sliftutils 1.7.127 → 1.7.128

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.127",
+    "version": "1.7.128",
     "main": "index.js",
     "license": "MIT",
     "files": [

package/security/authorizedKeys/daemon/daemon.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import os from "os";
 import { configureDiscordNotifications, DEFAULT_WEBHOOK_FILE_PATH } from "../../notifications/discord";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, legacySourceKeyPath, sourceKeyPath, sourceRepoPath } from "../sources";
 import { cloneRepo, syncRepo } from "./git";
 import {
     CHECK_INTERVAL,
@@ -74,10 +74,11 @@ async function loadConfig(): Promise<DaemonConfig> {
         process.exit(1);
     }
     for (let repoURL of parsed.repoSources) {
-        try {
-            await fs.access(sourceKeyPath(repoURL));
-        } catch (e) {
-            console.error(`portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}, ${e}`);
+        if (!await findSourceKey(repoURL)) {
+            console.error(
+                `portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}`
+                + ` or ${legacySourceKeyPath(repoURL)}, neither exists`
+            );
             process.exit(1);
         }
     }
@@ -213,7 +214,7 @@ async function pollSource(repoURL: string) {
         // Availability over tidiness: throw the working copy away and start again.
         console.log(`Discarding the checkout of ${repoURL} and cloning from scratch`);
         try {
-            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: sourceKeyPath(repoURL) });
+            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: await findSourceKey(repoURL) || sourceKeyPath(repoURL) });
             repoFailureCounts[repoURL] = 0;
             return true;
         } catch (cloneError) {

package/security/authorizedKeys/daemon/git.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import path from "path";
 import { spawnPromise } from "../../helpers/spawn";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
 import { GIT_TIMEOUT, MAX_ERROR_BODY_LENGTH } from "./paths";
 import { sourceState } from "./state";
 
@@ -68,7 +68,7 @@ export async function currentBranch(config: { repoPath: string; keyPath: string
 
 async function ensureSourceRepo(repoURL: string) {
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     if (!await repoIsUsable({ repoPath, keyPath })) {
         await cloneRepo({ repoURL, repoPath, keyPath });
     }
@@ -82,7 +82,7 @@ async function ensureSourceRepo(repoURL: string) {
 export async function syncRepo(repoURL: string) {
     await ensureSourceRepo(repoURL);
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     let branch = sourceState(repoURL).branch;
     let localSha = (await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
 

package/security/authorizedKeys/daemon/revocation.ts

@@ -1,8 +1,8 @@
 import fs from "fs/promises";
 import path from "path";
 import { keyFingerprint, summarizeKey } from "../authorizedKeys";
-import { deriveRevokeKey, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { deriveRevokeKey, findRevokeKey, REVOKE_KEY_LABEL, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
 import { cloneRepo, repoIsUsable, runGit } from "./git";
 import { messageTimestamp } from "../../notifications/discord";
 import { UNREVOKE_DELAY } from "./paths";
@@ -40,14 +40,20 @@ async function pathExists(filePath: string) {
 /** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
     nothing extra is stored anywhere it could be taken from. */
 async function ensureRevokeKey(sourceURL: string) {
-    let keyPath = revokeKeyPath(sourceURL);
-    if (await pathExists(keyPath)) {
-        return keyPath;
+    let existing = await findRevokeKey(sourceURL);
+    if (existing) {
+        return existing;
+    }
+    let sourceKey = await findSourceKey(sourceURL);
+    if (!sourceKey) {
+        throw new Error(`Expected a key for ${sourceURL} at ${sourceKeyPath(sourceURL)}, no such file exists`);
     }
-    let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(sourceURL), "utf8"));
+    let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+    let keyPath = revokeKeyPath(sourceURL);
     await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
     await fs.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
-    console.log(`Derived the revoke key for ${sourceURL}`);
+    await fs.writeFile(`${keyPath}.pub`, `${derived.publicKey} ${REVOKE_KEY_LABEL}\n`, { mode: 0o644 });
+    console.log(`Derived the revoke key for ${sourceURL} into ${keyPath}`);
     return keyPath;
 }
 
@@ -165,7 +171,7 @@ export async function recordRevocation(config: {
     }
 
     let repoPath = revokeRepoPath(sourceURL);
-    let keyPath = revokeKeyPath(sourceURL);
+    let keyPath = await ensureRevokeKey(sourceURL);
     let directory = path.join(repoPath, REVOCATIONS_DIR);
     await fs.mkdir(directory, { recursive: true });
     await fs.writeFile(path.join(directory, `${revocationId}.json`), JSON.stringify({

package/security/authorizedKeys/revokeSource.ts

@@ -1,6 +1,7 @@
 import { deriveEd25519Key } from "../keys/deriveKey";
 import { formatOpenSSHPrivateKey, parseOpenSSHPrivateKey } from "../keys/sshKeyFile";
-import { REPO_KEYS_DIR, REPOS_DIR, sourceName } from "./sources";
+import path from "path";
+import { findKey, keysDir, LEGACY_REPO_KEYS_DIR, REPOS_DIR, sourceName } from "./sources";
 
 // A source's revocations live in a repo beside it. Derived rather than configured, so adding a
 // source brings its revoke repo with it and there is nothing extra to pass on the command line.
@@ -15,7 +16,16 @@ export function revokeRepoURL(sourceURL: string) {
 }
 
 export function revokeKeyPath(sourceURL: string) {
-    return `${REPO_KEYS_DIR}/${sourceName(sourceURL)}${REVOKED_SUFFIX}`;
+    return path.join(keysDir(), `${sourceName(sourceURL)}${REVOKED_SUFFIX}`);
+}
+
+export function legacyRevokeKeyPath(sourceURL: string) {
+    return `${LEGACY_REPO_KEYS_DIR}/${sourceName(sourceURL)}${REVOKED_SUFFIX}`;
+}
+
+/** Wherever this source's revoke key already is, or nothing if it has not been derived yet. */
+export async function findRevokeKey(sourceURL: string) {
+    return await findKey({ current: revokeKeyPath(sourceURL), legacy: legacyRevokeKeyPath(sourceURL) });
 }
 
 export function revokeRepoPath(sourceURL: string) {

package/security/authorizedKeys/secureSSH.ts

@@ -3,8 +3,9 @@ import os from "os";
 import path from "path";
 import { DEFAULT_WEBHOOK_FILE_PATH, parseWebhookFile } from "../notifications/discord";
 import { normalizeKeys, readRepoKeys, summarizeKey } from "./authorizedKeys";
-import { sourceKeyPath, sourceRepoPath } from "./sources";
+import { findSourceKey, KEYS_DIR_NAME, sourceKeyPath, sourceName, sourceRepoPath } from "./sources";
 import { deriveRevokeKey, REVOKE_KEY_LABEL, revokeRepoURL } from "./revokeSource";
+import { legacySourceKeyPath } from "./sources";
 import { revokedKeysInRepo } from "./unrevoke";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
@@ -125,6 +126,27 @@ async function fingerprintKeys(keys: string[]) {
     return fingerprints;
 }
 
+/** Where the daemon on that machine keeps its keys: the home of the user it runs as. Asked of the
+    machine itself, because the answer is not the same everywhere and certainly not the same as the
+    home of whoever is running this. */
+async function daemonKeysDir(host: string) {
+    let result = await runOverSSH({
+        host,
+        script: `${SUDO_PREAMBLE}\n$SUDO getent passwd root | cut -d: -f6`,
+    });
+    let home = result.stdout.trim();
+    if (!home) {
+        throw new Error(`Expected ${describeHost(host)} to report a home directory for root, it reported nothing`);
+    }
+    return `${home}/${KEYS_DIR_NAME}`;
+}
+
+/** The public half of a private key, as ssh-keygen derives it. */
+async function publicKeyOf(privateKeyPath: string) {
+    let result = await runLocal({ command: "ssh-keygen", args: ["-y", "-f", privateKeyPath] });
+    return `${result.stdout.trim()}\n`;
+}
+
 async function cloneRepoForInspection(config: { repoURL: string; keyPath: string }) {
     let { repoURL, keyPath } = config;
     let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-repo-"));
@@ -184,8 +206,9 @@ async function ensureRevokeReposExist(repoSources: string[]) {
         // and the key derived from it is the one credential that repo is guaranteed to accept.
         // Anywhere else, a person is running this and has their own access.
         let ownKey = "";
-        if (await pathExists(sourceKeyPath(repoURL))) {
-            let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(repoURL), "utf8"));
+        let localSourceKey = await findSourceKey(repoURL);
+        if (localSourceKey) {
+            let derived = deriveRevokeKey(await fs.readFile(localSourceKey, "utf8"));
             ownKey = path.join(temporaryDirectory, "key");
             await fs.writeFile(ownKey, derived.privateKeyFile, { mode: 0o600 });
         }
@@ -467,13 +490,26 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     let webhookURL = await requireRemoteWebhook(host);
     console.log(`${describeHost(host)} notifies ${webhookURL}`);
 
+    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
+    // rather than worked out here: this may be running on a machine with no such user, and with a
+    // home directory in an entirely different shape.
+    let hostKeysDirectory = await daemonKeysDir(host);
     await writeRemoteFile({
         host,
-        filePath: sourceKeyPath(repoURL),
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
         contents: await fs.readFile(keyPath, "utf8"),
         fileMode: "600",
         directoryMode: "700",
     });
+    // The public half too, so the deploy key that a repo was given can be looked up on the machine
+    // using it, rather than only in whatever github shows.
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
+        contents: await publicKeyOf(keyPath),
+        fileMode: "644",
+        directoryMode: "700",
+    });
 
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
     repoSources.push(repoURL);
@@ -519,7 +555,7 @@ async function removeSource(config: { host: string; repoURL: string }) {
     await runOverSSH({
         host,
         script: `${SUDO_PREAMBLE}
-$SUDO rm -f "${sourceKeyPath(repoURL)}"
+$SUDO rm -f "${sourceKeyPath(repoURL)}" "${sourceKeyPath(repoURL)}.pub" "${legacySourceKeyPath(repoURL)}"
 $SUDO rm -rf "${sourceRepoPath(repoURL)}"`,
     });
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });

package/security/authorizedKeys/sources.ts

@@ -1,10 +1,22 @@
-// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of everything here, so it can
-// resolve the same locations with no dependencies. Both sides must derive identical paths from a
-// repo url - if you change one, make the matching change in the other.
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
 
-export const REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
+// PORTED CODE: nothing here is duplicated any more, the daemon imports it directly. Kept in one
+// place because the daemon and the deploy have to agree on where a source's key and checkout live.
+
+// The user's own folder, so this works the same on a machine that has no /etc. The daemon runs as
+// root, so on a host this is root's home.
+export const KEYS_DIR_NAME = "authorized_keys";
+// Where keys used to go. Still read, so a host set up before this keeps working, but nothing is
+// written here any more.
+export const LEGACY_REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
 export const REPOS_DIR = "/var/lib/portsecure/authorized-keys-repos";
 
+export function keysDir() {
+    return path.join(os.homedir(), KEYS_DIR_NAME);
+}
+
 /** A repo url reduced to something usable as a file name. Derived rather than configured, so the
     daemon and the deploy script always agree on where a source's key and checkout live. */
 export function sourceName(repoURL: string) {
@@ -12,9 +24,39 @@ export function sourceName(repoURL: string) {
 }
 
 export function sourceKeyPath(repoURL: string) {
-    return `${REPO_KEYS_DIR}/${sourceName(repoURL)}`;
+    return path.join(keysDir(), sourceName(repoURL));
+}
+
+export function legacySourceKeyPath(repoURL: string) {
+    return `${LEGACY_REPO_KEYS_DIR}/${sourceName(repoURL)}`;
 }
 
 export function sourceRepoPath(repoURL: string) {
     return `${REPOS_DIR}/${sourceName(repoURL)}`;
 }
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** The key for a source, wherever it happens to be. The user folder is where they go now, and the
+    old location is still read so a host that predates the move keeps working. */
+export async function findKey(config: { current: string; legacy: string }) {
+    let { current, legacy } = config;
+    if (await pathExists(current)) {
+        return current;
+    }
+    if (await pathExists(legacy)) {
+        return legacy;
+    }
+    return "";
+}
+
+export async function findSourceKey(repoURL: string) {
+    return await findKey({ current: sourceKeyPath(repoURL), legacy: legacySourceKeyPath(repoURL) });
+}

package/security/authorizedKeys/unrevoke.ts

@@ -3,7 +3,8 @@ import os from "os";
 import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
 import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
-import { revokeRepoURL } from "./revokeSource";
+import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
+import { findSourceKey } from "./sources";
 import { signRepo } from "../signedFiles/signFiles";
 import { readRepoKeys } from "./authorizedKeys";
 import { expandHome } from "../helpers/paths";
@@ -31,17 +32,25 @@ export type Revocation = {
     attempt?: { ip?: string; user?: string; required?: string };
 };
 
-/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
-    credentials this machine already has - the derived deploy key is for servers, and a person
-    running this has their own access to the repo. */
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory.
+
+    A person running this has their own access to the repo, so their credentials are what is used.
+    On a machine that is already a portsecure host there may be no such credentials, but the source
+    deploy key is right there, and the key derived from it is one that repo definitely accepts. */
 export async function readRemoteRevocations(config: { sourceURL: string }) {
     let { sourceURL } = config;
     let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "unrevoke-"));
     let repoPath = path.join(temporaryDirectory, "repo");
-    let clone = await spawnPromise({
-        command: "git",
-        args: ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath],
-    });
+    let cloneArgs = ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath];
+    let sourceKey = await findSourceKey(sourceURL);
+    if (sourceKey) {
+        let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+        let derivedKeyPath = path.join(temporaryDirectory, "key");
+        await fs.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+        let sshCommand = `ssh -i ${derivedKeyPath} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+        cloneArgs = ["-c", `core.sshCommand=${sshCommand}`, ...cloneArgs];
+    }
+    let clone = await spawnPromise({ command: "git", args: cloneArgs });
     if (clone.status !== 0) {
         await fs.rm(temporaryDirectory, { recursive: true, force: true });
         throw new Error(