Add support for creating and validating SSHSIG format signatures

This commit adds support for new top-level asyncssh.create_sshsig() and
asyncssh.validate_sshsig() functions and for an OpenSSH-compatible
"allowed signers" file.

Author: ronf

README.rst

@@ -78,9 +78,13 @@ Features
 
 * Support for accessing keys managed by PuTTY's Pageant agent on Windows
 * Support for accessing host keys via OpenSSH's ssh-keysign
+* Partial support for `OpenSSH-style configuration files`__
 * OpenSSH-style `known_hosts file`__ support
 * OpenSSH-style `authorized_keys file`__ support
-* Partial support for `OpenSSH-style configuration files`__
+* Support for `creating and validating SSHSIG signatures`__
+
+  * Including support for OpenSSH-style allowed signers files
+
 * Compatibility with OpenSSH "Encrypt then MAC" option for better security
 * Time and byte-count based session key renegotiation
 * Designed to be easy to extend to support new forms of key exchange,
@@ -92,16 +96,17 @@ __ http://asyncssh.readthedocs.io/en/stable/api.html#mac-algorithms
 __ http://asyncssh.readthedocs.io/en/stable/api.html#compression-algorithms
 __ http://asyncssh.readthedocs.io/en/stable/api.html#public-key-support
 __ http://asyncssh.readthedocs.io/en/stable/api.html#ssh-agent-support
+__ http://asyncssh.readthedocs.io/en/stable/api.html#config-file-support
 __ http://asyncssh.readthedocs.io/en/stable/api.html#known-hosts
 __ http://asyncssh.readthedocs.io/en/stable/api.html#authorized-keys
-__ http://asyncssh.readthedocs.io/en/stable/api.html#config-file-support
+__ http://asyncssh.readthedocs.io/en/stable/api.html#sshsig-support
 
 License
 -------
 
 This package is released under the following terms:
 
-  Copyright (c) 2013-2025 by Ron Frederick <ronf@timeheart.net> and others.
+  Copyright (c) 2013-2026 by Ron Frederick <ronf@timeheart.net> and others.
 
   This program and the accompanying materials are made available under
   the terms of the Eclipse Public License v2.0 which accompanies this

asyncssh/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2013-2024 by Ron Frederick <ronf@timeheart.net> and others.
+# Copyright (c) 2013-2026 by Ron Frederick <ronf@timeheart.net> and others.
 #
 # This program and the accompanying materials are made available under
 # the terms of the Eclipse Public License v2.0 which accompanies this
@@ -112,6 +112,10 @@
 from .sftp import SFTPAttrs, SFTPVFSAttrs, SFTPName, SFTPLimits
 from .sftp import SEEK_SET, SEEK_CUR, SEEK_END
 
+from .sshsig import SSHAllowedSigners
+from .sshsig import import_allowed_signers, read_allowed_signers
+from .sshsig import create_sshsig, validate_sshsig
+
 from .stream import SSHSocketSessionFactory, SSHServerSessionFactory
 from .stream import SFTPServerFactory, SSHReader, SSHWriter
 
@@ -159,8 +163,8 @@
     'SSHUNIXChannel', 'SSHUNIXSession', 'SSHWriter',
     'STDOUT', 'ServiceNotAvailable', 'SignalReceived', 'TerminalSizeChanged',
     'TimeoutError', 'connect', 'connect_agent', 'connect_reverse',
-    'create_connection', 'create_server', 'generate_private_key',
-    'get_server_auth_methods', 'get_server_host_key',
+    'create_connection', 'create_server', 'create_sshsig',
+    'generate_private_key', 'get_server_auth_methods', 'get_server_host_key',
     'import_authorized_keys', 'import_certificate', 'import_known_hosts',
     'import_private_key', 'import_public_key', 'listen', 'listen_reverse',
     'load_certificates', 'load_keypairs', 'load_pkcs11_keys',
@@ -169,5 +173,5 @@
     'read_known_hosts', 'read_private_key', 'read_private_key_list',
     'read_public_key', 'read_public_key_list', 'run_client', 'run_server',
     'scp', 'set_debug_level', 'set_default_skip_rsa_key_validation',
-    'set_log_level', 'set_sftp_log_level'
+    'set_log_level', 'set_sftp_log_level', 'validate_sshsig'
 ]

asyncssh/auth_keys.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2015-2024 by Ron Frederick <ronf@timeheart.net> and others.
+# Copyright (c) 2015-2026 by Ron Frederick <ronf@timeheart.net> and others.
 #
 # This program and the accompanying materials are made available under
 # the terms of the Eclipse Public License v2.0 which accompanies this
@@ -20,6 +20,7 @@
 
 """Parser for SSH authorized_keys files"""
 
+from pathlib import PurePath
 from typing import Dict, List, Mapping, Optional, Sequence
 from typing import Set, Tuple, Union, cast
 
@@ -30,7 +31,7 @@
 except ImportError: # pragma: no cover
     _x509_available = False
 
-from .misc import ip_address, read_file
+from .misc import FilePath, OptionsParser, ip_address, read_file
 from .pattern import HostPatternList, WildcardPatternList
 from .public_key import KeyImportError, SSHKey
 from .public_key import SSHX509Certificate, SSHX509CertificateChain
@@ -40,13 +41,15 @@
 
 _EntryOptions = Mapping[str, object]
 
-class _SSHAuthorizedKeyEntry:
+
+class _SSHAuthorizedKeyEntry(OptionsParser):
     """An entry in an SSH authorized_keys list"""
 
     def __init__(self, line: str):
+        super().__init__()
+
         self.key: Optional[SSHKey] = None
         self.cert: Optional[SSHX509Certificate] = None
-        self.options: Dict[str, object] = {}
 
         try:
             self._import_key_or_cert(line)
@@ -151,60 +154,6 @@ def _add_subject(self, option: str, value: str) -> None:
         'subject':     _add_subject
     }
 
-    def _add_option(self) -> None:
-        """Add an option value"""
-
-        if self._option.startswith('='):
-            raise ValueError('Missing option name in authorized_keys')
-
-        if '=' in self._option:
-            option, value = self._option.split('=', 1)
-
-            handler = self._handlers.get(option)
-            if handler:
-                handler(self, option, value)
-            else:
-                values = cast(List[str], self.options.setdefault(option, []))
-                values.append(value)
-        else:
-            self.options[self._option] = True
-
-    def _parse_options(self, line: str) -> str:
-        """Parse options in this entry"""
-
-        self._option = ''
-
-        idx = 0
-        quoted = False
-        escaped = False
-
-        for idx, ch in enumerate(line):
-            if escaped:
-                self._option += ch
-                escaped = False
-            elif ch == '\\':
-                escaped = True
-            elif ch == '"':
-                quoted = not quoted
-            elif quoted:
-                self._option += ch
-            elif ch in ' \t':
-                break
-            elif ch == ',':
-                self._add_option()
-                self._option = ''
-            else:
-                self._option += ch
-
-        self._add_option()
-
-        if quoted:
-            raise ValueError('Unbalanced quote in authorized_keys')
-        elif escaped:
-            raise ValueError('Unbalanced backslash in authorized_keys')
-
-        return line[idx:].strip()
-
     def match_options(self, client_host: str, client_addr: str,
                       cert_principals: Optional[Sequence[str]],
                       cert_subject: Optional['X509Name'] = None) -> bool:
@@ -277,7 +226,7 @@ def load(self, authorized_keys: str) -> None:
 
     def validate(self, key: SSHKey, client_host: str, client_addr: str,
                  cert_principals: Optional[Sequence[str]] = None,
-                 ca: bool = False) -> Optional[Mapping[str, object]]:
+                 ca: bool = False) -> Optional[_EntryOptions]:
         """Return whether a public key or CA is valid for authentication"""
 
         for entry in self._ca_entries if ca else self._user_entries:
@@ -322,7 +271,7 @@ def import_authorized_keys(data: str) -> SSHAuthorizedKeys:
     return SSHAuthorizedKeys(data)
 
 
-def read_authorized_keys(filelist: Union[str, Sequence[str]]) -> \
+def read_authorized_keys(filelist: Union[FilePath, Sequence[FilePath]]) -> \
         SSHAuthorizedKeys:
     """Read SSH authorized keys from a file or list of files
 
@@ -331,16 +280,16 @@ def read_authorized_keys(filelist: Union[str, Sequence[str]]) -> \
 
        :param filelist:
            The file or list of files to read the keys from.
-       :type filenlist: `str` or `list` of `str`
+       :type filelist: `PurePath`, `str`, or a list of these
 
        :returns: An :class:`SSHAuthorizedKeys` object
 
     """
 
     authorized_keys = SSHAuthorizedKeys()
 
-    if isinstance(filelist, str):
-        files: Sequence[str] = [filelist]
+    if isinstance(filelist, (PurePath, str)):
+        files: Sequence[FilePath] = [filelist]
     else:
         files = filelist