Currently the only way to push to a knot is to have an ssh key registered. I'd like the ability to have some sort of HTTPS or OAuth mechanism instead because in some cases you can't open a port for ssh (for example, I run my knot behind Cloudflare tunnels and it's impossible to have SSH connections via the tunnel without having the warp client installed).
I think that the best way to handle this would be delegating authentication to the PDS using something shaped like the atcr credential helper and/or the git-credential-oauth credential helper.
made a crappy proof of concept at https://tangled.org/madoka.systems/core/tree/knot-oauth and doesn't work with spindles (neither the new http path or the old ssh path, so don't use this in production obviously), but you use it like this:
use the
git-credential-tangledoauth provider to enroll a key for your device be doing:then this will give you a like which asks for oauth permissions for
atproto repo:sh.tangled.httpKeyfor localhost, then it takes the public key from that and publishes it tosh.tangled.httpKey/<tid>mirroring the publicKey lexicon. then you push like normal to your https repo url.