func provisionNewKey(botName string, keyPath string) error {
	log.Debug("Generating a new SSH key...")
	requester, err := kssh.NewRequester()
	if err != nil {
		return err
	}
	err = kssh.MakeDotSSH()
	if err != nil {
		return err
	}
	err = sshutils.GenerateNewSSHKey(keyPath, true, false)
	if err != nil {
		return fmt.Errorf("Failed to generate a new SSH key: %v", err)
	}
	pubKey, err := ioutil.ReadFile(shared.KeyPathToPubKey(keyPath))
	if err != nil {
		return fmt.Errorf("Failed to read the SSH key from the filesystem: %v", err)
	}
	randomUUID, err := uuid.NewRandom()
	if err != nil {
		return fmt.Errorf("Failed to generate a new UUID for the SignatureRequest: %v", err)
	}
	log.Debug("Requesting signature from the CA....")
	resp, err := requester.GetSignedKey(botName, shared.SignatureRequest{
		UUID:         randomUUID.String(),
		SSHPublicKey: string(pubKey),
	})
	if err != nil {
		return fmt.Errorf("Failed to get a signed key from the CA: %v", err)
	}
	log.Debug("Received signature from the CA!")
	err = ioutil.WriteFile(shared.KeyPathToCert(keyPath), []byte(resp.SignedKey), 0600)
	if err != nil {
		return fmt.Errorf("Failed to write new SSH key to disk: %v", err)
	}
	return nil
}
Provision a new signed SSH key :with the given config
package main
import (
	"fmt"
	"io/ioutil"
	"os"
	"os/exec"
	"time"
	"github.com/keybase/bot-sshca/src/keybaseca/sshutils"
	"github.com/google/uuid"
	"github.com/keybase/bot-sshca/src/kssh"
	"github.com/keybase/bot-sshca/src/shared"
	log "github.com/sirupsen/logrus"
	"golang.org/x/crypto/ssh"
)
func main() {
	kssh.InitLogging()
	botName, remainingArgs, action, err := handleArgs(os.Args[1:])
	if err != nil {
		fmt.Printf("Failed to parse arguments: %v\n", err)
		os.Exit(1)
	}
	keyPath, err := getSignedKeyLocation(botName)
	if err != nil {
		fmt.Printf("Failed to retrieve location to store SSH keys: %v\n", err)
		os.Exit(1)
	}
	if isValidCert(keyPath) {
		log.WithField("keyPath", keyPath).Debug("Reusing unexpired certificate")
		doAction(action, keyPath, remainingArgs)
		os.Exit(0)
	}
	err = provisionNewKey(botName, keyPath)
	if err != nil {
		fmt.Printf("%v\n", err)
		os.Exit(1)
	}
	doAction(action, keyPath, remainingArgs)
}
func doAction(action Action, keyPath string, remainingArgs []string) {
	if action == SSH {
		runSSHWithKey(keyPath, remainingArgs)
	} else if action == Provision {
		provision(keyPath)
	}
}
func provision(keyPath string) {
	err := kssh.AddKeyToSSHAgent(keyPath)
	if err != nil {
		fmt.Printf("%v\n", err)
		os.Exit(1)
	}
	user, err := kssh.GetDefaultSSHUser()
	if err != nil {
		fmt.Printf("Failed to retrieve default SSH user: %v\n", err)
		os.Exit(1)
	}
	err = kssh.CreateDefaultUserConfigFile(keyPath)
	if err != nil {
		fmt.Printf("Failed to create the ssh config file for the default user: %v\n", err)
		os.Exit(1)
	}
	fmt.Printf("Provisioned new SSH key at %s\n", keyPath)
	if user != "" {
		fmt.Println("See docs/troubleshooting.md for information on configuring scp, rsync, etc to " +
			"use the configured kssh default user")
	}
}
func getSignedKeyLocation(botName string) (string, error) {
	signedKeyLocation := shared.ExpandPathWithTilde("~/.ssh/keybase-signed-key--")
	if botName != "" {
		return signedKeyLocation + botName, nil
	}
	defaultBot, _, err := kssh.GetDefaultBotAndTeam()
	if err != nil {
		return "", err
	}
	return signedKeyLocation + defaultBot, nil
}
var cliArguments = []kssh.CLIArgument{
	{Name: "--set-default-bot", HasArgument: true},
	{Name: "--clear-default-bot", HasArgument: false},
	{Name: "--bot", HasArgument: true},
	{Name: "--provision", HasArgument: false},
	{Name: "--set-default-user", HasArgument: true},
	{Name: "--clear-default-user", HasArgument: false},
	{Name: "--help", HasArgument: false},
	{Name: "-v", HasArgument: false, Preserve: true},
	{Name: "--set-keybase-binary", HasArgument: true},
}
var VersionNumber = "master"
func generateHelpPage() string {
	return fmt.Sprintf(`NAME:
   kssh - A replacement ssh binary using Keybase SSH CA to provision SSH keys
USAGE:
   kssh [kssh options] [ssh arguments...]
VERSION:
   %s
GLOBAL OPTIONS:
   --help                Show help
   -v                    Enable kssh and ssh debug logs
   --provision           Provision a new SSH key and add it to the ssh-agent. Useful if you need to run another 
                         program that uses SSH auth (eg scp, rsync, etc)
   --set-default-bot     Set the default bot to be used for kssh. Not necessary if you are only in one team that
                         is using Keybase SSH CA
   --clear-default-bot   Clear the default bot
   --bot                 Specify a specific bot to be used for kssh. Not necessary if you are only in one team that
                         is using Keybase SSH CA
   --set-default-user    Set the default SSH user to be used for kssh. Useful if you use ssh configs that do not set 
					     a default SSH user 
   --clear-default-user  Clear the default SSH user
   --set-keybase-binary  Run kssh with a specific keybase binary rather than resolving via $PATH `, VersionNumber)
}
type Action int
const (
	Provision Action = iota
	SSH
)
func handleArgs(args []string) (string, []string, Action, error) {
	remaining, found, err := kssh.ParseArgs(args, cliArguments)
	if err != nil {
		return "", nil, 0, fmt.Errorf("Failed to parse provided arguments: %v", err)
	}
	botName := ""
	action := SSH
	for _, arg := range found {
		if arg.Argument.Name == "--bot" {
			botName = arg.Value
		}
		if arg.Argument.Name == "--set-default-user" {
			err := kssh.SetDefaultSSHUser(arg.Value)
			if err != nil {
				fmt.Printf("Failed to set the default ssh user: %v\n", err)
				os.Exit(1)
			}
			fmt.Println("Set default ssh user, exiting...")
			os.Exit(0)
		}
		if arg.Argument.Name == "--clear-default-user" {
			err := kssh.SetDefaultSSHUser("")
			if err != nil {
				fmt.Printf("Failed to clear the default ssh user: %v\n", err)
				os.Exit(1)
			}
			fmt.Println("Cleared default ssh user, exiting...")
			os.Exit(0)
		}
		if arg.Argument.Name == "--set-default-bot" {
			err := kssh.SetDefaultBot(arg.Value)
			if err != nil {
				fmt.Printf("Failed to set the default bot: %v\n", err)
				os.Exit(1)
			}
			fmt.Println("Set default bot, exiting...")
			os.Exit(0)
		}
		if arg.Argument.Name == "--clear-default-bot" {
			err := kssh.ClearDefaultBot()
			if err != nil {
				fmt.Printf("Failed to clear the default bot: %v\n", err)
				os.Exit(1)
			}
			fmt.Println("Cleared default bot, exiting...")
			os.Exit(0)
		}
		if arg.Argument.Name == "--set-keybase-binary" {
			err := kssh.SetKeybaseBinaryPath(arg.Value)
			if err != nil {
				fmt.Printf("Failed to set the keybase binary: %v\n", err)
				os.Exit(1)
			}
			fmt.Println("Set keybase binary, exiting...")
			os.Exit(0)
		}
		if arg.Argument.Name == "--provision" {
			action = Provision
		}
		if arg.Argument.Name == "--help" {
			fmt.Println(generateHelpPage())
			os.Exit(0)
		}
		if arg.Argument.Name == "-v" {
			log.SetLevel(log.DebugLevel)
		}
	}
	return botName, remaining, action, nil
}
func isValidCert(keyPath string) bool {
	_, err1 := os.Stat(keyPath)
	_, err2 := os.Stat(shared.KeyPathToPubKey(keyPath))
	_, err3 := os.Stat(shared.KeyPathToCert(keyPath))
	if os.IsNotExist(err1) || os.IsNotExist(err2) || os.IsNotExist(err3) {
		return false  
	}
	certBytes, err := ioutil.ReadFile(shared.KeyPathToCert(keyPath))
	if err != nil {
		return false
	}
	k, _, _, _, err := ssh.ParseAuthorizedKey(certBytes)
	if err != nil {
		return false
	}
	cert := k.(*ssh.Certificate)
	validBefore := time.Unix(int64(cert.ValidBefore), 0)
	validAfter := time.Unix(int64(cert.ValidAfter), 0)
	return time.Now().After(validAfter) && time.Now().Before(validBefore)
}