Proposal: Enhanced Certificate Authentication Helpers

[marlon-costa-dc]

Summary

I'd like to contribute enhanced authentication helpers to libplugin/ that add:

• SSH certificate validation against trusted CAs
• Multiple CA key sources (file, base64, Vault)
• Standardized helpers to reduce code duplication

Motivation

The current certificate authentication works but enterprise deployments need:

1. Multiple CA sources - Not just files, but also inline base64 and Vault secrets
2. Certificate validation helpers - Reusable MatchAndValidateCACert() function
3. Code deduplication - Same patterns repeated across yaml, docker, kubernetes plugins

Proposed Changes (Incremental PRs)

I plan to submit this as small, incremental PRs:

Phase	File	Lines	Description
1	libplugin/sshutil.go	~90	Certificate validation, known_hosts verification
2	libplugin/skelhelpers.go	~200	StandardTrustedUserCAKeys, StandardAuthorizedKeys
3	libplugin/skelhelpers.go	~150	StandardTestPassword, StandardPrivateKey
4	libplugin/authutil.go	~300	Vault integration (optional)
5	libplugin/authutil.go	~250	Multi-source aggregation

Each PR builds on the previous and can be reviewed independently.

Questions

1. Would you prefer this approach or a single larger PR?
2. Is Vault integration welcome? (Can be made optional via build tags)
3. Any concerns about adding helpers to libplugin?

Implementation Ready

I have working implementations tested in a fork. Happy to adjust based on feedback.

[tg123]

1 I prefer smaller PR so my small mem brain might not throw oom
2 yes, and you may check full signer in remote side https://github.com/tg123/sshpiper/blob/b51cbaff850cfb1b92307854e7498614aaa61e81/e2e/testplugin/testgrpcplugin/main.go#L89C1-L90C1

in real world, it works with https://github.com/tg123/azkeyvault together to have a privatekey-less sshpiper

3 should be friendly to plugins outside the repo e.g. https://github.com/tg123/sshpiper-plugins

thanks for the amazing idea