The `step ca acme eab` subcommands only emitted fixed-width column text,
making them awkward to script against (add.go even carried a standing
TODO asking for JSON output). Add a `--json` flag to each subcommand for
machine-readable output:
- add: marshals the created key (including the secret) as a JSON object
- list: collects all pages into a JSON array, bypassing $PAGER; the
secret HMAC key is omitted, matching the table's masking
- remove: emits {"provisioner","id","deleted":true} on success
The shared cliEAK struct now has exported, JSON-tagged fields, and toCLI
guards createdAt with an IsZero check (mirroring boundAt) so unset
timestamps are dropped via omitempty. Adds the first unit tests for the
package covering toCLI and the JSON contract.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
proxyDirect waited for both copy goroutines via wg.Wait(). When the
server closes the connection mid-session, the stdin->conn goroutine
stays blocked reading a stdin that never reaches EOF (the ssh client
holds the proxycommand's stdin open until it exits), deadlocking until
an OS-level timeout reaps the process.
Return as soon as either direction finishes instead. Extracted a
testable proxyDirectWithIO and added a regression test.
Fixes#1641
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
When VerificationURIComplete is present in the device authorization
response, the user code is already embedded in the URI. Printing
the code separately is redundant and potentially confusing.
This suppresses the code prompt in that case and shows only the
complete URI.
This is related to https://github.com/smallstep/cli/pull/1430, and
the behavior is in line with `kubelogin`
Change-Type: behavior
Release-Note: yes
Audience: user
Impact: low
Breaking: false
This command allows use use KMS URIs without using the `--kms` flag.
Those commands using cryptoutils package will read a key from a KMS if
the name is not a file and is one of the supported KMS types.
This commit suppresses the message "certificate does not need renewal"
on the `step certificate needs-renewal` and `step ssh needs-renewal`
unless the `--verbose` flag is passed.
The ACME-DA flow in the step ca certificate command expects all KMS parameters
to be provided through the `--attestation-uri` flag. Using the `--kms` flag at the
same time can lead to errors. For example, if the YubiKey PIN is set with the
`--kms` flag, the flow will ignore it and use the default one instead, resulting
in a PIN retry error.
Fixes#1492
This commit adds the `--pkix` flag to `step crypto key fingerprint` command.
This flag and the PKIX encoding of the key instead of the X.509 subjectPublicKey
format.
In the OIDC Device Authorization Flow in command/oauth, present the user
with VerificationURIComplete rather than VerificationURI if present, so
that the user doesn't have to manually type the code when using an IdP
that provides this feature.
Fixes#1424
This PR fixes the following issues:
- SCEP provisioners not detected in admin token flows
- Invalid provisioner selection logic when managing provisioner policies
- Unexpected error messages showing "issuer" instead or "provisioner" flag
- min-encryption-password-length
- provisioner
Enforce min-encryption-password-length, if set, in the 'step ssh
certificate' command.
Add flags.FirstStringOf returns value of first defined flag in input list
Add the `--set` and `--set-file` flags to the `step ca token` command,
allowing the user to set keys in the "user" claim in the resulting JWT.
Signed-off-by: Dan Fuhry <dan@fuhry.com>
