philips/shortbread — pull request #2 by joshi4 (2014-09-05 05:23:47+00:00)
Title: Current status of shortbread

## Summary

* The server running as the CA can issue new certificates
* git integration is done.
* server writes its certs to a local git repo, which is synced with the remote after every local write. (github.com/joshi4/shortbread-test)
* The client can poll the server and add new certs to the ssh-agent.
* The discovery-json api is fleshed out ( changes may occur depending on any server side changes to implement revoke)
* command line tool is fleshed out as well
* successfully tested it using 2 `ubuntu` instances on ec-2 to log into a `coreOS` instance.

#### Immediate Next Steps

* containerize the server, to get it running on kam.
* blogpost ?

#### Next Steps
* ability to revoke certs
* write unit tests
* synchronization across diff CA's

------
## Package level notes/questions

### cmd/shortbreadctl

* do we want to provide a --server flag which can be useful in one-off cases when we want to override the settings of the environment variable specifying the url of the server to connect to ? The flag does nothing for now
* Will change the `update` sub-command back to `useradd` before the next PR.
* **Improvement:** since the root shortbreadctl command is not runnable, but I've provided a set of persistent flags to it (for ease of reuse in the sub-commands) would be less confusing if I were to override the default help template and roll out my own.

### gitutil

* the libgit2 package provides the go bindings but they are too low-level. We want to provide an api that maps almost exactly to the interface provided by the git cli. I think it'll be a good standalone package to open source. So should I move it to a separate repo and submit a PR to coreos/gitutil ?

### server

* `url` and `path` hardcoded for now, will make them environment variables in the next PR.
* ignore `Revoke` for now
* in order to efficiently implement revoke might have to change the global map type to `map[fingerprint]map[nameOfPrivateKey]*ssh.Certificate`