Keys and the registry

bay keeps its keys in the registry, the Git ref refs/bay/registry. The registry is a chain of commits. Each commit holds four OpenSSH allowed-signers files: agent, executor, producer and registry. In this release, a registry-key holder edits the registry by hand with Git.

Rules for the files

• Write one line per key: <principal> <keytype> <base64>.
• Give each line exactly one principal, no options, and no cert-authority.
• Put each public key in exactly one file.
• The hook refuses any other shape.
• The hook takes a new registry commit only when a key in the current registry file signed it.
• The new commit must also fast-forward the ref.

Add or revoke a key

Run these steps from a clone of the repository. Sign with a registry-class key that the people who run the repository keep. Never sign the registry with an agent key.

git fetch origin refs/bay/registry:refs/bay/registry
dir=$(mktemp -d)
for f in agent executor producer registry; do
  git show refs/bay/registry:$f > "$dir/$f"     # first registry: create the four files instead
done

# add: append one line to the class file
echo "agent-7 ssh-ed25519 AAAAC3Nza..." >> "$dir/agent"
# revoke: delete that key's line from its file

tree=$(for f in agent executor producer registry; do
  printf '100644 blob %s	%s
' "$(git hash-object -w "$dir/$f")" "$f"
done | git mktree)
old=$(git rev-parse refs/bay/registry)
new=$(git -c gpg.format=ssh -c user.signingkey="$HOME/.ssh/bay-registry"   commit-tree -S "$tree" -p "$old" -m "revoke agent-7")   # first registry: no -p
git update-ref refs/bay/registry "$new" "$old"
git push origin refs/bay/registry                      # never --force

When a change takes effect

• A revocation applies to every push after it.
• bay still honours a request that an older registry version allowed at signing time.
• bay's own checks read the current registry, so they apply the change after the next fetch.
• Plain git verify-commit keeps the old list until bay install runs again on that machine.
• So run bay install on each machine where people verify commits with plain Git.