0.1.0: deterministic SSH keys, age identities with encryption, and child mnemonics from one mnemonic #9

clawbot · 2026-09-07T18:50:05+02:00

clawbot commented

2026-09-07 18:50:05 +02:00

Milestone PR for https://git.eeqj.de/sneak/keyfunc/milestone/28, the 0.1.0 release. next merges cleanly into main; this description says what is on the branch and is kept current.

Everything the README specifies is on the branch, each unit reviewed independently and landed on a passed review:

The module, script/ entrypoints and Makefile, Docker-only linting from a hash-pinned Dockerfile.lint, the Gitea workflow, and the mnemonic sources in the specified order with their refusals (issue 1).
keyfunc ssh pub and priv, with the README's two test vectors proven byte for byte and an index of 2147483648 or above refused before any derivation (issue 1).
keyfunc ssh install and keyfunc ssh to: the public line appended on a host only when absent, fed on standard input; the private key served from an in-process agent on a private socket and never written to disk (issue 2).
keyfunc age pub, priv, encrypt and decrypt, the identity derived the way secret derives it, the derived recipient always among encrypt's recipients (issue 3).
keyfunc mnemonic, child mnemonics of 12, 18 or 24 words from BIP-85's own mnemonic application, with the specification's test vectors as tests (issue 4).

make check is green on the head of next, run after the last landing. There is no licence file; that choice is yours. After merging, tag 0.1.0 on main.

Model: opus-5 (implementation and review); fable-5-1 (landing)

Milestone PR for https://git.eeqj.de/sneak/keyfunc/milestone/28, the 0.1.0 release. `next` merges cleanly into `main`; this description says what is on the branch and is kept current. Everything the README specifies is on the branch, each unit reviewed independently and landed on a passed review: - The module, `script/` entrypoints and Makefile, Docker-only linting from a hash-pinned `Dockerfile.lint`, the Gitea workflow, and the mnemonic sources in the specified order with their refusals (issue 1). - `keyfunc ssh pub` and `priv`, with the README's two test vectors proven byte for byte and an index of 2147483648 or above refused before any derivation (issue 1). - `keyfunc ssh install` and `keyfunc ssh to`: the public line appended on a host only when absent, fed on standard input; the private key served from an in-process agent on a private socket and never written to disk (issue 2). - `keyfunc age pub`, `priv`, `encrypt` and `decrypt`, the identity derived the way `secret` derives it, the derived recipient always among `encrypt`'s recipients (issue 3). - `keyfunc mnemonic`, child mnemonics of 12, 18 or 24 words from BIP-85's own mnemonic application, with the specification's test vectors as tests (issue 4). `make check` is green on the head of `next`, run after the last landing. There is no licence file; that choice is yours. After merging, tag `0.1.0` on `main`. Model: opus-5 (implementation and review); fable-5-1 (landing)

clawbot added the merge-ready label 2026-09-07 18:50:05 +02:00

sneak was assigned by clawbot

2026-09-07 18:50:05 +02:00

clawbot added 4 commits 2026-09-07 18:50:05 +02:00

Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1 )

check / check (push) Successful in 5s

Details

279cba6bcf

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

The mnemonic command: child mnemonics (closes #4 )

check / check (push) Successful in 4s

Details

d69bed722a

keyfunc mnemonic derives a 12, 18 or 24 word child mnemonic through BIP-85's own mnemonic application, with the specification's test vectors as tests. One review round, passed with no findings; the reviewer reproduced the vectors from an implementation written from the specification alone.

Model: opus-5 (implementation and review); fable-5-1 (landing)

The age commands: pub, priv, encrypt and decrypt (closes #3 )

check / check (push) Successful in 28s

Details

5bbeec86d6

keyfunc age derives an age identity at the generic path the way secret's agehd does, prints the recipient or the identity, and encrypts to or decrypts with it, the derived recipient always among encrypt's recipients. Two review rounds; the second passed with no findings, the clamping step now pinned by a fixed identity test.

Model: opus-5 (implementation and review); fable-5-1 (landing)

The ssh install and ssh to commands (closes #2 )

check / check (push) Successful in 2m30s

Details

b9c8631788

keyfunc ssh install appends the public line on a host through the system ssh, only when absent, feeding the line on standard input; keyfunc ssh to serves the derived key from an in-process agent on a private socket and runs the system ssh with it, the private key never on disk. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

sneak commented

2026-09-08 04:47:32 +02:00

ssh install can't expect to run code on the host. it needs to download the authorized keys file, alter it, and re-upload it. (to a sidecar file alongside then an atomic rename!)

sneak merged commit a2a0890ded into main

2026-09-08 04:49:05 +02:00

sneak referenced this issue from a commit

2026-09-08 04:49:05 +02:00

Merge pull request '0.1.0: deterministic SSH keys, age identities with encryption, and child mnemonics from one mnemonic' (#9) from next into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/keyfunc#9