backup-tool/docs/release/m10-evidence.md

M10 SSH source evidence

The released source capability is ssh: private-key-only, pinned-host-key, forced-SFTP chroot access. No password, shell, command channel, agent, default key discovery, or arbitrary remote root is supported.

Fixture

tests/compose.ssh.yaml builds a test-only OpenSSH server. Each run generates host and client Ed25519 keys under pytest tmp_path, mounts no committed keys, and configures a dedicated backup account with ChrootDirectory /home/backup and ForceCommand internal-sftp. The ordinary operator Compose stack is not modified. Run make test-ssh-integration to build, run, and tear down the fixture.

Verification

• Fake transport tests cover pin mismatch before authentication/SFTP, bounded reads, unsafe entries, and accepted/rejected private-key algorithms.
• The opt-in live test covers a private-key probe, backup, signed verification, and restore through the forced-SFTP fixture.
• make test-ssh-integration passed after fixture isolation and SFTP-channel concurrency fixes.
• Final make check passed: 107 unit/contract, 73 integration (one skipped), 15 fault, and 33 security tests; Ruff, mypy, TypeScript, and the frontend build passed.

See docs/runbooks/ssh-sources.md for deployment prerequisites, rotation, and containment limitations.