sliftutils 1.7.130 → 1.7.132

package/index.d.ts

@@ -4192,11 +4192,6 @@ declare module "sliftutils/storage/remoteStorage/deployTakeover" {
 
 }
 
-declare module "sliftutils/storage/remoteStorage/grantAccessCli" {
-    export {};
-
-}
-
 declare module "sliftutils/storage/remoteStorage/intermediateManagement" {
     import { RemoteConfig } from "../IArchives";
     /** Called every time a store applies a routing config to itself (see BlobStore's onRoutingApplied): arms the scans the config's upcoming window boundaries need. Each scan is scheduled once - the key includes the boundary it is for - so re-arming on every config application is harmless. */
@@ -4307,14 +4302,10 @@ declare module "sliftutils/storage/remoteStorage/remoteConfig" {
 }
 
 declare module "sliftutils/storage/remoteStorage/serverConfig" {
-    import type { IStorage } from "../IStorage";
-    import type { AccessRequest, TrustRecord } from "./storageController";
     export type StorageServerConfig = {
         domain: string;
         port: number;
         rootDomain: string;
-        sshTarget: string;
-        serverCommand: string;
         folder: string;
     };
     export declare function setStorageServerConfig(value: StorageServerConfig): void;
@@ -4324,12 +4315,6 @@ declare module "sliftutils/storage/remoteStorage/serverConfig" {
     export declare function getWritesRejectedReason(): string | undefined;
     export declare function assertWritesAllowed(): void;
     export declare function getStorageFolder(): string;
-    export declare function getTrust(): Promise<IStorage<TrustRecord>>;
-    export declare function getRequests(): Promise<IStorage<AccessRequest[]>>;
-    export declare function setTrustedMachines(config: {
-        account: string;
-        machineIds: string[];
-    }): Promise<void>;
     export declare function addExtraListenPort(port: number): void;
     export declare function removeExtraListenPort(port: number): void;
     /** Whether address:port is this server process, including its extra listen ports (a deploy switchover's alternate port is still us). Used to tell which config entries are OUR copy of a bucket - the stores we run - as opposed to peers we synchronize with. Talking to ourselves is not one of the things it prevents: a source that happens to be us is reached over the API like any other. */
@@ -4437,6 +4422,7 @@ declare module "sliftutils/storage/remoteStorage/storageController" {
     /// <reference types="node" />
     import { ArchiveFileInfo, ArchivesConfig, ArchivesSyncStatus, FindConfig, SourceConfig } from "../IArchives";
     import { ActiveBucketInfo, ServerBucketInfo } from "./storageServerState";
+    import { MachineState } from "../../security/machines/machines";
     import { AccessTotals, AccessSummaryState } from "./accessStats";
     import { LogFileInfo } from "../StreamingLogs";
     import type { SummaryEntry } from "../../treeSummary";
@@ -4454,25 +4440,13 @@ declare module "sliftutils/storage/remoteStorage/storageController" {
         signature: string;
         data: AuthTokenData;
     };
-    export type AccessRequest = {
-        requestId: string;
-        account: string;
-        machineId: string;
-        ip: string;
-        time: number;
-    };
-    export type TrustRecord = {
-        account: string;
-        machineId: string;
-        ip: string;
-        time: number;
-    };
     export type AccessState = {
         machineId: string;
         ip: string;
         hasAccess: boolean;
-        grantAccessCommand?: string;
-        trustedMachines?: TrustRecord[];
+        reason?: string;
+        addMachineCommand?: string;
+        trustedMachines?: MachineState[];
     };
     export declare function broadcastRoutingChanged(): void;
     export declare const RemoteStorageController: import("socket-function/SocketFunctionTypes").SocketRegistered<{
@@ -4481,34 +4455,13 @@ declare module "sliftutils/storage/remoteStorage/storageController" {
             machineId: string;
             ip: string;
         }>;
-        requestAccess: (config: {
-            account: string;
-        }) => Promise<{
-            machineId: string;
-            ip: string;
-            requestId: string;
-            grantAccessCommand: string;
-        }>;
         getAccessState: (config: {
             account: string;
         }) => Promise<AccessState>;
-        listRequestsForIP: (config: {
-            account: string;
-            ip: string;
-        }) => Promise<AccessRequest[]>;
-        grantAccess: (config: {
-            requestId: string;
-        }) => Promise<TrustRecord>;
         adminListActiveBuckets: () => Promise<{
             account: string;
             bucketName: string;
         }[]>;
-        adminListRequests: (config: {
-            ip: string;
-        }) => Promise<AccessRequest[]>;
-        adminGrantAccess: (config: {
-            requestId: string;
-        }) => Promise<TrustRecord>;
         get2: (config: {
             account: string;
             bucketName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.130",
+    "version": "1.7.132",
     "main": "index.js",
     "license": "MIT",
     "files": [

package/security/authorizedKeys/authorizedKeys.d.ts

@@ -0,0 +1,37 @@
+export declare function normalizeKeys(contents: string): string[];
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+export declare function keyFingerprint(keyLine: string): string;
+export declare const NO_RESTRICTION = "ANY ADDRESS (no from= restriction)";
+/** The addresses a key may be used from, one by one, or undefined when the key carries no from=
+    at all. Undefined and an empty list are very different things, so they stay distinguishable. */
+export declare function keyRestrictionList(keyLine: string): string[] | undefined;
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+export declare function keyRestriction(keyLine: string): string;
+/** Adds addresses to a key's from= list, leaving the rest of the line exactly as it was. Returns
+    which addresses were actually new, so a caller can report only what it changed.
+
+    A key with no from= at all is left alone: adding one would silently restrict a key that is
+    currently unrestricted, which is a different decision than the one being made here. */
+export declare function allowAddresses(keyLine: string, addresses: string[]): {
+    keyLine: string;
+    added: string[];
+};
+/** Enough to recognise whose key this is without printing the whole blob. */
+export declare function summarizeKey(keyLine: string): string;
+/** The shortest thing that still identifies a key to a person: the comment it carries, which is
+    usually user@machine, and otherwise the tail of the key itself. For the first line of a
+    notification, where there is only room for the one thing that matters. */
+export declare function keyNiceName(keyLine: string): string;
+/** What a set of keys has to satisfy before it is worth signing, as a list of complaints.
+
+    Every key needs a from=, because an unrestricted key can never be caught being used from the
+    wrong place, and being caught is the only thing that triggers a revocation.
+
+    No two keys may allow the same addresses, because that is one person holding two keys: revoking
+    one of them leaves the other working, so the revocation achieves nothing. */
+export declare function findKeyProblems(keys: string[]): string[];
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+export declare function readRepoKeys(repoPath: string): Promise<string[]>;

package/security/authorizedKeys/daemon/changes.d.ts

@@ -0,0 +1,17 @@
+/** A reason important enough to name the whole message. Its headline replaces the one the change
+    itself would have got, because "somebody is using a key they should not" outranks "the keys
+    changed" in the one line a phone shows. */
+export type LeadingReason = {
+    headline: string;
+    body: string;
+};
+export declare function addChangeReason(reason: string): void;
+/** For the one thing worth reading before anything else: somebody using a key from an address it
+    is not allowed from. */
+export declare function addLeadingChangeReason(reason: LeadingReason): void;
+/** The reasons gathered since the last write, and clears them. Called whether or not anything
+    changed, so reasons that came to nothing cannot show up against some later change. */
+export declare function takeChangeReasons(): {
+    leading: LeadingReason[];
+    reasons: string[];
+};

package/security/authorizedKeys/daemon/git.d.ts

@@ -0,0 +1,35 @@
+/** core.sshCommand keeps the key selection with the command instead of in the environment. */
+export declare function runGit(config: {
+    args: string[];
+    cwd?: string;
+    keyPath: string;
+    allowFailure?: boolean;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    status: number | undefined;
+    error: Error | undefined;
+}>;
+export declare function repoIsUsable(config: {
+    repoPath: string;
+    keyPath: string;
+}): Promise<boolean>;
+/** Cloned beside the old checkout and swapped in, so a clone that fails leaves the copy we are
+    already using untouched rather than deleting the only keys we have. */
+export declare function cloneRepo(config: {
+    repoURL: string;
+    repoPath: string;
+    keyPath: string;
+}): Promise<void>;
+export declare function currentBranch(config: {
+    repoPath: string;
+    keyPath: string;
+}): Promise<string>;
+/** Returns what changed, so the caller can report it. A rewritten history is called out
+    separately - it means the remote no longer contains the commits we already had. */
+export declare function syncRepo(repoURL: string): Promise<{
+    changed: boolean;
+    historyRewritten: boolean;
+    remoteSha: string;
+    previousSha: string;
+}>;

package/security/authorizedKeys/daemon/notify.d.ts

@@ -0,0 +1,8 @@
+export declare function setHostLabel(value: string): void;
+/** A headline and the rest.
+
+    The headline is all a phone shows. It gets the whole preview to itself: no product name, no
+    host, no timestamp in front of it, because a person glancing at their lock screen needs to read
+    what happened, not which machine said it or when. Those go at the end, where they are there for
+    whoever opens the message and out of the way of whoever does not. */
+export declare function notify(headline: string, body: string): Promise<void>;

package/security/authorizedKeys/daemon/paths.d.ts

@@ -0,0 +1,15 @@
+export declare const CONFIG_PATH = "/etc/portsecure/daemon.json";
+export declare const STATE_PATH = "/var/lib/portsecure/state.json";
+export declare const KEYS_HISTORY_PATH = "/var/lib/portsecure/authorized-keys-history";
+export declare const ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+export declare const SSHD_CONFIG_PATH = "/etc/ssh/sshd_config";
+export declare const SSHD_DROPIN_DIR = "/etc/ssh/sshd_config.d";
+export declare const SSHD_DROPIN_PATH = "/etc/ssh/sshd_config.d/00-portsecure.conf";
+export declare const PASSWD_PATH = "/etc/passwd";
+export declare const AUTH_LOG_PATH = "/var/log/auth.log";
+export declare const CHECK_INTERVAL: number;
+export declare const WEBHOOK_CHECK_INTERVAL: number;
+export declare const GIT_TIMEOUT: number;
+export declare const MAX_ERROR_BODY_LENGTH = 500;
+export declare const SIGNER_CHANGE_DELAY: number;
+export declare const MAX_REPO_FAILURES_BEFORE_RECLONE = 15;

package/security/authorizedKeys/daemon/repoFiles.d.ts

@@ -0,0 +1,25 @@
+/** Reading a repo, made to look like reading a directory. A caller asks for a file and gets its
+    contents; keeping a checkout on disk, cloning it once and pulling it since, is this module's
+    business and nobody else's.
+
+    Nothing here ever answers "there is nothing" when the truth is "I could not look". A repo that
+    cannot be reached throws, and the caller skips that source, because reading an unreachable
+    revoke repo as empty would un-revoke every key in it. */
+export type RepoRef = {
+    repoURL: string;
+    repoPath: string;
+    keyPath: () => Promise<string>;
+};
+export declare function sourceRepo(sourceURL: string): RepoRef;
+export declare function revokeRepo(sourceURL: string): RepoRef;
+/** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
+    nothing extra is stored anywhere it could be taken from. */
+export declare function ensureRevokeKey(sourceURL: string): Promise<string>;
+/** Brings the checkout in line with the remote. Cloned the first time, pulled after that, and the
+    usual case of nothing having changed costs one ref listing and no objects. Throws if the repo
+    cannot be read, so a caller cannot mistake that for an empty repo. */
+export declare function syncRepoFiles(repo: RepoRef): Promise<void>;
+/** One file out of the repo, or undefined if the repo does not have that file. */
+export declare function readRepoFile(repo: RepoRef, filePath: string): Promise<string | undefined>;
+/** The names in one of the repo's directories, or nothing if it has no such directory. */
+export declare function listRepoDir(repo: RepoRef, directory: string): Promise<string[]>;

package/security/authorizedKeys/daemon/revocation.d.ts

@@ -0,0 +1,74 @@
+export type Attempt = {
+    ip: string;
+    user: string;
+    port: string;
+    required: string;
+    line: string;
+};
+/** What an unrevoke has to name to undo a revocation, and what stops a second revocation of the
+    same key from the same address. */
+export declare function pairKey(config: {
+    fingerprint: string;
+    ip: string;
+}): string;
+/** Unique to the event. The time is there to read, the random half is there to be unique. */
+export declare function newRevocationId(fingerprint: string): string;
+export type RevocationFile = {
+    revocationId: string;
+    fingerprint: string;
+    ip: string;
+    revokedAt: string;
+    revokedBy: string;
+    reason: string;
+};
+export declare function readRevocationFiles(sourceURL: string): Promise<RevocationFile[]>;
+/** Which key is allowed from which address. Unrevokes live in the source repo, so they are covered
+    by its signature, and nothing is read out of them but the pairs they allow and, for files
+    written before pairs existed, the revocation ids they name. */
+export type Unrevokes = {
+    pairs: Map<string, string[]>;
+    legacyIds: Map<string, string[]>;
+};
+export declare function readUnrevokes(sourceURL: string): Promise<Unrevokes>;
+/** Every unrevoke covering one revocation: by the pair it is about, and by its id for the files
+    written before pairs existed. */
+export declare function unrevokesFor(unrevokes: Unrevokes, revocation: {
+    revocationId: string;
+    fingerprint: string;
+    ip: string;
+}): string[];
+/** Writes a revocation, unless this key is already revoked for this address. Checked twice:
+    against what this machine already knows, which needs no network, and again against the repo
+    after pulling it, so a flood of unknown keys cannot turn into a flood of commits.
+
+    Deduplication is on the pair. The same key from a second address is a second event and gets its
+    own revocation, because an unrevoke only ever forgives the pair it names. */
+export declare function recordRevocation(config: {
+    sourceURL: string;
+    fingerprint: string;
+    keyLine: string;
+    attempt: Attempt;
+    hostLabel: string;
+}): Promise<boolean>;
+/** Takes everything the revoke repos list into local state. Once here a revocation never leaves,
+    even if the file is deleted: the key that writes revocations is on every server, so an attacker
+    holding it could otherwise erase the record that locked them out. */
+export declare function absorbRevocations(sourceURLs: string[]): Promise<void>;
+/** An unrevoke counts the moment it is seen.
+
+    There used to be an hour's wait before honouring one, against a signing key that had itself
+    been stolen. It was never worth it: an unrevoke has to be signed, so writing one already takes
+    the hardware key, and anyone holding that can sign a new authorized_keys naming whatever they
+    like - they have no reason to go near an unrevoke. Meanwhile the wait cost real access, and a
+    machine deployed after an incident would freeze keys it had never had a problem with, for an
+    hour, because it was seeing the unrevoke for the first time.
+
+    What still protects a stolen signing key is the 24 hours before a NEW signer is accepted. */
+export declare function applyUnrevokes(sourceURLs: string[]): Promise<void>;
+/** Every key held out of authorized_keys: one that has at least one revocation nothing has
+    forgiven. A key forgiven for one address is an ordinary key again, and revoking it from another
+    address puts it back in here. */
+export declare function revokedFingerprints(): Set<string>;
+/** Drops revoked keys from the merged set, and says so the first time a key actually disappears -
+    which is the thing worth knowing, rather than the mere existence of a revocation. */
+export declare function removeRevokedKeys(keys: string[]): Promise<string[]>;

package/security/authorizedKeys/daemon/sessions.d.ts

@@ -0,0 +1,19 @@
+export type KeySession = {
+    processId: number;
+    user: string;
+    ip: string;
+    port: string;
+};
+export declare function parseAcceptedSessions(contents: string, fingerprint: string): KeySession[];
+/** Ends every live session that authenticated with this key. Returns what was ended, so the
+    revocation can say so rather than leaving it to be discovered. */
+export declare function endSessionsUsingKey(fingerprint: string): Promise<KeySession[]>;
+/** Disconnects every ssh session on the machine.
+
+    Not only the ones using the key that was just taken away: a session that predates the key being
+    removed is exactly as dangerous, and working out which sessions are still entitled to be here
+    is guesswork. Anyone who still has access can reconnect in a second, and anyone who does not
+    should not be here. */
+export declare function endAllSSHSessions(): Promise<number[]>;
+export declare function describeAllEnded(ended: number[]): string;
+export declare function describeEndedSessions(ended: KeySession[]): string;

package/security/authorizedKeys/daemon/state.d.ts

@@ -0,0 +1,67 @@
+/** What we last decided to trust for one source, kept on disk so nobody can tell us a different
+    story about what we saw last time. */
+export type SourceState = {
+    lastSha: string;
+    branch: string;
+    accepted: boolean;
+    acceptedSigner: string;
+    acceptedKeys: string[];
+    acceptedManifestHash: string;
+    acceptedSignatureHash: string;
+    pendingSigner: string;
+    pendingSince: number;
+    reportedProblem: string;
+};
+/** One revocation event: this key, used from this address, so it is no longer accepted. Kept even
+    when the revoke repo no longer lists it: the deploy key that writes revocations lives on every
+    server, so an attacker who took one could otherwise delete the revocation that locked them out.
+
+    The id is unique to the event, never derived from the key. A key that has been forgiven for one
+    address is still an ordinary key, and using it from some other address revokes it again, with a
+    new id that no existing unrevoke names. */
+export type RevocationState = {
+    revocationId: string;
+    fingerprint: string;
+    ip: string;
+    revokedAt: string;
+    revokedBy: string;
+    reason: string;
+    unrevokeId: string;
+    unrevoked: boolean;
+    reportedRemoved: boolean;
+};
+/** A refusal we saw but could not write down yet. Held until it is recorded, because the log is
+    read once and moves on: losing one of these to a repo that happened to be unreachable would
+    leave a key that was misused accepted forever. */
+export type PendingRevocation = {
+    fingerprint: string;
+    keyLine: string;
+    sourceURL: string;
+    attempt: {
+        ip: string;
+        user: string;
+        port: string;
+        required: string;
+        line: string;
+    };
+};
+export type DaemonState = {
+    sources: {
+        [repoURL: string]: SourceState;
+    };
+    userKeyHashes: {
+        [userName: string]: string;
+    };
+    revocations: {
+        [revocationId: string]: RevocationState;
+    };
+    pendingRevocations: PendingRevocation[];
+    appliedKeys: string[];
+    authLogOffset: number;
+    authLogSignature: string;
+};
+export declare function getState(): DaemonState;
+/** Per source progress, created on first use so a newly added source starts clean. */
+export declare function sourceState(repoURL: string): SourceState;
+export declare function loadState(): Promise<void>;
+export declare function saveState(): Promise<void>;

package/security/authorizedKeys/daemon/trust.d.ts

@@ -0,0 +1,20 @@
+/** The signature carries the public key that made it, so the key itself can be reported rather
+    than only a fingerprint. Returns it in the usual "type base64" form. */
+export declare function publicKeyFromSignature(signatureText: string): {
+    publicKey: string;
+    fingerprint: string;
+};
+/** Reads one checkout's keys. Prefers a top level authorized_keys file and otherwise concatenates
+    every .pub at the top level. */
+export declare function readCheckoutKeys(repoPath: string): Promise<string[]>;
+/** Proves a checkout on disk was signed, and that the files in it are the ones that were signed.
+    Returns the signer, and throws if anything about that does not hold.
+
+    Anything reading a repo for something other than ssh keys goes through this first: the whole
+    checkout is covered by one manifest, so a machine list is exactly as trustworthy as the keys
+    beside it, and neither is worth reading unsigned. */
+export declare function verifyCheckout(repoPath: string): Promise<string>;
+export declare function describeSigner(signer: string): string;
+/** The keys a source is allowed to contribute right now. A source signed by someone we have not
+    accepted keeps contributing the keys we last accepted, until the delay has passed. */
+export declare function resolveSourceKeys(repoURL: string): Promise<string[]>;

package/security/authorizedKeys/keysRepo.d.ts

@@ -0,0 +1,10 @@
+/** The keys repo to act on.
+
+    A named one if there is one, otherwise the repo the command is being run in if that repo holds
+    keys, otherwise this machine's own. Running in some other repo therefore reaches the keys repo
+    rather than acting on whatever happened to be around - signing sliftutils because that is where
+    the terminal was is never what anybody meant. */
+export declare function resolveKeysRepo(named?: string): Promise<{
+    repoPath: string;
+    sourceURL: string;
+}>;

package/security/authorizedKeys/revokeSource.d.ts

@@ -0,0 +1,13 @@
+export declare const REVOKE_KEY_LABEL = "revokegithubkey";
+export declare function revokeRepoURL(sourceURL: string): string;
+export declare function revokeKeyPath(sourceURL: string): string;
+export declare function legacyRevokeKeyPath(sourceURL: string): string;
+/** Wherever this source's revoke key already is, or nothing if it has not been derived yet. */
+export declare function findRevokeKey(sourceURL: string): Promise<string>;
+export declare function revokeRepoPath(sourceURL: string): string;
+/** The revoke repo's key, worked out from the source repo's key. Anything holding the source key
+    can produce it, so it never has to be stored anywhere separately or handed around. */
+export declare function deriveRevokeKey(sourcePrivateKey: string): {
+    publicKey: string;
+    privateKeyFile: string;
+};

package/security/authorizedKeys/sources.d.ts

@@ -0,0 +1,17 @@
+export declare const KEYS_DIR_NAME = "authorized_keys";
+export declare const LEGACY_REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
+export declare const REPOS_DIR = "/var/lib/portsecure/authorized-keys-repos";
+export declare function keysDir(): string;
+/** A repo url reduced to something usable as a file name. Derived rather than configured, so the
+    daemon and the deploy script always agree on where a source's key and checkout live. */
+export declare function sourceName(repoURL: string): string;
+export declare function sourceKeyPath(repoURL: string): string;
+export declare function legacySourceKeyPath(repoURL: string): string;
+export declare function sourceRepoPath(repoURL: string): string;
+/** The key for a source, wherever it happens to be. The user folder is where they go now, and the
+    old location is still read so a host that predates the move keeps working. */
+export declare function findKey(config: {
+    current: string;
+    legacy: string;
+}): Promise<string>;
+export declare function findSourceKey(repoURL: string): Promise<string>;

package/security/helpers/paths.d.ts

@@ -0,0 +1,4 @@
+/** Windows shells do not expand ~ themselves, and hunting down your home folder by hand is
+    annoying, so we expand it on every platform. Both separators are accepted, because a Windows
+    user may type either one. */
+export declare function expandHome(filePath: string): string;

package/security/helpers/spawn.d.ts

@@ -0,0 +1,16 @@
+/** An argument list rather than a shell string, so hostnames and paths can never be parsed as
+    shell syntax. Resolves with the exit code instead of throwing, callers decide what a failure
+    means. `inheritStderr` lets a child's own errors reach the terminal as they happen. */
+export declare function spawnPromise(config: {
+    command: string;
+    args: string[];
+    cwd?: string;
+    input?: string;
+    inheritStderr?: boolean;
+    timeoutTime?: number;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    status: number | undefined;
+    error: Error | undefined;
+}>;

package/security/keys/deriveKey.d.ts

@@ -0,0 +1,16 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/** A label mixed into a key's secret to get another key, so one key can stand behind several
+    identities without any of them being stored.
+
+    HMAC rather than hashing the two joined together: with a plain hash, anyone who obtained one
+    derived key could extend it into further labels without ever knowing the source key. The label
+    is the message and the source secret is the key, which is what HMAC is for. */
+export declare function deriveEd25519Key(config: {
+    seed: Buffer;
+    label: string;
+}): {
+    seed: Buffer;
+    publicKey: Buffer;
+};
+export declare function main(): Promise<void>;

package/security/keys/sshKeyFile.d.ts

@@ -0,0 +1,18 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/** The public key of a seed, worked out by node rather than by reimplementing the curve. */
+export declare function publicKeyFromSeed(seed: Buffer): Buffer;
+export declare function parseOpenSSHPrivateKey(contents: string): {
+    seed: Buffer;
+    publicKey: Buffer;
+    comment: string;
+};
+export declare function formatOpenSSHPrivateKey(config: {
+    seed: Buffer;
+    comment: string;
+}): string;
+/** The single line form, as it appears in authorized_keys and in a .pub file. */
+export declare function formatPublicKeyLine(config: {
+    publicKey: Buffer;
+    comment: string;
+}): string;