feat(v2): complete v2 reimplementation

2026-07-31 13:33:39 +02:00
parent 396219e776
commit bd107d6a30
137 changed files with 20737 additions and 155 deletions
@@ -0,0 +1,19 @@
+# SSH sources
+
+SSH sources require a dedicated account confined by an OpenSSH `ChrootDirectory`
+and `ForceCommand internal-sftp`. The chroot directory is root-owned; writable
+content is below it. Disable passwords, keyboard-interactive authentication,
+shells, PTYs, TCP/X11/agent forwarding, and tunnelling. Configure the source
+root as `/` only.
+
+Generate a dedicated unencrypted Ed25519, ECDSA, or RSA-3072+ client key and
+store it through the write-only `ssh_private_key` secret endpoint. Do not put a
+key, passphrase, password, command, agent path, or key file path in source
+configuration. Pin the server's exact OpenSSH public host key (`algorithm
+base64`) before probing. On host-key rotation, obtain the replacement through
+an out-of-band administrative channel, update the source pin, then probe.
+
+The server administrator controls mutable content inside the chroot. The client
+rejects traversal names, symlinks, special files, changed files, and configured
+resource-limit overflows, but cannot claim atomic no-follow behavior against a
+maliciously changing filesystem inside that server-controlled boundary.