Add vkey commits github and /settings github: gh signed in, key added

Author: vaulttec-dev

.github/workflows/audit.yml

@@ -5,9 +5,9 @@ name: audit
 
 on:
   push:
-    paths: ['**/Cargo.lock', '**/Cargo.toml', '.github/workflows/audit.yml']
+    paths: ['**/Cargo.lock', '**/Cargo.toml', '**/.cargo/audit.toml', '.github/workflows/audit.yml']
   pull_request:
-    paths: ['**/Cargo.lock', '**/Cargo.toml']
+    paths: ['**/Cargo.lock', '**/Cargo.toml', '**/.cargo/audit.toml']
   schedule:
     - cron: '17 6 * * 1'
   workflow_dispatch:
@@ -24,5 +24,9 @@ jobs:
           persist-credentials: false
       # rust-toolchain.toml pins the version; rustup installs it on the first call.
       - run: cargo install cargo-audit --locked
-      - run: cargo audit --file firmware/Cargo.lock
-      - run: cargo audit --file cli/Cargo.lock
+      # From each folder, as tools/checks.sh does: cargo audit reads .cargo/audit.toml
+      # from the working directory, not from beside the lock file.
+      - run: cargo audit
+        working-directory: firmware
+      - run: cargo audit
+        working-directory: cli

README.md

@@ -168,15 +168,18 @@ with apt first if it is missing.
 ```bash
 vkey commits enable    # a tap: an SSH key on the key, git signs every commit with it
 vkey commits disable   # git stops signing; the key stays for the next enable
+vkey commits github    # the key on GitHub as a signing key: commits show as verified
 ```
 
 `enable` makes an OpenSSH `ecdsa-sk` key on the nRF52840 (a tap) and keeps its handle in
 `~/.config/vkey/commit-signing-key`, which signs nothing without the key (not in
 `~/.ssh`, where GNOME Keyring's agent would take it and refuse to sign). It sets git's `gpg.format`,
 `user.signingkey`, `gpg.ssh.allowedSignersFile` and `commit.gpgsign` globally, refuses
 to overwrite a signing setup that is not its own, and offers to add the public half to
-GitHub as a signing key (`gh`), so the commits show as verified there. From then on every
-commit waits for a tap. In the shell it is `/settings` → `commits`, on or off. Linux only
+GitHub as a signing key (`gh`), so the commits show as verified there. `github` does that
+step alone: it signs `gh` in, or grants it the `admin:ssh_signing_key` permission, in the
+browser when it has to, then adds the key. From then on every commit waits for a tap. In
+the shell it is `/settings` → `commits`, on or off, and `/settings` → `github`. Linux only
 for now; macOS and Windows are issues #18 and #19. What it costs is in
 [the threat model](docs/threat-model.md#git-commits-signed-with-a-tap).
 

cli/src/commits.rs

@@ -3,6 +3,7 @@
 //! ```text
 //! vkey commits enable     an SSH key on the key, git told to sign with it
 //! vkey commits disable    git stops signing; the key stays for the next enable
+//! vkey commits github     the key on GitHub, so the commits show as verified
 //! ```
 //!
 //! The key is a FIDO2 authenticator (the nRF52840's passkeys), and OpenSSH keeps a
@@ -138,42 +139,78 @@ fn make_key(key: &Path) -> Result<(), Error> {
 }
 
 /// GitHub shows a commit as verified only when it knows the key as a signing key.
-/// Uploading publishes it, so it is asked, and needs `gh` with the scope for it.
+/// Uploading publishes it, so `enable` asks first.
 fn offer_to_github(key: &Path) -> Result<(), Error> {
-    let public = pub_path(key);
-    let by_hand = format!(
-        "  gh ssh-key add {} --type signing --title vkey",
-        public.display()
-    );
-    let gh = Command::new("gh").args(["auth", "status"]).output();
-    if !matches!(gh, Ok(ref o) if o.status.success()) {
+    if !prompt::is_tty()
+        || !prompt::yes_no("add the key to GitHub, so the commits show as verified?")
+    {
         println!(
-            "for GitHub to show the commits as verified, add the key as a signing key:\n{by_hand}"
+            "to add it later:  vkey commits github  (or /settings → github)\n  public key: {}",
+            pub_path(key).display()
         );
         return Ok(());
     }
-    if !prompt::is_tty() || !prompt::yes_no("add the key to GitHub as a signing key?") {
-        println!("to add it later:\n{by_hand}");
-        return Ok(());
+    github().map(drop)
+}
+
+/// The scope `gh` needs to add a signing key; a plain `gh auth login` does not ask it.
+const SCOPE: &str = "admin:ssh_signing_key";
+
+/// `vkey commits github`: the signing key's public half on GitHub as a signing key,
+/// signing `gh` in - or giving it the scope - in the browser first when it has to.
+pub fn github() -> Result<u8, Error> {
+    let public = pub_path(&home()?.join(KEY));
+    if !public.exists() {
+        return Err(Error::Value(
+            "no signing key yet:  vkey commits enable".into(),
+        ));
     }
-    let out = Command::new("gh")
-        .args(["ssh-key", "add"])
-        .arg(&public)
-        .args(["--type", "signing", "--title", "vkey"])
-        .output()?;
-    if out.status.success() {
-        println!("added to GitHub: commits signed by this key show as verified");
-        return Ok(());
+    let signed_in = match Command::new("gh").args(["auth", "status"]).output() {
+        Ok(out) => out.status.success(),
+        Err(_) => {
+            return Err(Error::Value(
+                "gh, GitHub's CLI, is missing:  sudo apt install gh".into(),
+            ));
+        }
+    };
+    if !signed_in {
+        println!("gh signs in to GitHub in the browser first");
+        gh_interactive(&["auth", "login", "-h", "github.com", "-s", SCOPE])?;
     }
+    let mut out = add_key(&public)?;
+    if !out.status.success() && String::from_utf8_lossy(&out.stderr).contains(SCOPE) {
+        println!("gh needs one more permission, to add signing keys: grant it in the browser");
+        gh_interactive(&["auth", "refresh", "-h", "github.com", "-s", SCOPE])?;
+        out = add_key(&public)?;
+    }
+    // gh answers success for a key GitHub already has, so both read the same.
     let why = String::from_utf8_lossy(&out.stderr);
-    if why.contains("admin:ssh_signing_key") {
-        println!(
-            "gh needs the scope to add signing keys first:\n  gh auth refresh -h github.com -s admin:ssh_signing_key\nthen:\n{by_hand}"
-        );
-    } else if why.contains("already") {
-        println!("GitHub already has this key");
+    if out.status.success() || why.contains("already") {
+        println!("the key is on GitHub: commits signed with it show as verified");
     } else {
-        println!("GitHub refused the key: {}\n{by_hand}", why.trim());
+        return Err(Error::Value(format!(
+            "GitHub refused the key: {}",
+            why.trim()
+        )));
+    }
+    Ok(0)
+}
+
+fn add_key(public: &Path) -> Result<std::process::Output, Error> {
+    Ok(Command::new("gh")
+        .args(["ssh-key", "add"])
+        .arg(public)
+        .args(["--type", "signing", "--title", "vkey"])
+        .output()?)
+}
+
+/// `gh` with the terminal: it prints a one-time code and opens the browser.
+fn gh_interactive(args: &[&str]) -> Result<(), Error> {
+    if !Command::new("gh").args(args).status()?.success() {
+        return Err(Error::Value(format!(
+            "gh {} did not finish",
+            args.join(" ")
+        )));
     }
     Ok(())
 }

cli/src/main.rs

@@ -216,6 +216,9 @@ enum CommitsCmd {
     Enable,
     /// git stops signing; the key stays for the next enable
     Disable,
+    /// The signing key on GitHub, so the commits show as verified; signs gh in, or
+    /// gives it the permission, in the browser when it has to
+    Github,
 }
 
 #[derive(Subcommand, Clone, Copy)]
@@ -328,6 +331,9 @@ fn run_off_port(cli: &Cli) -> Option<Result<u8, Error>> {
         Cmd::Commits {
             cmd: CommitsCmd::Disable,
         } => commits::disable(),
+        Cmd::Commits {
+            cmd: CommitsCmd::Github,
+        } => commits::github(),
         Cmd::Setup { erase, board } => cmd_setup(cli.port.as_deref(), board.as_deref(), *erase),
         _ => return None,
     })

cli/src/shell.rs

@@ -70,6 +70,10 @@ const SETTINGS: &[(&str, &str)] = &[
         "commits",
         "sign every git commit with a tap - turn on or off",
     ),
+    (
+        "github",
+        "sign in to GitHub and add the signing key, so commits show as verified",
+    ),
     (
         "wipe",
         "factory reset - every secret and the PIN; the button is held, not tapped",
@@ -2434,6 +2438,13 @@ impl Shell {
                 let r = self.cmd_commits();
                 return self.report(r);
             }
+            "github" => {
+                let r = std::env::current_exe()
+                    .map_err(Error::from)
+                    .and_then(|exe| self.outside(Command::new(exe).args(["commits", "github"])))
+                    .map(drop);
+                return self.report(r);
+            }
             _ => {}
         }
         if !self.connected() && !self.reconnect() {