opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
Goph is a lightweight Go SSH client library that simplifies SSH connections with a clean API. It supports password, private key, agent, and keyboard-interactive authentication; SOCKS5 proxy and jump host tunneling; file upload/download via SFTP; command execution with context cancellation; and script execution from readers or files. The library uses functional options for configuration, proper known hosts verification by default, and exposes a reusable dialer for multiple connections. It is well-structured, idiomatic Go with decent test coverage and modern dependency versions (Go 1.25, recent crypto/net packages). The commit timestamps appear anomalous (year 2026), but the repo shows active development.