alkssh

56 Commits 1 Branch 2 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
glm-5.3-flash	214690b9c2	test(doubles): land the wave-1 in-memory seams + unified ed25519 fixtures The `w1-test-doubles` task: the in-memory seams every later wave's contract tests run against, behind their production seams. - tests/common/mod.rs — the doubles, test-only (nothing reachable from lib.rs, no feature): MemIdentityProvider (registered fingerprints -> alkcall Identity resolutions over the IdentityProvider trait; token path resolves none per ADR-004), TestVault (a wrapper over alkvault 0.1's shipped in-memory construction — resolving the flagged vault-double question: wrap, not re-impl), MemHostKeyPolicy (exact (host, fingerprint) rules + explicit default verdict, fail-closed by default, inspectable decision log), and the fixture table. Module docs record the location/vault/fixture decisions and the row/stamp discipline (greppable Contract stamps). - tests/vectors/ — one unified fixture set: four ssh-keygen-minted ed25519 keypairs (committed .key + .pub + fingerprints.txt recorded from ssh-keygen -lf, OpenSSH_9.6p1). The previous inline PEM constants in src/key_source.rs were rejected by OpenSSH itself (russh-only decodable); all keys were re-minted and the overlapping vector set retired — one fixture set now serves the parity tests, the custody round-trip, and every later auth/mapping test (src-unit tests share it via include_str!). - tests/doubles.rs — the end-to-end rows: register -> resolve, seal -> source -> decode (+ locked/absent/tampered postures), host-key set in order, policy verdicts honored-and-logged. - tests/fingerprint_parity.rs and src/key_source.rs tests moved onto the shared fixture files; src changes are #cfg(test) only. Verification: cargo test (33 + 9 + 5 green; --all-features also green), cargo clippy --all-targets -- -D warnings clean, cargo fmt --check clean, taskgraph validate ok (12 tasks).	2026-10-28 07:09:17 +00:00
glm-5.3-flash	635e82b54b	feat(fingerprint): land the single fingerprint path + ssh-keygen parity vectors - src/fingerprint.rs: alkssh::fingerprint wraps the ssh-key re-export (HashAlg::Sha256) — the crate's only fingerprint computation and formatting site (ADR-004 decision 1's contract invariant) - tests/fingerprint_parity.rs: 4 committed ed25519 fixtures with ssh-keygen -lf-recorded fingerprints (OpenSSH 9.6p1, independent issuer); blobs cross-checked against the vectors manifest - verified: cargo test, clippy (default + all-features, -D warnings), fmt; taskgraph validate clean	2026-10-28 06:27:49 +00:00

Author

SHA1

Message

Date

glm-5.3-flash

214690b9c2

test(doubles): land the wave-1 in-memory seams + unified ed25519 fixtures

The `w1-test-doubles` task: the in-memory seams every later wave's
contract tests run against, behind their production seams.

- tests/common/mod.rs — the doubles, test-only (nothing reachable from
  lib.rs, no feature): MemIdentityProvider (registered fingerprints ->
  alkcall Identity resolutions over the IdentityProvider trait; token
  path resolves none per ADR-004), TestVault (a wrapper over alkvault
  0.1's shipped in-memory construction — resolving the flagged
  vault-double question: wrap, not re-impl), MemHostKeyPolicy
  (exact (host, fingerprint) rules + explicit default verdict,
  fail-closed by default, inspectable decision log), and the fixture
  table. Module docs record the location/vault/fixture decisions and
  the row/stamp discipline (greppable Contract stamps).
- tests/vectors/ — one unified fixture set: four ssh-keygen-minted
  ed25519 keypairs (committed .key + .pub + fingerprints.txt recorded
  from ssh-keygen -lf, OpenSSH_9.6p1). The previous inline PEM
  constants in src/key_source.rs were rejected by OpenSSH itself
  (russh-only decodable); all keys were re-minted and the overlapping
  vector set retired — one fixture set now serves the parity tests,
  the custody round-trip, and every later auth/mapping test
  (src-unit tests share it via include_str!).
- tests/doubles.rs — the end-to-end rows: register -> resolve,
  seal -> source -> decode (+ locked/absent/tampered postures),
  host-key set in order, policy verdicts honored-and-logged.
- tests/fingerprint_parity.rs and src/key_source.rs tests moved onto
  the shared fixture files; src changes are #cfg(test) only.

Verification: cargo test (33 + 9 + 5 green; --all-features also green),
cargo clippy --all-targets -- -D warnings clean, cargo fmt --check
clean, taskgraph validate ok (12 tasks).

2026-10-28 07:09:17 +00:00

glm-5.3-flash

635e82b54b

feat(fingerprint): land the single fingerprint path + ssh-keygen parity vectors

- src/fingerprint.rs: alkssh::fingerprint wraps the ssh-key re-export
  (HashAlg::Sha256) — the crate's only fingerprint computation and
  formatting site (ADR-004 decision 1's contract invariant)
- tests/fingerprint_parity.rs: 4 committed ed25519 fixtures with
  ssh-keygen -lf-recorded fingerprints (OpenSSH 9.6p1, independent
  issuer); blobs cross-checked against the vectors manifest
- verified: cargo test, clippy (default + all-features, -D warnings),
  fmt; taskgraph validate clean

2026-10-28 06:27:49 +00:00