[FEATURE-REQUEST] support ssh-keygen -Y format data signature

[gzm55]

can we support the native data signature format, generated via command ssh-keygen -Y sign ...?

[scheibling]

Let me look into it, I'll just leave some notes for myself below. Shouldn't be too hard to accomplish, we have most of the pieces for the generation and formatting in place already

https://man.openbsd.org/ssh-keygen.1#Y~4
https://github.com/openssh/openssh-portable/blob/d575cf44895104e0fcb0629920fb645207218129/PROTOCOL.sshsig
https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig
https://www.agwa.name/blog/post/ssh_signatures

[scheibling]

Scheduling this for the next minor version (0.10.1) due to a larger amount of changes

[scheibling]

Moving to 0.11.1 instead due to DSA deprecation requiring 0.10.1

[gzm55]

Moving to 0.11.1 instead due to DSA deprecation requiring 0.10.1

@scheibling any recent updates?

[scheibling]

@gzm55 Yes, sorry for the late reply. Currently working on this in a feature branch, hopefully I'll be able to finally finish it this week... This fall has been a bit hectic

[scheibling]

@gzm55 So, finally another update. I'm getting closer, if you have time and wanna have a look it's in the dev-data-signatures branch.

There's still some checks and finetuning to do, and some smaller bugs to fix, but if you have a look in the validate_signatures.py-file in that branch the loading and parsing of the signatures works, including the validation (although I haven't run this through any larger testing yet, so it's not production-ready by any measure). Signing and saving to file should work in most cases as well!

[gzm55]

@gzm55 So, finally another update. I'm getting closer, if you have time and wanna have a look it's in the dev-data-signatures branch.

There's still some checks and finetuning to do, and some smaller bugs to fix, but if you have a look in the validate_signatures.py-file in that branch the loading and parsing of the signatures works, including the validation (although I haven't run this through any larger testing yet, so it's not production-ready by any measure). Signing and saving to file should work in most cases as well!

hooray, i will try in the week end~

[scheibling]

@gzm55 Did you have a chance to try this out?