SourceHut user authorized keys

README.md

@@ -114,6 +114,12 @@ This is compatible with `--authorized-keys`.
 $ upterm host --gitlab-user username
 ```
 
+Host a terminal session that only allows specified SourceHut user client public key(s) to connect.
+This is compatible with `--authorized-keys`.
+```console
+$ upterm host --srht-user username
+```
+
 Host a session with a custom command
 ```console
 $ upterm host -- docker run --rm -ti ubuntu bash

cmd/upterm/command/host.go

@@ -29,6 +29,7 @@ var (
 	flagAuthorizedKeys     string
 	flagGitHubUsers        []string
 	flagGitLabUsers        []string
+	flagSourceHutUser      []string
 	flagReadOnly           bool
 )
 
@@ -70,6 +71,7 @@ func hostCmd() *cobra.Command {
 	cmd.PersistentFlags().StringVarP(&flagAuthorizedKeys, "authorized-key", "a", "", "an authorized_keys file that lists public keys that are permitted to connect.")
 	cmd.PersistentFlags().StringSliceVar(&flagGitHubUsers, "github-user", nil, "this GitHub user public keys are permitted to connect.")
 	cmd.PersistentFlags().StringSliceVar(&flagGitLabUsers, "gitlab-user", nil, "this GitLab user public keys are permitted to connect.")
+	cmd.PersistentFlags().StringSliceVar(&flagSourceHutUsers, "srht-user", nil, "this SourceHut user public keys are permitted to connect.")
 	cmd.PersistentFlags().BoolVarP(&flagReadOnly, "read-only", "r", false, "host a read-only session. Clients won't be able to interact.")
 
 	return cmd
@@ -155,6 +157,13 @@ func shareRunE(c *cobra.Command, args []string) error {
 		}
 		authorizedKeys = append(authorizedKeys, gitLabUserKeys...)
 	}
+	if flagSourceHutUsers != nil {
+		sourceHutUserKeys, err := host.SourceHutUserKeys(flagSourceHutUsers)
+		if err != nil {
+			return fmt.Errorf("error reading SourceHut user keys: %w", err)
+		}
+		authorizedKeys = append(authorizedKeys, sourceHutUserKeys...)
+	}
 
 	signers, cleanup, err := host.Signers(flagPrivateKeys)
 	if err != nil {

docs/upterm_host.md

@@ -39,6 +39,7 @@ upterm host [flags]
   -f, --force-command string    force execution of a command and attach its input/output to client's.
       --github-user strings     this GitHub user public keys are permitted to connect.
       --gitlab-user strings     this GitLab user public keys are permitted to connect.
+      --srht-user strings       this SourceHut user public keys are permitted to connect.
   -h, --help                    help for host
       --known-hosts string      a file contains the known keys for remote hosts (required). (default "/Users/owen/.ssh/known_hosts")
   -i, --private-key strings     private key file for public key authentication against the upterm server (default [/Users/owen/.ssh/id_ed25519])

etc/completion/upterm.bash_completion.sh

@@ -405,6 +405,8 @@ _upterm_host()
     two_word_flags+=("--github-user")
     flags+=("--gitlab-user=")
     two_word_flags+=("--gitlab-user")
+    flags+=("--srht-user=")
+    two_word_flags+=("--srht-user")
     flags+=("--help")
     flags+=("-h")
     local_nonpersistent_flags+=("--help")

etc/man/man1/upterm-host.1

@@ -33,6 +33,10 @@ Host a terminal session over a reverse SSH tunnel to the Upterm server with the
 \fB--gitlab-user\fP=[]
 	this GitLab user public keys are permitted to connect.
 
+.PP
+\fB--srht-user\fP=[]
+	this SourceHut user public keys are permitted to connect.
+
 .PP
 \fB-h\fP, \fB--help\fP[=false]
 	help for host

host/signer.go

@@ -23,6 +23,7 @@ const (
 	errCannotDecodeEncryptedPrivateKeys = "cannot decode encrypted private keys"
 	gitHubKeysUrlFmt                    = "https://github.com/%s"
 	gitLabKeysUrlFmt                    = "https://gitlab.com/%s"
+	sourceHutKeysUrlFmt                 = "https://meta.sr.ht/~%s"
 )
 
 type errDescryptingPrivateKey struct {
@@ -96,6 +97,10 @@ func GitLabUserKeys(usernames []string) ([]ssh.PublicKey, error) {
 	return getPublicKeys(gitLabKeysUrlFmt, usernames)
 }
 
+func SourceHutUserKeys(usernames []string) ([]ssh.PublicKey, error) {
+	return getPublicKeys(sourceHutKeysUrlFmt, usernames)
+}
+
 // Signers return signers based on the folllowing conditions:
 // If SSH agent is running and has keys, it returns signers from SSH agent, otherwise return signers from private keys;
 // If neither works, it generates a signer on the fly.