Conversation

fetching ssh keys from git forges while using TLS CA's as the root of trust

github: easy. 1 liner. curl https://api.github.com/meta | jq --raw-output '"github.com "+.ssh_keys[]'. you're trusting CA's, and that api.github.com is allowed to say what github.com's ssh keys are.

gitlab: ... harder, you need to parse the HTML of https://gitlab.com/help/instance_configuration... but they're there. (this seems to apply to every gitlab instance, which is nice).

forgejo: uhhhh??? ask an admin? specific instances have it documented like https://codeberg.org/Codeberg/org/src/branch/main/Imprint.md#ssh-fingerprints but outside of that, good luck.

of course, "do what CA's themselves do and ssh-keyscan from a few random vantage points and if they all match, that's Presumably Correct" works too.

1
0
0

@5225225 the ideal would be sshfp records on a dnssec enabled site

0
0
0