signers: allow all card slots and imported keys, sign confirmation and card select by serial #104
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- creates a cli configuration flag (--slot authentication) to be able to specify which slots should be enabled - allows specifying a pin policy (--slot signature,always) to allow for imported keys. These do not have a valid attestation which would be used to determine the pin policy, so we have to set it. to enable all slots with imported keys for a typical PIV config you could use: yubikey-agent -l agent.sock --slot authentication,once --slot signature,always --slot keymanagement,once
Try all available cards till we find the first usable one. Also allow selecting a specific yubikey by passing -serial 1234567890
similar to ssh-add -c. uses askpass to confirm every signing operation by the user. especially useful for cached pin scenarios. yubikeys can cache pins and askpass can be configured to autofill from keychain. The user might still want to know about signing operations happening.
FStelzer
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
able to specify which slots should be enabled
for imported keys. Since these do not have a valid attestation which
would be used to determine the pin policy otherwise we have to set it.
to enable all slots with imported keys for a typical PIV config you could use:
yubikey-agent -l agent.sock --slot authentication,once --slot signature,always --slot keymanagement,once
The default without any parameters matches the current config (only Authentication and no configured pin policy).
This change makes yubikey-agent immediately usable with previously generated / imported keys (which i think a lot of people at least in the corporate world have).
Similar to #57 but focused on usage of all imported keys.