Function revokeAction

command/ssh/revoke.go:124–199

(ctx *cli.Context)

}

func revokeAction(ctx *cli.Context) error {
	args := ctx.Args()
	token := ctx.String("token")
	var serial string

	switch ctx.NArg() {
	case 0:
		certFile := ctx.String("sshpop-cert")
		keyFile := ctx.String("sshpop-key")
		if certFile == "" || keyFile == "" {
			return errors.New("--sshpop-cert and --sshpop-key must be supplied if serial number is not supplied as first argument")
		}
		// Load the cert, because we need the serial number.
		certBytes, err := os.ReadFile(certFile)
		if err != nil {
			return errors.Wrapf(err, "error reading ssh certificate from %s", certFile)
		}
		sshpub, _, _, _, err := ssh.ParseAuthorizedKey(certBytes)
		if err != nil {
			return errors.Wrapf(err, "error parsing ssh public key from %s", certFile)
		}
		cert, ok := sshpub.(*ssh.Certificate)
		if !ok {
			return errors.New("error casting ssh public key to ssh certificate")
		}
		serial = strconv.FormatUint(cert.Serial, 10)
	case 1:
		serial = args.Get(0)
	default:
		return errs.TooManyArguments(ctx)
	}

	reason := ctx.String("reason")
	// Convert the reasonCode flag to an OCSP revocation code.
	reasonCode, err := cmdca.ReasonCodeToNum(ctx.String("reasonCode"))
	if err != nil {
		return err
	}

	flow, err := cautils.NewCertificateFlow(ctx)
	if err != nil {
		return err
	}

	if token == "" {
		token, err = flow.GenerateSSHToken(ctx, serial, cautils.SSHRevokeType, nil, provisioner.TimeDuration{}, provisioner.TimeDuration{})
		if err != nil {
			return err
		}
	}

	// Prepare retry function
	retryFunc, err := loginOnUnauthorized(ctx)
	if err != nil {
		return err
	}

	caClient, err := flow.GetClient(ctx, token, ca.WithRetryFunc(retryFunc))