cmd/incus: Add 'remote get-client-certificate' and 'get-client-token' commands

Signed-off-by: stoven2k17 <[email protected]>

Author: stoven2k17

cmd/incus/remote.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"bufio"
+	"crypto/sha256"
+	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
@@ -14,9 +16,10 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"time"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/spf13/cobra"
-
 	incus "github.com/lxc/incus/v6/client"
 	cli "github.com/lxc/incus/v6/internal/cmd"
 	"github.com/lxc/incus/v6/internal/i18n"
@@ -83,6 +86,14 @@ func (c *cmdRemote) Command() *cobra.Command {
 	remoteSetURLCmd := cmdRemoteSetURL{global: c.global, remote: c}
 	cmd.AddCommand(remoteSetURLCmd.Command())
 
+	// Get client certificate
+	remoteGetClientCertificateCmd := cmdRemoteGetClientCertificate{global: c.global, remote: c}
+	cmd.AddCommand(remoteGetClientCertificateCmd.Command())
+
+	// Get client token
+	remoteGetClientTokenCmd := cmdRemoteGetClientToken{global: c.global, remote: c}
+	cmd.AddCommand(remoteGetClientTokenCmd.Command())
+
 	// Workaround for subcommand usage errors. See: https://github.com/spf13/cobra/issues/706
 	cmd.Args = cobra.NoArgs
 	cmd.Run = func(cmd *cobra.Command, _ []string) { _ = cmd.Usage() }
@@ -691,6 +702,133 @@ func (c *cmdRemoteGetDefault) Command() *cobra.Command {
 	return cmd
 }
 
+// Get client certificate.
+type cmdRemoteGetClientCertificate struct {
+	global *cmdGlobal
+	remote *cmdRemote
+}
+
+// Command returns a cobra.Command for get-client-certificate.
+func (c *cmdRemoteGetClientCertificate) Command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = usage("get-client-certificate")
+	cmd.Short = i18n.G("Print the client certificate used by this Incus client")
+	cmd.RunE = c.Run
+	return cmd
+}
+
+// Runs the get-client-certificate cmmand.
+func (c *cmdRemoteGetClientCertificate) Run(cmd *cobra.Command, args []string) error {
+	conf, err := config.LoadConfig(os.Getenv("INCUS_CONF"))
+	if err != nil {
+		return fmt.Errorf("failed to load client config: %w", err)
+	}
+
+	if !conf.HasClientCertificate() {
+		fmt.Fprintf(os.Stderr, i18n.G("Generating a client certificate.") + "\n")
+		err := conf.GenerateClientCertificate()
+		if err != nil {
+			return fmt.Errorf("failed to generate client certificate: %w", err)
+		}
+	}
+
+	certPath := conf.ConfigPath("client.crt")
+
+	content, err := os.ReadFile(certPath)
+	if err != nil {
+		return fmt.Errorf("failed to read certificate: %w", err)
+	}
+
+	fmt.Println(string(content))
+	return nil
+}
+
+type cmdRemoteGetClientToken struct {
+	global *cmdGlobal
+	remote *cmdRemote
+}
+
+// Command returns a cobra.Command for get-client-token.
+func (c *cmdRemoteGetClientToken) Command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = usage("get-client-token")
+	cmd.Short = i18n.G("Generate a client token derived from the client certificate")
+	cmd.Long = cli.FormatSection(i18n.G("Description"), i18n.G(
+		`Generate a client trust token derived from the existing client certificate and private key.
+
+This is useful for remote authentication workflows where a token is passed to another Incus server.`))
+	cmd.RunE = c.Run
+	return cmd
+}
+
+// Run runs the get-client-token logic.
+func (c *cmdRemoteGetClientToken) Run(cmd *cobra.Command, args []string) error {
+	conf, err := config.LoadConfig(os.Getenv("INCUS_CONF"))
+	if err != nil {
+		return fmt.Errorf("failed to load client config: %w", err)
+	}
+
+	certPath := conf.ConfigPath("client.crt")
+	keyPath := conf.ConfigPath("client.key")
+
+	if _, err := os.Stat(certPath); os.IsNotExist(err) {
+		return fmt.Errorf("client certificate not found at %s", certPath)
+	}
+	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		return fmt.Errorf("client key not found at %s", keyPath)
+	}
+
+	cert, err := os.ReadFile(certPath)
+	if err != nil {
+		return fmt.Errorf("failed to read certificate: %w", err)
+	}
+	key, err := os.ReadFile(keyPath)
+	if err != nil {
+		return fmt.Errorf("failed to read private key: %w", err)
+	}
+
+	token, err := generateClientToken(cert, key)
+	if err != nil {
+		return fmt.Errorf("failed to generate token: %w", err)
+	}
+
+	fmt.Println(token)
+	return nil
+}
+
+// generateClientToken returns a signed JWT derived from the client certificate and key.
+func generateClientToken(certPEM, keyPEM []byte) (string, error) {
+	keypair, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return "", err
+	}
+
+	// Use SHA-256 fingerprint of the first cert in the chain
+	fingerprint := sha256.Sum256(keypair.Certificate[0])
+	subject := fmt.Sprintf("%x", fingerprint)
+
+	now := time.Now()
+	claims := jwt.RegisteredClaims{
+		Subject:   subject,
+		IssuedAt:  jwt.NewNumericDate(now),
+		NotBefore: jwt.NewNumericDate(now),
+		ExpiresAt: jwt.NewNumericDate(now.Add(1 * time.Hour)),
+	}
+
+	// Trying signing with both ES384 and RS256
+	algos := []jwt.SigningMethod{jwt.SigningMethodES384, jwt.SigningMethodRS256}
+
+	for _, alg := range algos {
+		token := jwt.NewWithClaims(alg, claims)
+		tokenStr, err := token.SignedString(keypair.PrivateKey)
+		if err == nil {
+			return tokenStr, nil
+		}
+	}
+
+	return "", fmt.Errorf("unable to sign JWT with available key algorithms")
+}	
+
 // Run is used in the RunE field of the cobra.Command returned by Command.
 func (c *cmdRemoteGetDefault) Run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf