nordisk/edda

nornir-git · sshkey — design

The ONE canonical ed25519 OpenSSH deploy-key mint (LAW #5, DRY). nornir's generate_keypair and dwarves' service::generate_deploy_keypair were byte-for-byte twins of the same ssh-key + rand_core recipe; this lifts that single implementation into the shared nornir-git leaf — next to [nornir_git::ssh], the transport that authenticates git-over-SSH with exactly this id_ed25519. Pure-Rust, zero-shell (LAW #9): no ssh-keygen subprocess, ever.

f0 — the whole

  service install ──► ensure_deploy_key(home, uid, gid) ──► <home>/.ssh/id_ed25519 (0600)
  (nornir/dwarves)         │  comment = <home-basename>@<host>   id_ed25519.pub  (0644)
                           ▼                                      dir             (0700)
                 generate_ed25519_openssh(dir, comment)   ──► chown → uid:gid
                 OsRng → ssh_key::PrivateKey::random           returns DeployKey { pubkey }
                 → .to_openssh(LF)  (in-process)          ──► pubkey pasted as repo deploy key
                                                              nornir_git::ssh auths with the key

Two functions, one recipe. The primitive mints a keypair into any directory; the service helper wraps it with home-dir convention + chown and hands back the public half to register.

f1 — the API (the whole surface)

• generate_ed25519_openssh(dir, comment) -> Result<bool> — the primitive. Mints <dir>/id_ed25519 (0600) + id_ed25519.pub (0644), creating dir at 0700, with the given OpenSSH comment. Idempotent: an existing private key is preserved and it returns Ok(false); a fresh mint returns Ok(true).
• ensure_deploy_key(home, user_uid, gid) -> Result<DeployKey> — the service-install helper. Mints <home>/.ssh/id_ed25519, chowns the .ssh dir + key files to user_uid:gid, and returns the [DeployKey] (public-key line + paths + created). The comment is derived from home's basename, so /home/nornir → nornir@<host> and /home/dwarves → dwarves@<host> — the exact comments the former per-service twins wrote.
• DeployKey { pubkey, private_path, public_path, created } — the on-disk result; pubkey is the ssh-ed25519 AAAA… <user>@<host> line to paste.

f2 — the chosen design (only the chosen one; alternatives → reasoning)

• In-process ssh-key + rand_core, never ssh-keygen. The private key is ssh_key::PrivateKey::random(&mut rand_core::OsRng, Ed25519) serialised with .to_openssh(LineEnding::LF); the public half is .public_key().to_openssh(). This is the identical recipe both twins ran — a faithful hoist, no behaviour change. ssh-key is declared explicitly (russh already pulls it) so sshkey uses it directly rather than reaching through russh::keys.
• Home lives in nornir-git, not a new crate. The deploy key IS the git SSH identity: [nornir_git::ssh] connects git-upload-pack with it and [nornir_git::gitio] resolves its path. Both twin-owners (nornir + dwarves via its git-source feature) already depend on nornir-git, so a sshkey module here is zero new dependency edges — a leaf-within-the-right-leaf, not a fork.
• Idempotent-by-default. A live deploy identity is never silently overwritten; a second call is a no-op that still returns the same pubkey. If a private key exists but its .pub was lost, ensure_deploy_key reconstructs the public half from the private key rather than failing.
• ensure_deploy_key(home, uid, gid) signature. The user identity for the comment is derived from the home basename (not a separate arg), keeping the call site to just the three things an installer already has: the home path and the freshly-ensured service user's (uid, gid).

f3 — acceptance (tests, all RED-when-broken)

• Valid ed25519 OpenSSH: the minted private key re-parses via ssh_key::PrivateKey::from_openssh and its .algorithm() is Ed25519; the public line re-parses and matches the private key's public bytes.
• 0600 / 0700 / 0644: private key is owner-only 0600 (a deploy key that is world-readable is a leak), .ssh dir is 0700, public is 0644.
• Deterministic shape: the public line always starts ssh-ed25519 and carries the derived <user>@<host> comment.
• Idempotent: a second mint preserves the key byte-for-byte and reports created=false; ensure_deploy_key returns the same pubkey.
• functional_status rows (feature testmatrix, release strips them): ensure_deploy_key_mints, deploy_key_is_valid_ed25519, deploy_key_idempotent — driven by the real mint in a wiring test that drains the process-global buffer and asserts the rows landed.

f4 — reuse map

f5 — deferred (follow-up, other agents)

• Repoint the twins (logged in workspace_nordisk/edda_agents_problems.md): nornir's generate_keypair (src/bin/nornir.rs) and dwarves' generate_deploy_keypair / ensure_dwarves_deploy_key (service.rs) should become thin wrappers over nornir_git::sshkey, then their local ssh-key / rand_core deps drop. Left to their per-repo agents (this pass does not touch nornir or dwarves).
• Optional key rotation (mint-new + retire-old) is out of scope; today's contract is mint-once / preserve.