6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	15ebe24f7b	README: policy sections and age and child mnemonic vectors (closes #21) ... The README gains the sections REPO_POLICIES.md requires: a first sentence naming the category and author, Getting Started, Entrypoints (one line per `script/` file), Rationale, Design, TODO (the open issues between the tree and 1.0), License and Author. It also publishes test vectors for age and child mnemonics, copied from the tests. Disclosures: - No license is named; the choice is open on the tracker and the README says so. - The 12-word child mnemonic is the BIP-85 specification vector, the only one the test asserts, and is labelled as such. - Markdown is hand-wrapped; `make fmt` here formats Go only. Model: opus-4-8 (implementation, review); fable-5-1 (merge message)	2026-09-21 16:24:28 +02:00
clawbot	64dcc7f42b	Keep the mnemonic out of the ssh and sftp children (closes #16) ... `keyfunc ssh to` and `keyfunc ssh install` started the system `ssh` and `sftp` with the tool's whole environment, so a mnemonic given in `KEYFUNC_MNEMONIC` stayed readable in the child's environment and could be forwarded to the host by a `SendEnv` line. Both children now get the environment with `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` removed, through one helper, `childEnv`, in the ssh cli package. The mnemonic command still runs with the full environment. Two tests drive the real commands against the stand-in `ssh` and `sftp` and check that a third variable still arrives. Model: opus-4-8 (implementation, review); fable-5-1 (merge message)	2026-09-21 14:58:26 +02:00
clawbot	3d90ac87f1	ssh install tells a missing .ssh from one it cannot enter (closes #10) ... The first sftp session now lists .ssh before fetching authorized_keys. The file reads as empty only when sftp reports .ssh itself as missing, or the listing succeeded and the file is reported missing. A directory or file that is there but cannot be read fails the run and nothing is written, so no existing authorized_keys is replaced by content that was not built from what was read. An .ssh that already exists keeps its mode; the directory is made and set to 0700 only when none was found. The README describes the rule and states batch mode's limit: a key or an agent must authenticate. Model: opus-4-8 (implementation); fable-5-1 (summary)	2026-09-21 09:49:59 +02:00
clawbot	e6ddf49acc	Report the module version for a go install build (closes #18) ... keyfunc --version printed dev for any binary not built with make build. When no version was stamped at build time, the tool now reports the module version recorded in the binary's build info, which go install fills in. A stamped version still wins, and a local build with neither still prints dev. Model: opus-4-8 (implementation); fable-5-1 (summary)	2026-09-21 09:39:38 +02:00
clawbot	860e590114	Update dependencies to current releases (closes #19) ... Every direct dependency moves to its current release, golang.org/x/crypto first: keyfunc ssh to serves keys through its ssh/agent package, which has had security fixes since the pinned 2025-05 version. go.mod and go.sum only; no code changed and the SSH, age and child mnemonic test vectors pass unedited, so no derived key moves. Model: opus-4-8 (implementation); fable-5-1 (summary)	2026-09-21 09:34:26 +02:00
clawbot	63575ce827	Move the entrypoint to cmd/keyfunc (closes #20) ... main.go moves unchanged to cmd/keyfunc/main.go, where REPO_POLICIES.md puts Go entrypoints, and the Makefile build target builds ./cmd/keyfunc. The binary is still written to ./keyfunc and still carries the stamped version. Model: opus-4-8 (implementation); fable-5-1 (summary)	2026-09-21 09:25:38 +02:00