mirror_key.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package domain
4
5import (
6	"crypto/ed25519"
7	"crypto/sha256"
8	"encoding/base64"
9	"encoding/binary"
10	"net/url"
11	"time"
12)
13
14const MirrorKeyPath = "mirror/key" // KV key and secretbox AAD of the sealed seed
15type MirrorPublicKey struct {
16	AuthorizedKey string // "ssh-ed25519 AAAA… ermite-mirror@<host>"
17	Fingerprint   string // "SHA256:<base64 no padding>"
18	CreatedAt     time.Time
19}
20
21func MirrorKeyComment(publicURL string) string {
22	host := "localhost"
23	if u, e := url.Parse(publicURL); e == nil && u.Hostname() != "" {
24		host = u.Hostname()
25	}
26	return "ermite-mirror@" + host
27}
28
29// MirrorPublicKeyOf formats an ed25519 public key (wire encoding + base64 done with stdlib).
30func MirrorPublicKeyOf(pub ed25519.PublicKey, host string, createdAt time.Time) MirrorPublicKey {
31	wire := make([]byte, 4+len("ssh-ed25519")+4+len(pub))
32	binary.BigEndian.PutUint32(wire, uint32(len("ssh-ed25519")))
33	copy(wire[4:], "ssh-ed25519")
34	offset := 4 + len("ssh-ed25519")
35	binary.BigEndian.PutUint32(wire[offset:], uint32(len(pub)))
36	copy(wire[offset+4:], pub)
37	sum := sha256.Sum256(wire)
38	return MirrorPublicKey{AuthorizedKey: "ssh-ed25519 " + base64.StdEncoding.EncodeToString(wire) + " " + MirrorKeyComment("https://"+host), Fingerprint: "SHA256:" + base64.RawStdEncoding.EncodeToString(sum[:]), CreatedAt: createdAt}
39}