This repository has no description
tools.age-detect: detect gpg-agent identity (priority above yubikey)
When gpg-agent is reachable and the user has a secret encryption
subkey ([E] ssb), emit the age-plugin-gpg default identity
(AGE-PLUGIN-GPG-1H40XPM, the bech32 of an empty body for the gpg
plugin). gpg-agent caches the passphrase / smartcard PIN, so this is
more frictionless than the yubikey path; we therefore place it above
yubikey/solo2 but below se/tpm.
author
lassulus
date
(May 1, 2026, 8:05 PM CEST)
commit
8926c4aa
8926c4aa453ae6f4401488f96bf430b7cedcf2ce
parent
811a80e6
811a80e6e6b6371964b11cca8a29e4423d03615a
+16
-2
+16
-2
tools/age-detect/age-detect
+16
-2
tools/age-detect/age-detect
···
30
30
fi
31
31
fi
32
32
33
-
# Check for YubiKeys (third priority)
33
+
# Check for gpg-agent with an encryption subkey (third priority).
34
+
# Frictionless after the first decrypt because gpg-agent caches the
35
+
# passphrase / smartcard PIN, so we prefer it over yubikey/solo2.
36
+
if command -v gpg-connect-agent >/dev/null 2>&1 \
37
+
&& gpg-connect-agent /bye >/dev/null 2>&1 \
38
+
&& gpg --list-secret-keys --with-colons 2>/dev/null \
39
+
| awk -F: '$1 == "ssb" && $12 ~ /e/ { found=1 } END { exit !found }'; then
40
+
echo "AGE-PLUGIN-GPG-1H40XPM" > "$temp_identities"
41
+
echo "IDENTITY_FILE=$temp_identities"
42
+
echo "DETECTED_KEY=gpg"
43
+
echo "KEY_TYPE=gpg"
44
+
return
45
+
fi
46
+
47
+
# Check for YubiKeys (fourth priority)
34
48
if command -v ykman >/dev/null 2>&1; then
35
49
local yubikey_serial
36
50
yubikey_serial=$(ykman info 2>/dev/null | grep "Serial number:" | cut -d: -f2 | tr -d ' ' || true)
···
85
99
echo " DETECTED_KEY=<name> - Name of the detected key (e.g., yubi1, solo2, se)"
86
100
echo " KEY_TYPE=<type> - Type of key (yubikey, solo2, se)"
87
101
echo ""
88
-
echo "Priority order: se > tpm > yubikey > solo2"
102
+
echo "Priority order: se > tpm > gpg > yubikey > solo2"
89
103
;;
90
104
*)
91
105
echo "Unknown command: $1" >&2