proposal: x/crypto/ssh: add package for Key Revocation Lists

[micahhausler]

What version of Go are you using (go version)?

go version go1.9.2 darwin/amd64

What did you expect to see?

x/crypto/ssh has support for SSH Certificates and an ssh.CertChecker.IsRevoked() method, but there seems to not be support for OpenSSH's Key Revocation List (KRL) format. It would be useful to be able to marshal/unmarshal revocation lists for use by an OpenSSH server in Go.

[bradfitz]

@hanwen?

[hanwen]

sounds like a useful feature. I think it could be separate subpackage of SSH.

[micahhausler]

After digging around I found stripe/krl which supports what I need. It might still be useful to have that functionality as a package under x/crypto/ssh, but its up to you all to keep this open or not.

[FiloSottile]

This wasn't implemented for 2 years, and there's a third-party package that seems to meet the need, so reverting the Proposal-Accepted and bouncing it back to the committee. I think the lack of activity suggests we can do without it.

[rsc]

Based on the discussion above and two years of inactivity after the initial acceptance, it sounds like this is a likely decline and that people who need KRLs can use https://github.com/stripe/krl. This does not seem like enough people need it to adopt it.

Leaving open for a week for final comments.

[rsc]

No change in consensus, so declined.