What's the deal?

[kristofferR]

Forgive me, but why isn't this open source? I don't get why you'd make it closed-source if you release it for free, especially for something as security sensitive as a terminal? Seems like one of the most important apps to open source, for all I know this app is an ssh key stealer..

Do you plan to start charging for this eventually? Otherwise, please consider open-sourcing it so it can be trusted.

[lonnywong]

I'm not a maintainer, but I guess one reason for not open-sourcing might be to prevent others from stealing the code and profiting from it on the App Store. To avoid suspicion of private key theft, could a separate open-source app similar to ssh-agent be developed? Users could store their private keys in this app, and rootshell would request signatures from it during login. This way, even if rootshell is closed-source, people could use it with more confidence.

[kitknox]

Thanks for your interest in rootshell. While I am likely to open source the application later, I totally understand if you choose to use something else in the meantime. I am currently focused on getting this shipped and approved in the App Store as well as some other work before considering the additional work of managing contributions. (I'd also prefer there not be clones before rootshell is published in the first place.)

As a long-standing contributor to security-related efforts I have put extra care into ensuring there are multiple ways that you can use the application without your private keys ever being accessible to either me, or even Apple as a platform owner.

1. rootshell has stronger support for multiple vendors' security keys than any other similar application I am aware of. We have support for ED25519 and RSA 4096 PIV slots for SSH keys on YubiKey that are generated on the hardware key itself. PIN-required slots can be leveraged for signing exclusively. We currently have extensive support including USB-C, NFC, and even Lightning in our TestFlight builds and the standalone macOS variants. If you are not a fan of YubiKey, we have standard FIDO2 support which has additional vendor options. In FIDO2 mode you are more limited with ECDSA P-256 because of an Apple limitation. In FIDO2 mode you have to physically trigger key signing EACH time. This functionality is baked into READ ONLY firmware on the security key. The macOS version is also not an encrypted binary, making it easier for you to validate my claims.

Using these options, even you as an owner of the device have no possible way to retrieve the private key. (This requires separate disaster recovery considerations such as a second key, etc.)

2. rootshell has robust support for third-party solutions such as Tailscale where you can optionally enumerate your tailnet and use the none SSH authentication type and offload that trust to Tailscale SSH instead of me. In this mode we are not even in the loop for the key signing process.

I am very grateful to the other projects and developers who have contributed their technology to the community, making this application possible. A number of upstream contributions have already been made and will continue to be made as I work through a backlog over here. For example, the Helix support that was recently added was already open sourced.

[kristofferR]

Thanks for the response! I'll try it for my vibebox VM, but im still a little hesitant to use it for my real servers until it is App Store approved or open source.