Implementing OpenSSH certificate support in PuTTY
a day ago
- Certificate support in PuTTY required changes across almost all code areas except terminal emulation, making it a far-reaching feature.
- The implementation was done in parallel across subsystems, with frequent context-switching to avoid rework of completed parts.
- A new global configuration system was introduced for CA settings, as per-session configuration was insufficient for host key certificates.
- A custom Boolean expression syntax was designed for CA trust rules, allowing simple wildcards like '*.example.com' and compound expressions with '&&' and '||'.
- User certificates can be provided via modified PPK files, separate certificate files, or command-line options, supporting multiple certificates per key.
- Pageant's key storage was refactored into separate public and private key data structures to ensure related keys are encrypted/decrypted together.
- A rekey bug caused crashes after an hour due to oversight in testing; fixed before release.
- Pre-release builds were announced for the first time to gather user feedback, successfully catching bugs before the final release.