Method maybeSignWithCa

sign_certd.go:657–692

(requestID string, numSignersRequired int, signingKeyFingerprint string)

}

func (h *certRequestHandler) maybeSignWithCa(requestID string, numSignersRequired int, signingKeyFingerprint string) (bool, error) {
	h.stateMutex.Lock()
	defer h.stateMutex.Unlock()
	if len(h.state[requestID].signatures) >= numSignersRequired {
		if h.sshAgentConn == nil {
			// This is used for testing. We're effectively disabling working
			// with the ssh agent to avoid needing to mock it.
			log.Print("ssh agent uninitialized, will not attempt signing. This is normal in unittests")
			return true, nil
		}
		log.Printf("Received %d signatures for %s, signing now.\n", len(h.state[requestID].signatures), requestID)
		signer, err := ssh_ca_util.GetSignerForFingerprintOrUrl(signingKeyFingerprint, h.sshAgentConn)
		if err != nil {
			log.Printf("Couldn't find signing key for request %s, unable to sign request: %s\n", requestID, err)
			return false, fmt.Errorf("Couldn't find signing key, unable to sign. Sorry.")
		}
		stateInfo := h.state[requestID]
		for extensionName := range stateInfo.request.Extensions {
			// sshd up to version 6.8 has a bug where optional extensions are
			// treated as critical. If a cert contains any non-standard
			// extensions, like ours, the server rejects the cert because it
			// doesn't understand the extension. To cope with this we simply
			// strip our non-standard extensions before doing the final
			// signature. https://bugzilla.mindrot.org/show_bug.cgi?id=2387
			if strings.Contains(extensionName, "@") {
				delete(stateInfo.request.Extensions, extensionName)
			}
		}
		stateInfo.request.SignCert(rand.Reader, signer)
		stateInfo.certSigned = true
		// this is weird. see: https://code.google.com/p/go/issues/detail?id=3117
		h.state[requestID] = stateInfo
		return true, nil
	}
	return false, nil
}

func signdFlags() []cli.Flag {
	home := os.Getenv("HOME")