diff options
| author | tv <tv@krebsco.de> | 2026-11-09 02:49:25 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 02:49:25 +0000 |
| commit | c2e566599aed088973b5a5be2bb04ee69cee5c7a (patch) | |
| tree | 11fb923c99318f6e927bcaff65ed918865b6ab54 /docs | |
| parent | 51c7a4c2588b3f4064ba116276796741b3170de6 (diff) | |
access: keep an SSH key's comment
A key's line was stored as the key alone (`ssh-ed25519 <base64>`), whatever comment it
came with, both from `PUT /auth/keys/<name>` and from `--bootstrap-keys`. Now its
comment is kept after it (`PublicKey::kept_line`), the spaces between its words made
one. The comment checks nothing: every use of a key parses the line, and the parse
reads the key alone.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/docs/access.md b/docs/access.md index 4bb5945..7392bb9 100644 --- a/docs/access.md +++ b/docs/access.md @@ -30,8 +30,8 @@ password hashes: every member reads the document). An entry that doesn't read as above gives less, never more: a capability that doesn't read is left out, and anything but `false` disables. * **`keys`**: the user's SSH keys, each by a name of its choosing, as an - `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA…"`; Ed25519 only): what - it signs values with (Values signed by their users, below) and logs in with. A user + `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA… alice@laptop"`; Ed25519 + only; the comment is kept and checks nothing): what it signs values with (Values signed by their users, below) and logs in with. A user manages its own, whatever else it may do: `GET /auth/keys`, `PUT /auth/keys/<name>` with the line, `DELETE /auth/keys/<name>`; under a strict policy, by signing its entry with only its keys changed (`continuum-signed key-add laptop |
