Key ID: C6CB6CC54E363735
Subkeys: AAFDA9101C58F338, A96EDD9C10BC77A5, 5BB1D2E5A4C8404B
git config --global user.signingkey AAFDA9101C58F338
git config --global commit.gpgsign true
curl https://gist.githubusercontent.com/nicolo-ribaudo/2d3b27778d2b248947ddbb5c48b1bc3c/raw/077ccef1f3210a9f9a3ab9b2d6811f61b2037bc7/pubkey.pem | gpg --import
gpg --edit-key C6CB6CC54E363735 # configure ultimate trustRestart deamon (linux)
gpgconf --kill gpg-agent
gpgconf --launch gpg-agent~/.gnupg/gpg-agent.conf
enable-ssh-support
ttyname $GPG_TTY
default-cache-ttl 60
max-cache-ttl 120
pinentry-program /usr/bin/pinentry-gnome3
# pinentry-program /opt/homebrew/bin/pinentry-mac.bashrc/.zshrc
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
gpgconf --launch gpg-agentThat setup above is when running from a single device. To support using a device both as standalone and as a ssh server for remote clients, use the following config.
On the server, in .zshrc:
# For SSH from PGP on the Yubikey
GPG_AGENT_SOCKET="/run/user/1000/gnupg/S.gpg-agent"
GPG_AGENT_SOCKET_REMOTE="/run/user/1000/gnupg/S.gpg-agent.from-ssh"
if [[ -n $SSH_CONNECTION ]]; then
# Remote
if [[ "$(realpath $GPG_AGENT_SOCKET)" == $GPG_AGENT_SOCKET_REMOTE ]]; then
# Already running with the remote agent
else
gpgconf --kill gpg-agent
rm $GPG_AGENT_SOCKET 2> /dev/null || true
ln -s $GPG_AGENT_SOCKET_REMOTE $GPG_AGENT_SOCKET
fi
else
# Local
if [[ "$(realpath $GPG_AGENT_SOCKET)" == $GPG_AGENT_SOCKET_REMOTE ]]; then
# Disconnect from the remote agent
rm $GPG_AGENT_SOCKET || true
fi
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
gpgconf --launch gpg-agent
fiOn the server, in /etc/ssh/sshd_config:
StreamLocalBindUnlink yes
On each remote client's ~/.ssh/config (note: the RemoteForward second path assumes MacOS):
Host <host name>
ForwardAgent yes
User <user name>
RemoteForward /run/user/1000/gnupg/S.gpg-agent.from-ssh /Users/<user name>/.gnupg/S.gpg-agent.extra
$ gpg --card-view
$ gpg --card-edit # run verify command
On linux I needed to
sudo apt install scdaemon