hanna/fabrica

feat: SSH/GPG key ownership verification

4f981bc · hanna committed on 2026-07-25

Add key verification (migration 0010: keys.verified_at, back-filled for existing
keys). SSH keys verify automatically on the first successful SSH authentication
(the server sets verified_at in auth_publickey). GPG keys verify via a signed
challenge: the keys page shows a per-key challenge string to sign and a box to
paste the armored signature, checked with git::verify_challenge (reusing the
existing pgp/ssh-key verification). Keys show a verified/unverified badge.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +19 −0

crates/git/src/lib.rs +1 −1

crates/git/src/signature.rs +55 −0

crates/model/src/entity.rs +11 −0

crates/ssh/src/server.rs +3 −0

crates/store/src/keys.rs +22 −4

crates/web/src/lib.rs +1 −0

crates/web/src/pages.rs +100 −1

crates/web/src/tests.rs +7 −1

migrations/postgres/0010_key_verification.sql +5 −0

migrations/sqlite/0010_key_verification.sql +5 −0

   margin-top: 0.2rem;
   font-size: 0.85em;
+}
+.key-verify {
+  margin-top: 0.5rem;
+}
+.key-verify > summary {
+  cursor: pointer;
+  color: var(--fb-accent);
+  font-size: 0.9em;
+}
+.key-verify textarea {
+  font-family: var(--fb-font-mono);
+  font-size: 0.85em;
+}
+.key-challenge {
+  padding: 0.6rem 0.75rem;
+  background: var(--fb-bg-inset);
+  border-radius: var(--fb-radius);
+  overflow-x: auto;
+  white-space: pre-wrap;
+}
 .key-add {
   padding-top: 1rem;
   border-top: 1px solid var(--fb-border);

 pub use crate::attributes::{AttrValue, Attributes, AttributesCache, AttributesSet};
 pub use crate::pubkey::{ParsedKey, parse_public_key};
 pub use crate::repo::Repo;
-pub use crate::signature::{SignatureCache, SignatureState, SigningKey};
+pub use crate::signature::{SignatureCache, SignatureState, SigningKey, verify_challenge};
 pub use crate::types::{
     Blob, BranchInfo, CommitDetail, CommitSummary, DeltaStatus, DiffLine, DiffOpts, EntryKind,
     FileDiff, FileDiffs, Hunk, LineOrigin, Oid, Page, Person, RefKind, Resolved, TagInfo,

+    }
+}
+/// Verify that `armored_sig` is a valid signature over `payload` produced by the
+/// private key matching `public_key` (an `authorized_keys` line for SSH or an
+/// ASCII-armored block for GPG). Proves possession of the private key — used for
+/// key-ownership challenges. SSH signatures must use the `git` namespace.
+#[must_use]
+pub fn verify_challenge(
+    kind: KeyKind,
+    fingerprint: &str,
+    public_key: &str,
+    armored_sig: &str,
+    payload: &[u8],
+) -> bool {
+    let key = SigningKey {
+        user_id: String::new(),
+        key_id: String::new(),
+        kind,
+        fingerprint: fingerprint.to_string(),
+        public_key: public_key.to_string(),
+    };
+    let keys = std::slice::from_ref(&key);
+    let state = match kind {
+        KeyKind::Ssh => verify_ssh(armored_sig, payload, keys),
+        KeyKind::Gpg => verify_gpg(armored_sig, payload, keys),
+    };
+    matches!(state, SignatureState::Verified { .. })
+}
 /// Compare two SSH fingerprints. The `SHA256:<base64>` body is case-sensitive, so
 /// only surrounding whitespace is trimmed.
 fn ssh_fingerprint_matches(stored: &str, computed: &str) -> bool {
+    }
     #[test]
+    fn verify_challenge_accepts_a_valid_gpg_signature() {
+        // The pinned signature is over GPG_PAYLOAD, so verify_challenge accepts it.
+        assert!(verify_challenge(
+            KeyKind::Gpg,
+            GPG_FPR,
+            GPG_PUB,
+            GPG_SIG,
+            GPG_PAYLOAD
+        ));
+        // A different payload (as a real challenge would use) must be refused.
+        assert!(!verify_challenge(
+            KeyKind::Gpg,
+            GPG_FPR,
+            GPG_PUB,
+            GPG_SIG,
+            b"a different challenge"
+        ));
+        // Garbage signature is refused, not a panic.
+        assert!(!verify_challenge(
+            KeyKind::Gpg,
+            GPG_FPR,
+            GPG_PUB,
+            "not a signature",
+            GPG_PAYLOAD
+        ));
+    }
+    #[test]
     fn gpg_verified_unknown_and_invalid() {
         // Registered → Verified.
         match verify_gpg(GPG_SIG, GPG_PAYLOAD, &[gpg_key()]) {

     pub ordinal: i64,
     /// When the key was last used to authenticate, if ever.
     pub last_used_at: Option<Timestamp>,
+    /// When ownership of the key was verified, or `None` if unverified. SSH keys
+    /// verify on first successful SSH auth; GPG keys via a signed challenge.
+    pub verified_at: Option<Timestamp>,
     /// Creation time.
     pub created_at: Timestamp,
+}
+impl Key {
+    /// Whether ownership of the key has been verified.
+    #[must_use]
+    pub fn verified(&self) -> bool {
+        self.verified_at.is_some()
+    }
+}
 /// An API token record. The JWT itself is never stored; this row exists so a token
 /// can be listed and revoked (`revoked_at`), which the API checks on every request.
 #[derive(Debug, Clone, PartialEq, Eq)]

             return Ok(Auth::reject());
+        }
         let _ = self.shared.store.touch_key_used(&key.id).await;
+        // A successful public-key auth proves possession of the private key, so
+        // the key is now verified.
+        let _ = self.shared.store.set_key_verified(&key.id).await;
         self.identity = Some(Identity {
             user_id: user.id,
             username: user.username,

 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `keys` in a fixed order, shared by every `SELECT`.
-const KEY_COLUMNS: &str =
+const KEY_COLUMNS: &str = "id, user_id, kind, name, fingerprint, public_key, ordinal, \
-    "id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at";
+     last_used_at, verified_at, created_at";
 /// Fields needed to register a key. The fingerprint is computed by the caller
 /// (which parses and validates the key material); the store assigns the id and
             public_key: new.public_key,
             ordinal: next,
             last_used_at: None,
+            verified_at: None,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO keys \
-             (id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, created_at) \
+             (id, user_id, kind, name, fingerprint, public_key, ordinal, last_used_at, \
-             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
+              verified_at, created_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)";
         sqlx::query(sql)
             .bind(key.id.clone())
             .bind(key.user_id.clone())
             .bind(key.public_key.clone())
             .bind(key.ordinal)
             .bind(key.last_used_at)
+            .bind(key.verified_at)
             .bind(key.created_at)
             .execute(&self.pool)
             .await
         Ok(())
+    }
+    /// Mark a key's ownership verified (idempotent; sets `verified_at` once).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_key_verified(&self, key_id: &str) -> Result<(), StoreError> {
+        sqlx::query("UPDATE keys SET verified_at = $1 WHERE id = $2 AND verified_at IS NULL")
+            .bind(now_ms())
+            .bind(key_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
     /// Delete a key by id. Returns `true` if a row was removed.
     ///
     /// # Errors
         public_key: row.try_get("public_key")?,
         ordinal: row.try_get("ordinal")?,
         last_used_at: row.try_get("last_used_at")?,
+        verified_at: row.try_get("verified_at")?,
         created_at: row.try_get("created_at")?,
     })
+}

             get(pages::settings_keys).post(pages::key_add),
+        )
         .route("/settings/keys/delete", post(pages::key_delete))
+        .route("/settings/keys/verify", post(pages::key_verify))
         .route("/settings/avatar", post(avatar::upload))
         .route("/settings/theme", get(pages::set_theme))
         .route("/avatar/{username}", get(avatar::show))

     Redirect::to("/settings/keys").into_response()
+}
+/// The verify-key form: the key id and a pasted armored signature.
+#[derive(Debug, Deserialize)]
+pub struct KeyVerifyForm {
+    /// The key id.
+    #[serde(default)]
+    id: String,
+    /// The armored detached signature over the challenge.
+    #[serde(default)]
+    signature: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/keys/verify` — verify GPG key ownership from a signed
+/// challenge. (SSH keys verify automatically on authentication.)
+pub async fn key_verify(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<KeyVerifyForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let Ok(keys) = state.store.keys_by_user(&user.id).await else {
+        return AppError::internal("could not load keys").into_response();
+    };
+    let Some(key) = keys.into_iter().find(|k| k.id == form.id) else {
+        return AppError::NotFound.into_response();
+    };
+    if key.kind != model::KeyKind::Gpg {
+        return AppError::BadRequest("Only GPG keys are verified this way.".to_string())
+            .into_response();
+    }
+    let challenge = gpg_challenge(&key);
+    let ok = git::verify_challenge(
+        model::KeyKind::Gpg,
+        &key.fingerprint,
+        &key.public_key,
+        form.signature.trim(),
+        challenge.as_bytes(),
+    );
+    if !ok {
+        return AppError::BadRequest("That signature did not verify against this key.".to_string())
+            .into_response();
+    }
+    let _ = state.store.set_key_verified(&key.id).await;
+    Redirect::to("/settings/keys").into_response()
+}
 /// Render the settings page: avatar, profile, account credentials, and tokens.
 /// The settings page shell: a left tab nav and the active tab's content. Each tab
 /// is its own route, so navigation works without JavaScript.
                 } @else {
                     ul class="entry-list key-list" {
                         @for k in keys {
-                            li class="entry-row" {
+                            li class="entry-row key-entry" {
                                 div class="entry-row-body" {
                                     span class="entry-row-title" {
                                         span class="badge" { (k.kind.as_str()) }
                                         " " (k.name.as_deref().unwrap_or("(unnamed)"))
+                                        @if k.verified() {
+                                            " " span class="badge badge-verified" { "verified" }
+                                        } @else {
+                                            " " span class="badge badge-unverified" { "unverified" }
+                                        }
+                                    }
                                     div class="entry-row-meta muted mono" { (k.fingerprint) }
+                                    @if !k.verified() {
+                                        (key_verify_hint(k, csrf))
+                                    }
+                                }
                                 div class="entry-row-actions" {
                                     form method="post" action="/settings/keys/delete" {
+    }
+}
+/// The deterministic message a GPG key owner signs to prove possession.
+fn gpg_challenge(key: &model::Key) -> String {
+    format!(
+        "fabrica GPG key ownership verification\nfingerprint: {}\n",
+        key.fingerprint
+    )
+}
+/// The verify affordance for an unverified key: a note for SSH keys (which verify
+/// on use) and a sign-a-challenge form for GPG keys.
+fn key_verify_hint(key: &model::Key, csrf: &str) -> Markup {
+    match key.kind {
+        model::KeyKind::Ssh => html! {
+            p class="muted field-hint key-verify-note" {
+                "Verifies automatically the next time you authenticate over SSH."
+            }
+        },
+        model::KeyKind::Gpg => html! {
+            details class="key-verify" {
+                summary { "Verify ownership" }
+                p class="muted field-hint" {
+                    "Sign this exact text with your GPG key and paste the armored signature:"
+                }
+                pre class="key-challenge" { code { (gpg_challenge(key)) } }
+                p class="muted field-hint mono" {
+                    "gpg --local-user " (key.fingerprint) " --armor --detach-sign challenge.txt"
+                }
+                form method="post" action="/settings/keys/verify" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    input type="hidden" name="id" value=(key.id);
+                    textarea name="signature" rows="6" required
+                             placeholder="-----BEGIN PGP SIGNATURE-----" {}
+                    button class="btn" type="submit" { "Verify" }
+                }
+            }
+        },
+    }
+}
 /// The API tokens settings section.
 fn tokens_section(csrf: &str, tokens: &[model::ApiToken], new_token: Option<&str>) -> Markup {
     html! {

         .body(Body::empty())
         .unwrap();
     let res = app.clone().oneshot(req).await.unwrap();
-    assert!(body_string(res).await.contains("laptop"), "key label shown");
+    let listing = body_string(res).await;
+    assert!(listing.contains("laptop"), "key label shown");
+    assert!(listing.contains("unverified"), "new keys start unverified");
+    assert!(
+        listing.contains("authenticate over SSH"),
+        "SSH auto-verify hint shown"
+    );
     // Delete it.
     let req = Request::builder()

+-- Key ownership verification. SSH keys verify automatically on first successful
+-- SSH authentication; GPG keys verify by signing a challenge. Existing keys
+-- predate this and are trusted.
+ALTER TABLE keys ADD COLUMN verified_at BIGINT;
+UPDATE keys SET verified_at = created_at;