Support allowed signers

[hiddeco]

This just adds the lowest level API to match the golang.org/x/crypto/ssh package.

The library itself should offer a nicer API addition to also provide proper verification while utilizing the principals and options from the allowed_signers file.

To-do

• Tests
• Further API abstraction around verification, and working with principals in general

[tionis]

Is there a reason why this was never merged?

[hiddeco]

It hasn't been finalized, and I need to find time to do this.

What I recall from the top of my head: while this allows parsing of the file, by itself it would be insufficient to support principals in full, which would require additional logic. For example to support wild cards, and some other features which an allowed_signers file facilities.

[tionis]

I see, I'll take a look at it next week and maybe shoot a PR your way then.
I'm currently building a small signing infrastructure on top of ssh sigs (+ certificates).

[tionis]

Ok, I implemented it over at my own tool:
https://github.com/tionis/ssh-tools/blob/a835cb13df0c310e236cd3fb3bb1003e526a4432/allowed_signers/main.go
This still needs some cleanup before I would merge it here. Also, my implementation allows comments even though they are not allowed by the spec (OpenSSH does still parse the file with them though)
This should probably be removed for this library.
Also, some integration with cert revocation files could later be added.

[hiddeco]

Also, my implementation allows comments even though they are not allowed by the spec (OpenSSH does still parse the file with them though)

The implementation in this PR should also successfully parse the file, but does not provide them as output. Which I think is the correct thing to do, as we strive to follow the specification as close as possible within this library except if it breaks integration with more loose implementations (which shouldn't be the case for something that is practically metadata).

I will try to find some time soon (probably next week) to get this PR landed without the further abstractions, as I think it should be placed somewhere else e.g. ../crypto/ssh (or util, but that's an awful package name) to make room for the abstractions.