sliftutils 1.7.128 → 1.7.130

package/security/authorizedKeys/secureSSH.ts

@@ -7,6 +7,7 @@ import { findSourceKey, KEYS_DIR_NAME, sourceKeyPath, sourceName, sourceRepoPath
 import { deriveRevokeKey, REVOKE_KEY_LABEL, revokeRepoURL } from "./revokeSource";
 import { legacySourceKeyPath } from "./sources";
 import { revokedKeysInRepo } from "./unrevoke";
+import { resolveKeysRepo } from "./keysRepo";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
 import { describeHost, readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, THIS_MACHINE, writeRemoteFile } from "../helpers/remoteSSH";
@@ -155,38 +156,15 @@ async function cloneRepoForInspection(config: { repoURL: string; keyPath: string
     return repoPath;
 }
 
-/** With no repo url given, the repo we are standing in is used. It has to actually hold keys
-    before we hand it to a host, so a stray working directory cannot be deployed by accident. */
+/** With no repo url given, the keys repo this machine resolves to is used - the one we are
+    standing in when that holds keys, and this machine's own otherwise. */
 async function resolveRepoURL(passedURL: string | undefined) {
     if (passedURL) {
         return normalizeRepoURL(passedURL);
     }
-    let topLevel = await runLocal({ command: "git", args: ["rev-parse", "--show-toplevel"], allowFailure: true });
-    if (topLevel.status !== 0) {
-        throw new Error(`Expected a repo url, or the current directory to be inside a git repo, it is not.\n${USAGE}`);
-    }
-    let repoPath = topLevel.stdout.trim();
-    try {
-        await readRepoKeys(repoPath);
-    } catch (e) {
-        throw new Error(
-            `Expected a repo url, or the current repo (${repoPath}) to hold keys, it does not.\n${e}\n${USAGE}`
-        );
-    }
-    let origin = await runLocal({
-        command: "git",
-        args: ["remote", "get-url", "origin"],
-        cwd: repoPath,
-        allowFailure: true,
-    });
-    if (origin.status !== 0 || !origin.stdout.trim()) {
-        throw new Error(
-            `Expected the current repo (${repoPath}) to have an origin remote, it has none.`
-            + ` The host clones the source itself, so a local path is no use to it.`
-        );
-    }
-    let repoURL = normalizeRepoURL(origin.stdout.trim());
-    console.log(`No repo url given, using the current repo: ${repoURL}`);
+    let { repoPath, sourceURL } = await resolveKeysRepo();
+    let repoURL = normalizeRepoURL(sourceURL);
+    console.log(`No repo url given, using ${repoPath}: ${repoURL}`);
     return repoURL;
 }
 
@@ -449,6 +427,31 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
         console.log(`${describeHost(host)} already has ${repoURL}, refreshing its key and the daemon.`);
     }
 
+    // Copied into place before anything else needs it. The checks below look this source's key up
+    // where the machine keeps it, not at the path it was handed on the command line, so a key that
+    // is still only sitting in the caller's directory reads as no key at all.
+    //
+    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
+    // rather than worked out here: this may be running on a machine with no such user, and with a
+    // home directory in an entirely different shape.
+    let hostKeysDirectory = await daemonKeysDir(host);
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
+        contents: await fs.readFile(keyPath, "utf8"),
+        fileMode: "600",
+        directoryMode: "700",
+    });
+    // The public half too, so the deploy key that a repo was given can be looked up on the machine
+    // using it, rather than only in whatever github shows.
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
+        contents: await publicKeyOf(keyPath),
+        fileMode: "644",
+        directoryMode: "700",
+    });
+
     // The merged result is what root ends up with, so our own key has to be somewhere in it. On
     // this machine there is no ssh session to preserve, so there is nothing to check.
     let ourFingerprint = "";
@@ -490,27 +493,6 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     let webhookURL = await requireRemoteWebhook(host);
     console.log(`${describeHost(host)} notifies ${webhookURL}`);
 
-    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
-    // rather than worked out here: this may be running on a machine with no such user, and with a
-    // home directory in an entirely different shape.
-    let hostKeysDirectory = await daemonKeysDir(host);
-    await writeRemoteFile({
-        host,
-        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
-        contents: await fs.readFile(keyPath, "utf8"),
-        fileMode: "600",
-        directoryMode: "700",
-    });
-    // The public half too, so the deploy key that a repo was given can be looked up on the machine
-    // using it, rather than only in whatever github shows.
-    await writeRemoteFile({
-        host,
-        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
-        contents: await publicKeyOf(keyPath),
-        fileMode: "644",
-        directoryMode: "700",
-    });
-
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
     repoSources.push(repoURL);
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
@@ -634,32 +616,58 @@ function parseArgs(argv: string[]) {
         host = positional[0];
         positional = positional.slice(1);
     }
+
+    // How many arguments each verb takes, checked here rather than where the verb is acted on, so
+    // that a command which was typed wrong says so before anything else is complained about.
+    if (verb === "list" && positional.length) {
+        throw new Error(`Expected nothing after list, was ${positional.length} argument(s)\n${USAGE}`);
+    }
+    if (verb === "update" && positional.length) {
+        throw new Error(`Expected nothing after update, was ${positional.length} argument(s)\n${USAGE}`);
+    }
+    if (verb === "add" && (!positional.length || positional.length > 2)) {
+        throw new Error(`Expected a private key and optionally a repo url, was ${positional.length} argument(s)\n${USAGE}`);
+    }
+    if (verb === "remove" && positional.length > 1) {
+        throw new Error(`Expected at most a repo url to remove, was ${positional.length} argument(s)\n${USAGE}`);
+    }
     return { verb, host, rest: positional };
 }
 
+/** Everything here is root's: root's authorized_keys, root's keys directory, the sshd config, the
+    systemd unit. Run as anyone else it reads a different home and writes files the daemon will
+    never see, and it gets there several steps in rather than failing at the start. */
+function requireRoot() {
+    let uid = process.getuid?.();
+    if (uid !== 0) {
+        throw new Error(
+            `Expected to be running as root, is uid ${uid ?? "unknown"}.\n`
+            + `Rerun this with sudo.`
+        );
+    }
+}
+
 export async function main() {
+    // What was typed is checked before anything about this machine is. A command that does not
+    // make sense is worth saying so about whoever is running it, and being told to find sudo only
+    // to then be told the arguments were wrong is two trips for one mistake.
     let { verb, host, rest } = parseArgs(process.argv.slice(2));
+    // With a host, everything root-owned happens on that host through $SUDO over ssh, so being root here proves nothing and would block running this from a workstation.
+    if (host === THIS_MACHINE) {
+        requireRoot();
+    }
 
     if (verb === "list") {
         await listSources(host);
         return;
     }
     if (verb === "update") {
-        if (rest.length) {
-            throw new Error(`Expected nothing after update, was ${rest.length} argument(s)\n${USAGE}`);
-        }
         await updateDaemon(host);
         return;
     }
     if (verb === "add") {
-        if (!rest.length || rest.length > 2) {
-            throw new Error(`Expected a private key and optionally a repo url, was ${rest.length} argument(s)\n${USAGE}`);
-        }
         await addSource({ host, keyPath: expandHome(rest[0]), repoURL: await resolveRepoURL(rest[1]) });
         return;
     }
-    if (rest.length > 1) {
-        throw new Error(`Expected at most a repo url to remove, was ${rest.length} argument(s)\n${USAGE}`);
-    }
     await removeSource({ host, repoURL: await resolveRepoURL(rest[0]) });
 }

package/security/authorizedKeys/unrevoke.ts

@@ -2,13 +2,15 @@ import fs from "fs/promises";
 import os from "os";
 import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
-import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
+import { allowAddresses, keyFingerprint, normalizeKeys, summarizeKey } from "./authorizedKeys";
 import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
 import { findSourceKey } from "./sources";
 import { signRepo } from "../signedFiles/signFiles";
 import { readRepoKeys } from "./authorizedKeys";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
+import { getMachines, setMachines } from "../machines/machines";
+import { resolveKeysRepo } from "./keysRepo";
 
 const UNREVOKES_DIR = "unrevoked";
 const REVOCATIONS_DIR = "revocations";
@@ -17,21 +19,41 @@ const COMMIT_MESSAGE = "unrevoke keys";
 const USAGE = `Usage: yarn unrevoke [keys-repo] [${GIT_KEYWORD}]
 
 Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
-naming every revocation in it, so the keys are accepted again once each machine's hour long wait
-passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it too.
+naming every revocation in it, so the keys are accepted again as each machine picks it up. It signs
+the result, and with ${GIT_KEYWORD} it commits and pushes it too.
 
 Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
 for a key you still want.`;
 
+/** One revocation event. Either an ssh key used from an address it is not allowed from, or a
+    machine that talked to us from one. Both are the same shape - an identity and an address - and
+    an unrevoke undoes either by allowing that same pair.
+
+    Which is why unrevoking never makes anything unrevokable: used from some other address, it is
+    revoked again, under a new id no existing unrevoke names. */
 export type Revocation = {
     revocationId: string;
-    fingerprint: string;
+    // Exactly one of these. A key revocation names a fingerprint, a machine revocation a machineId.
+    fingerprint?: string;
+    machineId?: string;
+    ip?: string;
     key?: string;
     revokedAt?: string;
     revokedBy?: string;
+    reason?: string;
     attempt?: { ip?: string; user?: string; required?: string };
 };
 
+/** Older revocation files carry the address under attempt only. */
+export function revocationIP(revocation: Revocation) {
+    return revocation.ip || revocation.attempt?.ip || "";
+}
+
+/** What the revocation is about, which is what an unrevoke has to name to undo it. */
+export function revocationIdentity(revocation: Revocation) {
+    return revocation.fingerprint || revocation.machineId || "";
+}
+
 /** Every revocation the revoke repo lists. Cloned read only into a temp directory.
 
     A person running this has their own access to the repo, so their credentials are what is used.
@@ -86,6 +108,10 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
                 continue;
             }
             let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let allowed of parsed.allowed || []) {
+                unrevoked.add(`${allowed.fingerprint || allowed.machineId} ${allowed.ip}`);
+            }
+            // Named ids, for the unrevokes written before this was about pairs.
             for (let revocationId of parsed.revocationIds || []) {
                 unrevoked.add(revocationId);
             }
@@ -93,40 +119,85 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
     } catch (e) {
         // Nothing has been unrevoked.
     }
-    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId)
+        && !unrevoked.has(`${revocation.fingerprint} ${revocationIP(revocation)}`));
     let keys = normalizeKeys(await fs.readFile(path.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
     return stillRevoked
         .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
         .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
 }
 
-/** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
-    repo that actually holds keys and has an origin to clone from. */
-async function resolveKeysRepo(named: string | undefined) {
-    let cwd = named && expandHome(named) || undefined;
-    // spawnPromise rather than runPromise, because these two are read for their value. runPromise
-    // returns stdout and stderr joined, so one git warning ends up glued to the front of the path.
-    let topLevel = await spawnPromise({ command: "git", args: ["rev-parse", "--show-toplevel"], cwd });
-    let repoPath = topLevel.stdout.trim();
-    if (topLevel.status !== 0 || !repoPath) {
-        throw new Error(
-            `Expected ${named || "the current directory"} to be inside a git repo, it is not.\n`
-            + `${(topLevel.stdout + topLevel.stderr).trim()}\n${USAGE}`
-        );
-    }
+/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
+    which ones were actually new. Only the lines being changed are touched, so comments, ordering
+    and any key not involved come out of this byte for byte the same. */
+async function allowAddressesInRepo(config: {
+    repoPath: string;
+    addressesByFingerprint: Map<string, string[]>;
+}) {
+    let { repoPath, addressesByFingerprint } = config;
+    let added = new Map<string, string[]>();
+    let filePath = path.join(repoPath, "authorized_keys");
+    let contents;
     try {
-        await readRepoKeys(repoPath);
+        contents = await fs.readFile(filePath, "utf8");
     } catch (e) {
-        throw new Error(`Expected ${repoPath} to be a keys repo, it holds no keys.\n${e}\n${USAGE}`);
+        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
+        // caller's listing is all whoever ran this gets.
+        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
+        return added;
+    }
+    let lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index++) {
+        let fingerprint = keyFingerprint(lines[index]);
+        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
+        if (!addresses || !addresses.length) {
+            continue;
+        }
+        let result = allowAddresses(lines[index], addresses);
+        lines[index] = result.keyLine;
+        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
+    }
+    if ([...added.values()].some(list => list.length)) {
+        await fs.writeFile(filePath, lines.join("\n"));
+    }
+    return added;
+}
+
+/** Puts each machine's addresses back into its own file, which is the machine equivalent of adding
+    an address to a key's from= list: without it the machine is allowed again in principle and
+    still rejected on sight, which revokes it once more. */
+async function allowAddressesForMachines(config: { repoPath: string; revocations: Revocation[] }) {
+    let { repoPath, revocations } = config;
+    let added = new Map<string, string[]>();
+    // Read the whole list, change what these revocations are about, write it back. Setting is by
+    // the whole set, so writing one machine at a time would delete every other machine.
+    let machines = await getMachines(repoPath);
+    for (let revocation of revocations) {
+        let machineId = revocation.machineId;
+        let ip = revocationIP(revocation);
+        if (!machineId || !ip) {
+            continue;
+        }
+        let existing = machines.find(machine => machine.machineId === machineId);
+        if (!existing) {
+            // Removed from the repo since it was revoked, so there is nothing to allow. Deleting a
+            // machine is the stronger statement and it stands.
+            console.log(`machines/${machineId}.json is not in this repo, so ${ip} was not added to it`);
+            continue;
+        }
+        if (existing.ips.includes(ip)) {
+            continue;
+        }
+        existing.ips = [...existing.ips, ip];
+        added.set(machineId, [...(added.get(machineId) || []), ip]);
     }
-    let origin = await spawnPromise({ command: "git", args: ["remote", "get-url", "origin"], cwd: repoPath });
-    let originURL = origin.stdout.trim();
-    if (origin.status !== 0 || !originURL) {
-        throw new Error(`Expected ${repoPath} to have an origin remote, it has none.\n${USAGE}`);
+    if (added.size) {
+        await setMachines({ repoPath, machines });
     }
-    return { repoPath, originURL };
+    return added;
 }
 
+
 export async function main() {
     let argv = process.argv.slice(2);
     let pushToGit = argv.includes(GIT_KEYWORD);
@@ -134,7 +205,7 @@ export async function main() {
     if (positional.length > 1) {
         throw new Error(`Expected at most a keys repo, was ${positional.length} argument(s)\n${USAGE}`);
     }
-    let { repoPath, originURL } = await resolveKeysRepo(positional[0]);
+    let { repoPath, sourceURL: originURL } = await resolveKeysRepo(positional[0]);
 
     let revocations = await readRemoteRevocations({ sourceURL: originURL });
     if (!revocations.length) {
@@ -149,36 +220,89 @@ export async function main() {
     await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
         unrevokeId,
         createdAt: new Date().toISOString(),
-        // Named one by one rather than as a blanket "allow everything again", so this file only
-        // ever undoes the revocations that existed when it was written.
-        revocationIds: revocations.map(revocation => revocation.revocationId),
+        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
+        // and not a blanket "allow everything again" - a key forgiven here for one address is
+        // still revoked the moment it is used from another.
+        allowed: revocations.map(revocation => ({
+            fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
+        })),
         revocations: revocations.map(revocation => ({
             revocationId: revocation.revocationId,
             fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
             revokedAt: revocation.revokedAt,
             revokedBy: revocation.revokedBy,
             attempt: revocation.attempt,
         })),
     }, undefined, 4) + "\n");
 
-    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
+    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
+    // which of their keys is being talked about.
+    let keysByFingerprint = new Map<string, string>();
+    for (let key of await readRepoKeys(repoPath).catch(() => [] as string[])) {
+        keysByFingerprint.set(keyFingerprint(key), key);
+    }
+    let describeKey = (revocation: Revocation) => {
+        let key = keysByFingerprint.get(revocation.fingerprint || "") || revocation.key || "";
+        return key && summarizeKey(key) || `a key no longer in this repo (${revocation.fingerprint})`;
+    };
+
+    let addressesByIdentity = new Map<string, string[]>();
     for (let revocation of revocations) {
-        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
+        let ip = revocationIP(revocation);
+        let identity = revocationIdentity(revocation);
+        let existing = addressesByIdentity.get(identity) || [];
+        if (ip && !existing.includes(ip)) {
+            existing.push(ip);
+        }
+        addressesByIdentity.set(identity, existing);
+    }
+
+    // Cancelling the revocation on its own would leave sshd refusing that address, and the machines
+    // revoking all over again, so the addresses go into the key's from= list and into the machine's
+    // own file here. We are in the repo that owns both, so there is nothing to hand back to whoever
+    // ran this.
+    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint: addressesByIdentity });
+    let addedForMachines = await allowAddressesForMachines({ repoPath, revocations });
+
+    console.log("");
+    for (let [identity, addresses] of addressesByIdentity) {
+        let entries = revocations.filter(entry => revocationIdentity(entry) === identity);
+        let machineId = entries[0].machineId;
+        console.log(`Unfreezing ${machineId && `machine ${machineId}` || describeKey(entries[0])}`);
+        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
+        let addedHere = machineId && addedForMachines.get(machineId) || added.get(identity) || [];
+        if (addedHere.length) {
+            let where = machineId && `machines/${machineId}.json` || `that key's from= list in authorized_keys`;
+            console.log(`  added to ${where}: ${addedHere.join(", ")}`);
+        } else {
+            console.log(`  already allowed from ${addresses.join(", ") || "everywhere"}`);
+        }
+        for (let entry of entries) {
+            console.log(
+                `  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`
+            );
+        }
+        console.log("");
     }
+    console.log(`Every other address stays frozen, and any of these used from anywhere else is`);
+    console.log(`frozen again.`);
 
     // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
     // all, and the repo would sit there looking done while every machine ignored it.
     await signRepo({ repoPath });
 
     if (!pushToGit) {
-        console.log(`\nCommit and push it, and each machine will wait an hour after seeing it before`);
-        console.log(`those keys work again:`);
+        console.log(`\nCommit and push it, and those keys work again as each machine picks it up:`);
         console.log(`\`\`\`\ngit add -A\ngit commit -m "${COMMIT_MESSAGE}"\ngit push\n\`\`\``);
         return;
     }
     await runPromise(`git add -A`, { cwd: repoPath });
     await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
     await runPromise(`git push`, { cwd: repoPath });
-    console.log(`\nCommitted and pushed. Each machine waits an hour after seeing it before those`);
-    console.log(`keys work again.`);
+    console.log(`\nCommitted and pushed. Those keys work again as each machine picks it up.`);
 }

package/security/helpers/dist/remoteSSH.ts.cache

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.SUDO_PREAMBLE = void 0;
+//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.describeHost = exports.THIS_MACHINE = exports.SUDO_PREAMBLE = void 0;
 const spawn_1 = require("./spawn");
 const SSH_CONNECT_TIMEOUT = 10;
 const EXISTS_MARKER = "__PORTSECURE_EXISTS__";
@@ -8,27 +8,37 @@ const MISSING_MARKER = "__PORTSECURE_MISSING__";
 const MAX_ERROR_BODY_LENGTH = 500;
 // /etc is root owned, so fall back to sudo whenever the SSH user is not root.
 exports.SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
+/** No host means this machine, so the very same script runs with nothing in front of it. Local and
+    remote then do exactly the same thing, rather than being two pieces of code that have to be kept
+    saying the same thing. */
+exports.THIS_MACHINE = "";
+function describeHost(host) {
+    return host || "this machine";
+}
+exports.describeHost = describeHost;
 /** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
     config, so BatchMode makes a missing setup fail immediately instead of prompting. */
 async function runOverSSH(config) {
     let { host, script, input, allowFailure } = config;
     let result = await (0, spawn_1.spawnPromise)({
-        command: "ssh",
-        args: [
+        command: host && "ssh" || "sh",
+        args: host && [
             "-o", "BatchMode=yes",
             "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
             host,
             script,
-        ],
+        ] || ["-c", script],
         input,
         inheritStderr: !allowFailure,
     });
     if (result.error) {
-        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+        throw new Error(`Expected to run against ${describeHost(host)}, failed with ${result.error.message}`);
     }
     if (result.status !== 0 && !allowFailure) {
-        throw new Error(`Expected ssh to ${host} to exit 0, was ${result.status}.`
-            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+        let advice = host
+            && ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.`
+            || "";
+        throw new Error(`Expected the script on ${describeHost(host)} to exit 0, was ${result.status}.${advice}\n`
             + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
     }
     return { stdout: result.stdout || "", stderr: result.stderr || "", status: result.status };
@@ -86,5 +96,5 @@ async function remoteCommandExists(config) {
     return result.stdout.trim() === "yes";
 }
 exports.remoteCommandExists = remoteCommandExists;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7d0ZBQ3dGO0FBQ2pGLEtBQUssVUFBVSxVQUFVLENBQUMsTUFBZ0Y7SUFDN0csSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQztRQUM1QixPQUFPLEVBQUUsS0FBSztRQUNkLElBQUksRUFBRTtZQUNGLElBQUksRUFBRSxlQUFlO1lBQ3JCLElBQUksRUFBRSxrQkFBa0IsbUJBQW1CLEVBQUU7WUFDN0MsSUFBSTtZQUNKLE1BQU07U0FDVDtRQUNELEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxtQkFBbUIsSUFBSSxtQkFBbUIsTUFBTSxDQUFDLE1BQU0sR0FBRztjQUN4RCxrQ0FBa0MsSUFBSSx3REFBd0Q7Y0FDOUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUNoRixDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDL0YsQ0FBQztBQXhCRCxnQ0F3QkM7QUFFRDtpQkFDaUI7QUFDVixLQUFLLFVBQVUsY0FBYyxDQUFDLE1BQTBDO0lBQzNFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2hDLElBQUksTUFBTSxHQUFHLENBQUMsTUFBTSxVQUFVLENBQUM7UUFDM0IsSUFBSTtRQUNKLE1BQU0sRUFBRSxHQUFHLHFCQUFhO29CQUNaLFFBQVE7WUFDaEIsYUFBYTtpQkFDUixRQUFROztZQUViLGNBQWM7R0FDdkI7S0FDRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDWCxJQUFJLFlBQVksR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xELElBQUksTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksYUFBYSxPQUFPLGNBQWMsU0FBUyxJQUFJLFNBQVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEksQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDMUMsQ0FBQztBQXJCRCx3Q0FxQkM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUFDLE1BTXJDO0lBQ0csSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkUsSUFBSSxTQUFTLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sVUFBVSxDQUFDO1FBQ2IsSUFBSTtRQUNKLHNGQUFzRjtRQUN0RixrREFBa0Q7UUFDbEQsS0FBSyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQztRQUN0QyxNQUFNLEVBQUUsR0FBRyxxQkFBYTs7a0JBRWQsU0FBUztjQUNiLGFBQWEsS0FBSyxTQUFTO2FBQzVCLFFBQVE7Y0FDUCxRQUFRLEtBQUssUUFBUSxHQUFHO0tBQ2pDLENBQUMsQ0FBQztBQUNQLENBQUM7QUFyQkQsMENBcUJDO0FBRU0sS0FBSyxVQUFVLG1CQUFtQixDQUFDLE1BQXlDO0lBQy9FLElBQUksRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQy9CLElBQUksTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDO1FBQzFCLElBQUk7UUFDSixNQUFNLEVBQUUsZUFBZSxPQUFPLDJDQUEyQztRQUN6RSxZQUFZLEVBQUUsSUFBSTtLQUNyQixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssS0FBSyxDQUFDO0FBQzFDLENBQUM7QUFSRCxrREFRQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuL3NwYXduXCI7XG5cbmNvbnN0IFNTSF9DT05ORUNUX1RJTUVPVVQgPSAxMDtcbmNvbnN0IEVYSVNUU19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9FWElTVFNfX1wiO1xuY29uc3QgTUlTU0lOR19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9NSVNTSU5HX19cIjtcbmNvbnN0IE1BWF9FUlJPUl9CT0RZX0xFTkdUSCA9IDUwMDtcblxuLy8gL2V0YyBpcyByb290IG93bmVkLCBzbyBmYWxsIGJhY2sgdG8gc3VkbyB3aGVuZXZlciB0aGUgU1NIIHVzZXIgaXMgbm90IHJvb3QuXG5leHBvcnQgY29uc3QgU1VET19QUkVBTUJMRSA9IGBTVURPPVwiXCI7IGlmIFsgXCIkKGlkIC11KVwiIC1uZSAwIF07IHRoZW4gU1VETz1cInN1ZG8gLW5cIjsgZmlgO1xuXG4vKiogVGhlIGhvc3Qgc3RyaW5nIGlzIGhhbmRlZCB0byBzc2ggdW50b3VjaGVkLiBVc2Vycywga2V5cyBhbmQgcG9ydHMgYmVsb25nIGluIHRoZSBjYWxsZXIncyBzc2hcbiAgICBjb25maWcsIHNvIEJhdGNoTW9kZSBtYWtlcyBhIG1pc3Npbmcgc2V0dXAgZmFpbCBpbW1lZGlhdGVseSBpbnN0ZWFkIG9mIHByb21wdGluZy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBydW5PdmVyU1NIKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IHNjcmlwdDogc3RyaW5nOyBpbnB1dD86IHN0cmluZzsgYWxsb3dGYWlsdXJlPzogYm9vbGVhbiB9KSB7XG4gICAgbGV0IHsgaG9zdCwgc2NyaXB0LCBpbnB1dCwgYWxsb3dGYWlsdXJlIH0gPSBjb25maWc7XG4gICAgbGV0IHJlc3VsdCA9IGF3YWl0IHNwYXduUHJvbWlzZSh7XG4gICAgICAgIGNvbW1hbmQ6IFwic3NoXCIsXG4gICAgICAgIGFyZ3M6IFtcbiAgICAgICAgICAgIFwiLW9cIiwgXCJCYXRjaE1vZGU9eWVzXCIsXG4gICAgICAgICAgICBcIi1vXCIsIGBDb25uZWN0VGltZW91dD0ke1NTSF9DT05ORUNUX1RJTUVPVVR9YCxcbiAgICAgICAgICAgIGhvc3QsXG4gICAgICAgICAgICBzY3JpcHQsXG4gICAgICAgIF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBzc2ggdG8gcnVuIGFnYWluc3QgJHtob3N0fSwgZmFpbGVkIHdpdGggJHtyZXN1bHQuZXJyb3IubWVzc2FnZX1gKTtcbiAgICB9XG4gICAgaWYgKHJlc3VsdC5zdGF0dXMgIT09IDAgJiYgIWFsbG93RmFpbHVyZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgc3NoIHRvICR7aG9zdH0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS5gXG4gICAgICAgICAgICArIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
- /* _JS_SOURCE_HASH = "b9707fe65376e19327371edb2ebdda68daa9b9b21220d7ac91ec21ef22520290"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7OzZCQUU2QjtBQUNoQixRQUFBLFlBQVksR0FBRyxFQUFFLENBQUM7QUFFL0IsU0FBZ0IsWUFBWSxDQUFDLElBQVk7SUFDckMsT0FBTyxJQUFJLElBQUksY0FBYyxDQUFDO0FBQ2xDLENBQUM7QUFGRCxvQ0FFQztBQUVEO3dGQUN3RjtBQUNqRixLQUFLLFVBQVUsVUFBVSxDQUFDLE1BQWdGO0lBQzdHLElBQUksRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkQsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUM7UUFDNUIsT0FBTyxFQUFFLElBQUksSUFBSSxLQUFLLElBQUksSUFBSTtRQUM5QixJQUFJLEVBQUUsSUFBSSxJQUFJO1lBQ1YsSUFBSSxFQUFFLGVBQWU7WUFDckIsSUFBSSxFQUFFLGtCQUFrQixtQkFBbUIsRUFBRTtZQUM3QyxJQUFJO1lBQ0osTUFBTTtTQUNULElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDO1FBQ25CLEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsSUFBSSxNQUFNLEdBQUcsSUFBSTtlQUNWLGtDQUFrQyxJQUFJLHNEQUFzRDtlQUM1RixFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUNYLDBCQUEwQixZQUFZLENBQUMsSUFBSSxDQUFDLG1CQUFtQixNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sSUFBSTtjQUN4RixHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUMvRixDQUFDO0FBMUJELGdDQTBCQztBQUVEO2lCQUNpQjtBQUNWLEtBQUssVUFBVSxjQUFjLENBQUMsTUFBMEM7SUFDM0UsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDaEMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFVBQVUsQ0FBQztRQUMzQixJQUFJO1FBQ0osTUFBTSxFQUFFLEdBQUcscUJBQWE7b0JBQ1osUUFBUTtZQUNoQixhQUFhO2lCQUNSLFFBQVE7O1lBRWIsY0FBYztHQUN2QjtLQUNFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNYLElBQUksWUFBWSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEMsSUFBSSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDbEQsSUFBSSxNQUFNLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxhQUFhLE9BQU8sY0FBYyxTQUFTLElBQUksU0FBUyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNsSSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksR0FBRyxDQUFDLENBQUMsQ0FBQztBQUMxQyxDQUFDO0FBckJELHdDQXFCQztBQUVNLEtBQUssVUFBVSxlQUFlLENBQUMsTUFNckM7SUFDRyxJQUFJLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRSxJQUFJLFNBQVMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxVQUFVLENBQUM7UUFDYixJQUFJO1FBQ0osc0ZBQXNGO1FBQ3RGLGtEQUFrRDtRQUNsRCxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDO1FBQ3RDLE1BQU0sRUFBRSxHQUFHLHFCQUFhOztrQkFFZCxTQUFTO2NBQ2IsYUFBYSxLQUFLLFNBQVM7YUFDNUIsUUFBUTtjQUNQLFFBQVEsS0FBSyxRQUFRLEdBQUc7S0FDakMsQ0FBQyxDQUFDO0FBQ1AsQ0FBQztBQXJCRCwwQ0FxQkM7QUFFTSxLQUFLLFVBQVUsbUJBQW1CLENBQUMsTUFBeUM7SUFDL0UsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDL0IsSUFBSSxNQUFNLEdBQUcsTUFBTSxVQUFVLENBQUM7UUFDMUIsSUFBSTtRQUNKLE1BQU0sRUFBRSxlQUFlLE9BQU8sMkNBQTJDO1FBQ3pFLFlBQVksRUFBRSxJQUFJO0tBQ3JCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLENBQUM7QUFDMUMsQ0FBQztBQVJELGtEQVFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4vc3Bhd25cIjtcblxuY29uc3QgU1NIX0NPTk5FQ1RfVElNRU9VVCA9IDEwO1xuY29uc3QgRVhJU1RTX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX0VYSVNUU19fXCI7XG5jb25zdCBNSVNTSU5HX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX01JU1NJTkdfX1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuXG4vLyAvZXRjIGlzIHJvb3Qgb3duZWQsIHNvIGZhbGwgYmFjayB0byBzdWRvIHdoZW5ldmVyIHRoZSBTU0ggdXNlciBpcyBub3Qgcm9vdC5cbmV4cG9ydCBjb25zdCBTVURPX1BSRUFNQkxFID0gYFNVRE89XCJcIjsgaWYgWyBcIiQoaWQgLXUpXCIgLW5lIDAgXTsgdGhlbiBTVURPPVwic3VkbyAtblwiOyBmaWA7XG5cbi8qKiBObyBob3N0IG1lYW5zIHRoaXMgbWFjaGluZSwgc28gdGhlIHZlcnkgc2FtZSBzY3JpcHQgcnVucyB3aXRoIG5vdGhpbmcgaW4gZnJvbnQgb2YgaXQuIExvY2FsIGFuZFxuICAgIHJlbW90ZSB0aGVuIGRvIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcsIHJhdGhlciB0aGFuIGJlaW5nIHR3byBwaWVjZXMgb2YgY29kZSB0aGF0IGhhdmUgdG8gYmUga2VwdFxuICAgIHNheWluZyB0aGUgc2FtZSB0aGluZy4gKi9cbmV4cG9ydCBjb25zdCBUSElTX01BQ0hJTkUgPSBcIlwiO1xuXG5leHBvcnQgZnVuY3Rpb24gZGVzY3JpYmVIb3N0KGhvc3Q6IHN0cmluZykge1xuICAgIHJldHVybiBob3N0IHx8IFwidGhpcyBtYWNoaW5lXCI7XG59XG5cbi8qKiBUaGUgaG9zdCBzdHJpbmcgaXMgaGFuZGVkIHRvIHNzaCB1bnRvdWNoZWQuIFVzZXJzLCBrZXlzIGFuZCBwb3J0cyBiZWxvbmcgaW4gdGhlIGNhbGxlcidzIHNzaFxuICAgIGNvbmZpZywgc28gQmF0Y2hNb2RlIG1ha2VzIGEgbWlzc2luZyBzZXR1cCBmYWlsIGltbWVkaWF0ZWx5IGluc3RlYWQgb2YgcHJvbXB0aW5nLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bk92ZXJTU0goY29uZmlnOiB7IGhvc3Q6IHN0cmluZzsgc2NyaXB0OiBzdHJpbmc7IGlucHV0Pzogc3RyaW5nOyBhbGxvd0ZhaWx1cmU/OiBib29sZWFuIH0pIHtcbiAgICBsZXQgeyBob3N0LCBzY3JpcHQsIGlucHV0LCBhbGxvd0ZhaWx1cmUgfSA9IGNvbmZpZztcbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogaG9zdCAmJiBcInNzaFwiIHx8IFwic2hcIixcbiAgICAgICAgYXJnczogaG9zdCAmJiBbXG4gICAgICAgICAgICBcIi1vXCIsIFwiQmF0Y2hNb2RlPXllc1wiLFxuICAgICAgICAgICAgXCItb1wiLCBgQ29ubmVjdFRpbWVvdXQ9JHtTU0hfQ09OTkVDVF9USU1FT1VUfWAsXG4gICAgICAgICAgICBob3N0LFxuICAgICAgICAgICAgc2NyaXB0LFxuICAgICAgICBdIHx8IFtcIi1jXCIsIHNjcmlwdF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0byBydW4gYWdhaW5zdCAke2Rlc2NyaWJlSG9zdChob3N0KX0sIGZhaWxlZCB3aXRoICR7cmVzdWx0LmVycm9yLm1lc3NhZ2V9YCk7XG4gICAgfVxuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwICYmICFhbGxvd0ZhaWx1cmUpIHtcbiAgICAgICAgbGV0IGFkdmljZSA9IGhvc3RcbiAgICAgICAgICAgICYmIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5gXG4gICAgICAgICAgICB8fCBcIlwiO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgdGhlIHNjcmlwdCBvbiAke2Rlc2NyaWJlSG9zdChob3N0KX0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS4ke2FkdmljZX1cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "50b1a08f2aa4b96f04f676f20c516bc6c2897a47ad7c12729c0f651735c71057"; */

package/security/machines/addMachine.ts

@@ -0,0 +1,84 @@
+import os from "os";
+import { getOwnIPs } from "../../misc/ownIPs";
+import { describeHost } from "../helpers/remoteSSH";
+import { createRemoteIdentity, Identity, localDomains, localIdentity, remoteIdentity } from "./identity";
+import { resolveKeysRepo } from "../authorizedKeys/keysRepo";
+import { getMachines, setMachines } from "./machines";
+
+const USAGE = `Usage: yarn addmachine <domain> [ip]
+
+The domain is required: a machine has a different identity, and so a different machine id, under
+every domain it runs under, so there is no such thing as "this machine" without one.
+
+With no ip it adds this machine, with its own addresses. With an ip it asks that machine over ssh
+for its identity under that domain, gives it one if it has none, and adds it under that address.
+
+It edits the keys repo this machine reads, wherever that is, not whatever directory this was run
+from. Nothing is signed or pushed here. Run "yarn signfiles git" in that repo afterwards, or no
+machine will believe any of it.`;
+
+export async function main() {
+    let argv = process.argv.slice(2);
+    if (!argv.length || argv.length > 2) {
+        throw new Error(`Expected a domain and optionally an ip, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [domain, host = ""] = argv;
+    // The same repo the acceptance check reads. Editing anything else would write a machine list
+    // nothing on this machine ever looks at.
+    let { repoPath } = await resolveKeysRepo();
+
+    let identity: Identity;
+    let addresses: string[];
+    if (!host) {
+        let found = await localIdentity(domain);
+        if (!found) {
+            throw new Error(
+                `Expected an identity for ${domain} in ${os.homedir()}, this machine has none.\n`
+                + `It has: ${(await localDomains()).join(", ") || "no identities at all"}\n`
+                + `One is generated the first time something runs here under a domain, so run that`
+                + ` first, or name another machine to add instead.`
+            );
+        }
+        identity = found;
+        addresses = await getOwnIPs();
+        if (!addresses.length) {
+            throw new Error(`Expected this machine to have an address anything else can see, it has none`);
+        }
+    } else {
+        // Nothing there under this domain means it gets one. Its own from this point on: the key
+        // is written there and nothing keeps a copy.
+        let found = await remoteIdentity(host, domain);
+        if (!found) {
+            console.log(`${describeHost(host)} has no identity for ${domain}, generating one`);
+        }
+        identity = found || await createRemoteIdentity({ host, domain });
+        // The address it was named by is the address it talks to us from, which is the one thing
+        // it cannot lie about.
+        addresses = [host];
+    }
+
+    // The whole list is read and written back, because setting is by the set: writing this one
+    // machine alone would remove every other machine from the repo.
+    let machines = await getMachines(repoPath);
+    let existing = machines.find(machine => machine.machineId === identity.machineId);
+    let ips = [...(existing?.ips || [])];
+    let added = addresses.filter(address => !ips.includes(address));
+    if (existing) {
+        existing.ips = [...ips, ...added];
+    } else {
+        machines.push({ machineId: identity.machineId, ips: [...added], addedAt: "" });
+    }
+    await setMachines({ repoPath, machines });
+
+    console.log(`\nTrusting machine ${identity.machineId}`);
+    console.log(`Allowing IP ${[...ips, ...added].join(", ")}`);
+    if (added.length) {
+        console.log(`  added to machines/${identity.machineId}.json: ${added.join(", ")}`);
+    } else {
+        console.log(`  already allowed from ${addresses.join(", ")}`);
+    }
+    console.log(`  identity ${identity.fullDomain}`);
+    console.log(`  in ${repoPath}`);
+    console.log(`\nNothing believes this until it is signed. In that repo, run:`);
+    console.log(`\`\`\`\nyarn signfiles git\n\`\`\``);
+}