Skip to content

Add SSH certificate authentication for targets, issued by Vault #2397

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
janisdombr wants to merge 46 commits into
base: main
Choose a base branch
from
Open

Add SSH certificate authentication for targets, issued by Vault #2397

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
46 commits
Select commit Hold shift + click to select a range
57cdbc0
Add SSH certificate authentication for targets, issued by Vault
janisdombr Aug 10, 2026
bea50d4
Close the vulnerabilities found in review of the certificate path
janisdombr Aug 11, 2026
d818090
Test the certificate path against real issuers, and fix what that found
janisdombr Aug 11, 2026
6bd00e1
Check what the issuer returns more strictly, and bound the handshake
janisdombr Aug 11, 2026
561a9d1
Check the whole surface, not the parts that were pointed at
janisdombr Aug 12, 2026
55f49c4
Give the sshd fixture the name a jump host dials
janisdombr Aug 12, 2026
f6d734d
Close the whole ledger, not the items that were pointed at
janisdombr Aug 13, 2026
f13b043
Merge upstream main
janisdombr Aug 13, 2026
110820c
Resume the handshake deadline instead of cancelling it
janisdombr Aug 14, 2026
2a978f7
Name a discriminator for every guard, and mark an unattributed key ID
janisdombr Aug 14, 2026
d482ad7
Measure the guards instead of asserting them
janisdombr Aug 14, 2026
39bde2a
Enforce every pin, reserve the token names, and settle the budget guard
janisdombr Aug 14, 2026
58245a3
Silence the AWS SDK crates under aws_config, not just aws_config
janisdombr Aug 14, 2026
a11a837
Parse pytest's counts instead of matching its summary as a substring
janisdombr Aug 14, 2026
55dd5ee
Rebuild the binary after restoring, not only after mutating
janisdombr Aug 14, 2026
a596c65
Record the run artifact for the integration-pinned guards
janisdombr Aug 14, 2026
6d4d6cf
One verifier for every guard, whatever language its test is in
janisdombr Aug 14, 2026
f6ed355
Measure all 43 guards in one run for the first time
janisdombr Aug 15, 2026
03cdec7
Give two guards evidence, and derive the crate list instead of typing it
janisdombr Aug 15, 2026
7e7437d
Set the verification mode the deadline test always claimed to set
janisdombr Aug 15, 2026
60e0e63
Assert the refusal the comment called an assertion
janisdombr Aug 15, 2026
4cb03a6
Keep the guard verifier out of the pull request
janisdombr Aug 15, 2026
df8d025
Merge upstream main
janisdombr Aug 15, 2026
feb4749
Wipe the response buffer before it is freed, not after
janisdombr Aug 15, 2026
37e1c34
Close the last open items, including the ones nobody had read
janisdombr Aug 15, 2026
4bc4036
Keep the gateway's own attribution out of the substitution
janisdombr Aug 15, 2026
821e603
Fix what CI and an outside verifier found, and stop guessing at the d…
janisdombr Aug 16, 2026
4954f9d
Give each host-key guard its own test, and assert identity not differ…
janisdombr Aug 16, 2026
8684cf2
Merge branch 'warp-tech:main' into feat/vault-ssh-certificate-auth
janisdombr Aug 16, 2026
63bc1e5
Merge remote-tracking branch 'fork/feat/vault-ssh-certificate-auth' i…
janisdombr Aug 17, 2026
0df7ae5
Merge upstream, and keep one fix for the host-key bug rather than two
janisdombr Aug 17, 2026
2da1c73
Make the mutation matrix runnable again, and name its real invocation
janisdombr Aug 18, 2026
814df11
Stop the harness depending on the working directory and on name resol…
janisdombr Aug 18, 2026
a2d4def
Two usernames can no longer produce one key ID, and a log line cannot…
janisdombr Aug 18, 2026
877d96b
Give every test its own scratch directory instead of one named after …
janisdombr Aug 18, 2026
a505382
Close the abort ordering, the AppRole role ID, and three honesty gaps
janisdombr Aug 18, 2026
695a2e4
Merge upstream v0.28.0-beta.3
janisdombr Aug 18, 2026
6942e06
Bound the target's own answer, and stop one sentence covering two jobs
janisdombr Aug 18, 2026
b2ddddc
Make the host-key deadline test drive the code instead of two constants
janisdombr Aug 18, 2026
859fe99
Stop a never-expiring certificate panicking the session before it is …
janisdombr Aug 18, 2026
8e06df7
Assert the escape was neutralised, not that it was absent
janisdombr Aug 18, 2026
34550c7
Run the guards in CI, on the shape the auditor ruled for
janisdombr Aug 18, 2026
7129438
Refuse a second matrix run, and let the pre-checks say they are working
janisdombr Aug 18, 2026
02792ac
Stop one guard's mutated gateway becoming the next guard's baseline
janisdombr Aug 19, 2026
93e37ae
Measure every guard in one run: 53 of 53 discriminate
janisdombr Aug 19, 2026
618fd35
Merge upstream v0.28.0
janisdombr Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,6 @@ node_modules
.github
*.md
.env

# rustc crash dumps land in the working directory and are not ours to keep
rustc-ice-*.txt
105 changes: 104 additions & 1 deletion Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ members = [
"warpgate-protocol-vnc",
"warpgate-desktop-ui",
"warpgate-sso",
"warpgate-vault",
"warpgate-web",
"warpgate-web-clients-common",
"warpgate-web-desktop",
Expand Down
Loading
Loading