advice = host
+            && ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.`
+            || "";
         throw new Error(
-            `Expected ssh to ${host} to exit 0, was ${result.status}.`
-            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+            `Expected the script on ${describeHost(host)} to exit 0, was ${result.status}.${advice}\n`
             + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }

package/security/notifications/discord.ts

@@ -72,8 +72,25 @@ async function readWebhookFile(filePath: string) {
     return parseWebhookFile({ contents, sourceName: filePath });
 }
 
+/** When the message was sent, in the sending machine's own time zone. Discord shows when it
+    received something, which is not the same thing when a machine has been offline or a send has
+    been retried, and the zone matters when the machines are not all in one place. */
+export function messageTimestamp(now: Date) {
+    let date = now.toLocaleDateString("en-CA");
+    let time = now.toLocaleTimeString("en-US", {
+        hour: "2-digit",
+        minute: "2-digit",
+        second: "2-digit",
+        hour12: true,
+        timeZoneName: "short",
+    });
+    return `${date} ${time}`;
+}
+
 async function postToWebhook(webhookURL: string, message: string) {
-    let content = message;
+    // Stamped once rather than per attempt, so a retry says when the thing happened rather than
+    // when we last managed to get it out.
+    let content = `\`${messageTimestamp(new Date())}\` ${message}`;
     if (content.length > DISCORD_MESSAGE_LIMIT) {
         content = content.slice(0, DISCORD_MESSAGE_LIMIT - 3) + "...";
     }