Reading the ski SSH certificate issuer

ski is a small SSH certificate issuer. A user logs in to it, completes a password-and-TOTP exchange, and receives a new Ed25519 keypair plus a signed OpenSSH user certificate in their forwarded ssh-agent. The code does not implement its own crypto or mechanism. It uses existing facilities of the OpenSSH protocol stack, and the proven AsyncSSH python library. We will look at the code in detail in a few critical places: load a CA safely, authenticate an identity, turn its groups into principals, sign a new key, then inject the result into the agent. The previous article demonstrates how to operate the thing and what that looks like. This one is a code tour. CA ski ca init enters through initialize_ca() in src/ski/ca_commands.py . It delegates file creation to CAFileWriter, then records the public key, fingerprint, and active state in SQLite. The key generation itself is plain AsyncSSH: 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 def _generate(self) ->…