Add native Dosh host trust foundation

src/bin/dosh-server.rs

@@ -6,6 +6,7 @@ use dosh::auth::{
 };
 use dosh::config::{ServerConfig, load_server_config};
 use dosh::crypto;
+use dosh::native::{host_public_key, host_public_key_line, load_or_create_host_key};
 use dosh::protocol::{
     self, AttachOk, AttachReject, BootstrapAttachRequest, CLIENT_TO_SERVER, Frame, Input,
     PacketKind, ReplayWindow, Resize, ResumeRequest, SERVER_TO_CLIENT, TicketAttachBody,
@@ -36,7 +37,9 @@ enum Command {
         #[arg(long, default_value_t = 1)]
         protocol: u8,
         #[arg(long)]
-        nonce: String,
+        nonce: Option<String>,
+        #[arg(long)]
+        host_key: bool,
         #[arg(long, default_value = "default")]
         session: String,
         #[arg(long, default_value = "read-write")]
@@ -58,6 +61,7 @@ async fn main() -> Result<()> {
         Command::Auth {
             protocol,
             nonce,
+            host_key,
             session,
             mode,
             size,
@@ -66,8 +70,13 @@ async fn main() -> Result<()> {
         } => {
             anyhow::ensure!(protocol == 1, "unsupported protocol {protocol}");
             let config = load_server_config(None)?;
+            if host_key {
+                let signing_key = load_or_create_host_key(&config)?;
+                println!("{}", host_public_key_line(&host_public_key(&signing_key)));
+                return Ok(());
+            }
             let secret = load_or_create_server_secret(&config)?;
-            let nonce = parse_nonce(&nonce)?;
+            let nonce = parse_nonce(nonce.as_deref().context("--nonce is required")?)?;
             let size = parse_size(&size)?;
             let user = std::env::var("USER").unwrap_or_else(|_| "unknown".to_string());
             let udp_host = udp_host.unwrap_or_else(|| "127.0.0.1".to_string());