petrbalvin/goget
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: extend certificate pinning to all TLS protocols and add SSH

Browse Source 
host-key pinning
This commit is contained in:
petrbalvin
2026-06-29 19:23:10 +02:00
parent e7ed3a334e
commit fc65ea8340
19 changed files with 355 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+19 -2
View File
@@ -12,13 +12,30 @@ goget implements multiple security features to protect both the client and serve
### Certificate Pinning
Pin a specific certificate by its SHA-256 hash:
Pin a specific certificate by its SHA-256 hash. This works across every
TLS-bearing protocol goget supports: HTTPS, FTPS, Gemini, and WebDAVS.
```bash
goget --pinned-cert "a1b2c3d4e5f6..." --url https://example.com
goget --pinned-cert "a1b2c3d4e5f6..." --url ftps://ftp.example.com/file
goget --pinned-cert "a1b2c3d4e5f6..." --url gemini://geminiprotocol.net
goget --pinned-cert "a1b2c3d4e5f6..." --url webdavs://dav.example.com/file
```
If the server certificate's SHA-256 doesn't match, the connection is aborted.
If the leaf certificate's SHA-256 doesn't match, the connection is aborted.
### SSH Host-Key Pinning (SFTP)
Pin the SSH host key for SFTP by its OpenSSH fingerprint (the same value
printed by `ssh-keygen -lf ~/.ssh/known_hosts`). Pinning takes precedence
over `--ssh-insecure` and the `known_hosts` file.
```bash
goget --pinned-host-key "SHA256:AAAAC3NzaC1lZDI1NTE5AAAAIE+HHi0MtRj4VPl8mdP8gniGZDRb0SZTdI2TPxRyCm1H" \
--url sftp://example.com/file
```
The raw lowercase-hex SHA-256 of the key wire format is also accepted.
### Client Certificates (mTLS)