github.com/openpubkey/opkssh

A Note on Compatibility for GQ signatures

Includes security fix to GitLab-CI GQ commitment PK Tokens by updating to OpenPubkey v0.25.0. As OPKSSH does not currently support GitLab-CI, and only currently supports GitLab user OP, there should be no security impact to OPKSSH.

However this does introduce a breaking change to how GQ signatures are verified. If GitHub is being used with GQ signatures then signatures created prior to this release will not verify on OPKSSH after this change and signatures created after this release will not verify against on OPKSSH before this change.

See openpubkey/openpubkey#379

Changes

• Update to OpenPubkey v0.25.0 @EthanHeilman (#569)
• fix(deps): Update Docker @renovate[bot] (#566)
• fix(deps): Update go toolchain directive to v1.26.5 @renovate[bot] (#567)
• fix(deps): Update actions/cache action to v6.1.0 @renovate[bot] (#556)
• feat(enforcer): add glob support to github-actions @gastmaier (#558)
• chore(deps): bump github.com/go-chi/chi/v5 from 5.2.2 to 5.2.4 @dependabot[bot] (#540)
• Imports slices rather exp/slices @EthanHeilman (#565)
• feat: produce Android binaries on CI @bltavares (#550)
• fix(deps): Update Docker @renovate[bot] (#555)
• fix(deps): Update docker/build-push-action action to v7.3.0 @renovate[bot] (#560)
• fix(deps): Update goreleaser/goreleaser-action action to v7.2.3 @renovate[bot] (#557)
• fix(deps): Update release-drafter/release-drafter action to v7.5.1 @renovate[bot] (#554)
• fix(deps): Update release-drafter/release-drafter action to v7 @renovate[bot] (#551)
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.4 @dependabot[bot] (#539)

🐛 Bug Fixes

• Fix release drafter @EthanHeilman (#561)
• fix(deps): Update actions/cache action to v6 @renovate[bot] (#543)
• fix(deps): Update actions/checkout action to v7 @renovate[bot] (#545)
• fix(deps): Update actions/setup-go action to v6.5.0 @renovate[bot] (#553)
• fix(deps): Update dependency golangci/golangci-lint to v2.12.2 @renovate[bot] (#552)
• fix(deps): Update Docker @renovate[bot] (#549)
• fix(deps): Update actions/setup-go action to v6.4.0 @renovate[bot] (#541)
• fix(deps): Update dependency golangci/golangci-lint to v2.11.4 @renovate[bot] (#489)
• fix(deps): Update zizmorcore/zizmor-action action to v0.5.7 @renovate[bot] (#535)
• fix(deps): Update Docker @renovate[bot] (#469)

🧰 Maintenance

• fix(deps): Update Docker @renovate[bot] (#469)

🚀 Features

• Adds ssh certificate principals arg @EthanHeilman (#533)

🐛 Bug Fixes

• fix(deps): Update docker/build-push-action action to v7.2.0 @renovate[bot] (#515)
• Fix: Ensure openssh can be installed on windows arm @EthanHeilman (#548, #547, #544)
• fix(deps): Update goreleaser/goreleaser-action action to v7.2.2 @renovate[bot] (#542)
• fix(deps): Update actions/setup-go action to v6.3.0 @renovate[bot] (#483)

🧰 Maintenance

• fix(deps): bump go to v1.25, crypto to v0.53.0 @gastmaier (#528)
• Update CLI documentation @github-actions[bot] (#534)
• Update go version in hack/build.sh @Kunzol (#531)

Adds support for sshing into windows servers.
Openssh 10.13 makes a breaking, non-backwards compatible change to how ssh certificates work, this breaks opkssh older than this release. This release creates a fix for this breaking change.

Changes

• feat: update to openpubkey 0.23.0 @ianroberts (#510)
• fix(ci): use go run . instead of go run main.go in gha workflow @fdcastel (#506)
• [3/3] Add Windows SSH server support @fdcastel (#480)
• refactor: unify MockUserLookup into shared test helper package. Closes #439. @fdcastel (#495)
• Update CLI documentation @github-actions[bot] (#500)
• feat: add --inspect-cert and --verbose flags to login command. Closes #353. @fdcastel (#497)
• docs: Add GitHub Actions integration guide. Closes #481 @fdcastel (#492)
• test: cover full printed output of opkssh inspect. Closes #356 @fdcastel (#493)
• Update CLI documentation @github-actions[bot] (#498)
• Add logout command to remove opkssh-generated SSH keys. Closes #317. @fdcastel (#496)
• Update CLI documentation @github-actions[bot] (#490)
• [2/3] Add permissions command @fdcastel (#479)
• bug: ensure provider arg doesn't skip remote-redirect-uri @EthanHeilman (#471)
• [1/3] Update GitHub Actions workflows and .gitignore @fdcastel (#478)
• docs: Add AWS EC2 setup guide for opkssh @Rishang (#467)

🐛 Bug Fixes

• fix(deps): Update docker/build-push-action action to v7 @renovate[bot] (#512)
• Fix for openssh 10.13 breaking principals wildcard in SSH certificates @EthanHeilman (#513)
• fix(deps): Update zizmorcore/zizmor-action action to v0.5.2 @renovate[bot] (#488)
• fix(deps): Update dependency golangci/golangci-lint to v2.11.2 @renovate[bot] (#486)
• fix(deps): Update goreleaser/goreleaser-action action to v7 @renovate[bot] (#484)
• fix(deps): Update goreleaser/goreleaser-action action to v7 @renovate[bot] (#477)
• fix(deps): Update actions/setup-go action to v6.3.0 @renovate[bot] (#482)
• fix(deps): Update zizmorcore/zizmor-action action to v0.5.0 @renovate[bot] (#451)
• fix(deps): Update Docker @renovate[bot] (#464)

🧰 Maintenance

• Improve install script to make linter happy, fix typo @EthanHeilman (#514)

Main feature of this release is the ability to specify remote redirect URIs. This helps with integrating opkssh with other tools such as termix. Most users of opkssh should not be using this flag and can skip this update.

🚀 Features

• Remote Redirect URIs Support (termix) @EthanHeilman (#456)

Main feature of this release is the audit command, which allows you to check server side configurations. Read the docs here: https://github.com/openpubkey/opkssh/blob/main/docs/audit.md

Changes

• docs: warn that azure alias URI hardcodes the tenant ID @TheToddLuci0 (#446)
• docs: Add Keycloak docs @sylvain-vq (#442)

🚀 Features

• feat: Audit command @Basti-Fantasti (#396)

🐛 Bug Fixes

• Update hack.sh to use user ids as user ids, not group ids as user ids @TheToddLuci0 (#447)
• Fix openssh version detection bug @EthanHeilman (#444)
• fix(deps): Update Docker @renovate[bot] (#450)
• fix(deps): Update actions/setup-go action to v6.2.0 @renovate[bot] (#449)

🚀 Features

• Add support for custom group claims @mvanderlee (#133)
• feat: Flag to print SSH cert and private key rather than FS @EthanHeilman (#437)
• feat: Process extra arguments to the verify command @justincmoy (#436)
• Add warning message when email claim is missing from ID token @copilot-swe-agent[bot] (#374)
• [feat] Add new "inspect" subcommand @stmcginnis (#349)
• Add CLI reference documentation @stmcginnis (#365)
• Include signature JSON in inspect output @stmcginnis (#358)
• • docs: Add Amazon Cognito as tested provider @Foorack (#414)
• docs: Add documentation for opkssh and sssd integration @vigneshmanick (#409)
• Added SELinux support for sudo logging @descensus (#376)
• Update CLI documentation @github-actions[bot] (#368)

🐛 Bug Fixes

• Fix race condition in ReadHome @gcorrall (#391)
• [fix] Use lowercase for positional argument placeholders @t38miwa (#361)
• fix typo in commands/verify.go @DevRockstarZ (#336)
• Doc: fix small errors in policy plugin doc @PotatoesMaster (#344)
• Correct macOS name @stmcginnis (#341)

🧰 Maintenance

• chore: document upstream nix usage & remove nix flake @datosh (#383)
• Update CLI documentation @github-actions[bot] (#438)
• Stop hash pinning docker images @EthanHeilman (#421)
• [fix] Fix ssh version integration test @EthanHeilman (#362)
• Fix integration tests failing due to pacman keys @EthanHeilman (#432)
• fix(deps): Update docker/setup-buildx-action action to v3.12.0 @renovate[bot] (#426)
• fix(deps): Update zizmorcore/zizmor-action action to v0.3.0 @renovate[bot] (#413)
• fix(deps): Update peter-evans/create-pull-request action to v8 @renovate[bot] (#418)
• fix(deps): Update zizmorcore/zizmor-action action to v0.2.0 @renovate[bot] (#335)
• fix(deps): Update peter-evans/create-pull-request action to v7.0.9 @renovate[bot] (#407)

Changes

• Merge SELinux Type Enforcement Files. @SweBarre (#332)
• Feature/provider command @aaron-riact (#307)
• Fixes typo in linux install script and docs (regression) @SweBarre (#320)

🐛 Bug Fixes

• fix(deps): Update Docker @renovate[bot] (#330)
• fix(deps): Update actions/setup-go action to v6 @renovate[bot] (#329)
• fix(deps): Update Docker @renovate[bot] (#322)
• fix: Fixes build since /var/run/sshd already created @EthanHeilman (#325)
• fix: Fixes URL in get_te_download_path @SweBarre (#324)
• fix(deps): Update actions/checkout action to v5 @renovate[bot] (#306)
• fix(deps): Update zizmorcore/zizmor-action action to v0.1.2 @renovate[bot] (#308)
• fix(deps): Update Docker @renovate[bot] (#321)

🧰 Maintenance

• fix(deps): Update Docker @renovate[bot] (#330)
• fix(deps): Update Docker @renovate[bot] (#322)

Changes

• Improve docs command package @gppmad (#303)
• docs: Better description of policy being additive @EthanHeilman (#288)
• Add description for OPKSSH command-line tool @gppmad (#284)

🚀 Features

• Create user deny list @EthanHeilman (#316)
• Add --key-type/-t flag to the login command to control what type of SSH key is generated @Hidoni (#300)
• Separate Type Enforcement files from install script @SweBarre (#276)
• Wildcard support for all users at a given domain @aaron-riact (#291)

🐛 Bug Fixes

• Use smaller constants for 32-bit archs (#314) @jas4711 (#315)
• fixes a typo in the install linux documentation @kayiwa (#304)

🧰 Maintenance

• fix(deps): Update goreleaser/goreleaser-action action to v6.4.0 @renovate[bot] (#312)
• fix(deps): Update Docker @renovate[bot] (#302)
• fix(deps): Update actions/checkout action to v4.3.0 @renovate[bot] (#305)
• fix(deps): Update Docker @renovate[bot] (#301)
• fix(deps): Update Docker @renovate[bot] (#299)
• fix(deps): Update Docker @renovate[bot] (#298)
• fix(deps): Update Docker @renovate[bot] (#297)
• fix(deps): Update Docker @renovate[bot] (#296)
• fix(deps): Update Docker @renovate[bot] (#294)
• fix(deps): Update Docker @renovate[bot] (#290)
• fix(deps): Update Docker @renovate[bot] (#287)
• fix(deps): Update Docker @renovate[bot] (#285)
• fix(deps): Update Docker @renovate[bot] (#283)
• fix(deps): Update quay.io/archlinux/archlinux:latest Docker digest to 3bd6dfb @renovate[bot] (#282)
• fix(deps): Update Docker @renovate[bot] (#279)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to ebf7f5c @renovate[bot] (#277)
• fix(deps): Update golang.org/x/exp digest to 542afb5 @renovate[bot] (#274)
• fix(deps): Update Docker @renovate[bot] (#275)
• Bump github.com/docker/docker from 28.2.2+incompatible to 28.3.3+incompatible @dependabot[bot] (#295)
• fix(deps): Update Docker @renovate[bot] (#302)
• fix(deps): Update Docker @renovate[bot] (#301)
• fix(deps): Update Docker @renovate[bot] (#298)
• fix(deps): Update Docker @renovate[bot] (#297)
• fix(deps): Update Docker @renovate[bot] (#296)
• fix(deps): Update Docker @renovate[bot] (#294)
• fix(deps): Update Docker @renovate[bot] (#290)
• fix(deps): Update Docker @renovate[bot] (#287)
• fix(deps): Update Docker @renovate[bot] (#283)
• fix(deps): Update quay.io/archlinux/archlinux:latest Docker digest to 3bd6dfb @renovate[bot] (#282)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to ebf7f5c @renovate[bot] (#277)
• fix(deps): Update Docker @renovate[bot] (#275)

Changes

• Add azure config doc @EthanHeilman (#243)
• Add test for piping install script to bash @SweBarre (#241)
• Unittests for the install script @SweBarre (#204)

🚀 Features

• Feat: Add 12h expiration policy @bmodotdev (#235)
• Write the certificate where OpenSSH will find it @syskill (#224)
• Improve checkOpenSSHVersion function @gppmad (#238)
• Move opkssh key files to a separate location @net42-jkeil (#122)

🐛 Bug Fixes

• Fix: silence error when plugin policy dir missing @bmodotdev (#236)
• Fixes some spelling errors @SweBarre (#228)
• Fix issue in go upgrades @datosh (#221)
• Docs: fix formatting of Azure docs @boosterl (#269)
• Add troubleshooting note for azure for prompt: none @EthanHeilman (#254)

🧰 Maintenance

• ci: add zizmor action so that action security will be tracked @datosh (#246)
• ci: configure dependabot for go and github action updates, fixes #207 @shyim (#217)
• ci: fix zizmor findings @datosh (#247)
• Migrate from dependabot to renovate @datosh (#255)
• Migrate golangcilint @datosh (#233)
• Update linter to v2.0.2 @EthanHeilman (#230)
• fix(deps): Update quay.io/archlinux/archlinux:latest Docker digest to 00ce22d @renovate[bot] (#273)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to c0a0dad @renovate[bot] (#271)
• fix(deps): Update module github.com/testcontainers/testcontainers-go to v0.38.0 @renovate[bot] (#266)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to 315d1af @renovate[bot] (#267)
• fix(deps): Update Docker @renovate[bot] (#262)
• fix(deps): Update quay.io/archlinux/archlinux:latest Docker digest to 00ce22d @renovate[bot] (#273)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to c0a0dad @renovate[bot] (#271)
• fix(deps): Update module github.com/zitadel/oidc/v3 to v3.41.0 @renovate[bot] (#270)
• fix(deps): Update Docker @renovate[bot] (#268)
• fix(deps): Update module github.com/testcontainers/testcontainers-go to v0.38.0 @renovate[bot] (#266)
• fix(deps): Update opensuse/tumbleweed:latest Docker digest to 315d1af @renovate[bot] (#267)
• fix(deps): Update DeterminateSystems/update-flake-lock action to v27 @renovate[bot] (#265)
• fix(deps): Update DeterminateSystems/nix-installer-action action to v19 @renovate[bot] (#264)
• fix(deps): Update DeterminateSystems/flake-checker-action action to v12 @renovate[bot] (#263)
• fix(deps): Update Docker @renovate[bot] (#262)
• fix(deps): Update Go @renovate[bot] (#257)
• fix(deps): Update golangci/golangci-lint-action action to v8 @renovate[bot] (#260)
• fix(deps): Update Docker @renovate[bot] (#259)
• fix(deps): Update Docker @renovate[bot] (#256)
• Fix auth_id uniqueness bug @EthanHeilman (#251)
• fix(deps): bump github.com/zitadel/oidc/v3 from 3.39.0 to 3.39.1 in the all group @dependabot[bot] (#248)
• fix(deps): bump the all group with 3 updates @dependabot[bot] (#249)
• fix(deps): bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 @dependabot[bot] (#244)
• fix(deps): bump ncruces/go-coverage-report from 0.3.0 to 0.3.1 in the all group @dependabot[bot] (#239)
• Fix bug in install script @EthanHeilman (#237)
• fix(deps): bump the all group with 2 updates @dependabot[bot] (#223)
• fix(deps): bump docker/setup-buildx-action from 3.10.0 to 3.11.1 in the all group @dependabot[bot] (#232)
• fix(deps): bump the all group across 1 directory with 4 updates @dependabot[bot] (#222)

Changes

• fix: only make GitHub provider available in GitHub environments @datosh (#210)
• Harden gh actions @datosh (#198)
• Cleans up TODOs on unneeded logging statement @EthanHeilman (#195)
• Adds Chocolatey install to Readme (#82). @fdcastel (#194)
• Define a Nix overlay and module @javbit (#186)
• Find opkssh binary path dynamically @k0da (#177)
• Add more Nix CI checks & documentation @javbit (#180)
• Documents how to use PuTTY with opkssh @EthanHeilman (#179)
• Add Nix Flake to build opkssh @javbit (#178)
• Document configuration for Gitlab selfhosted @matijse (#175)

🚀 Features

• Userinfo claims support via an Access token in the ssh cert @EthanHeilman (#183)
• GHA based login @datosh (#187)
• Honor the INSTALL_DIR Variable and openSUSE/SLES support @SweBarre (#197)
• Creates server config.yml to set env variables @EthanHeilman (#189)
• Creates policy plugin system (env vars) @EthanHeilman (#181)

🐛 Bug Fixes

• fix: read send_access_token when parsing config @datosh (#215)
• Fix broken link in readme @EthanHeilman (#205)
• Fixes missing backticks on code block @SweBarre (#203)
• Add hello provider @gdm257 (#202)
• Fix typo in README @EthanHeilman (#190)

🧰 Maintenance

• Fix broken link in readme @EthanHeilman (#205)
• Cleans up more info in the README @EthanHeilman (#196)
• Moves off of bastionzero oidc fork @EthanHeilman (#193)
• Sets permissions for directories we create on install @EthanHeilman (#192)
• Fix typo in README @EthanHeilman (#190)
• docs: Clarify point in policy plugin docs @EthanHeilman (#185)