app-crypt/ssh-tpm-agent
ssh-agent compatible agent for TPM 2.0 sealed SSH keys
Screenshots
View
Download
BrowseChangeLog
commit 559bba2baab2d84dad063d92b92c7b97e157fa7a
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 10:16:02 2026 -0600
app-crypt/ssh-tpm-agent: 1.0.0_rc2_p2 from the nabbi fork, drop 0.9.0-r1
Build the nabbi fork of ssh-tpm-agent instead of upstream's signed
release: upstream master (1.0.0-rc2) plus the hardening fixes that are
not upstream, tagged v<upstream version>-nabbi<N> and packaged as
<upstream version>_p<N>. The fork's CI (projg2/golang-dist-action)
builds the Go deps tarball for each tag, so the tag archive and the deps
tarball come from the same release.
The two 0.9.0 backports (keygen overwrite prompt, keygen -p swapped
passphrases) are in the fork, as are the upstream lifetime and
cache-timeout pull requests. Fork tags are not OpenPGP-signed, so
verify-sig goes.
Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
commit 6a517733a580476fca6aaf12bb974f95f8bd7d5b
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 00:46:32 2026 -0600
app-crypt/ssh-tpm-agent: fix ssh-tpm-keygen -p, 0.9.0-r1
Backport upstream PR #148 (fixes #133, not merged yet): -p passed the
old and new passphrase to ChangeAuth swapped, so changing a passphrase
failed with TPM_RC_AUTH_FAIL and each try counted towards the TPM's
dictionary-attack lockout. Drop the postinst warning about it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 43e9992d990438ae738c7f1f356c6e989f956e3b
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 00:38:27 2026 -0600
app-crypt/ssh-tpm-agent: 0.9.0 from the signed release, drop the snapshot
Build from upstream's signed v0.9.0 tarball (verify-sig, inline-signed
.gpg) instead of the master snapshot, and backport 71cf1f39:
ssh-tpm-keygen overwrote the key even when answering "n".
Go deps come from the golang-dist fork nabbi/ssh-tpm-agent, built by
GitHub CI from the tag (projg2/golang-dist-action). The snapshot's deps
URL never existed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 6da91afb9babd7960d19ab6b663b778665247111
Author: Nic Boet <nic@boet.cc>
Date: Sat Nov 7 23:54:52 2026 -0600
app-crypt/ssh-tpm-agent
Signed-off-by: Nic Boet <nic@boet.cc>
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 10:16:02 2026 -0600
app-crypt/ssh-tpm-agent: 1.0.0_rc2_p2 from the nabbi fork, drop 0.9.0-r1
Build the nabbi fork of ssh-tpm-agent instead of upstream's signed
release: upstream master (1.0.0-rc2) plus the hardening fixes that are
not upstream, tagged v<upstream version>-nabbi<N> and packaged as
<upstream version>_p<N>. The fork's CI (projg2/golang-dist-action)
builds the Go deps tarball for each tag, so the tag archive and the deps
tarball come from the same release.
The two 0.9.0 backports (keygen overwrite prompt, keygen -p swapped
passphrases) are in the fork, as are the upstream lifetime and
cache-timeout pull requests. Fork tags are not OpenPGP-signed, so
verify-sig goes.
Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
commit 6a517733a580476fca6aaf12bb974f95f8bd7d5b
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 00:46:32 2026 -0600
app-crypt/ssh-tpm-agent: fix ssh-tpm-keygen -p, 0.9.0-r1
Backport upstream PR #148 (fixes #133, not merged yet): -p passed the
old and new passphrase to ChangeAuth swapped, so changing a passphrase
failed with TPM_RC_AUTH_FAIL and each try counted towards the TPM's
dictionary-attack lockout. Drop the postinst warning about it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 43e9992d990438ae738c7f1f356c6e989f956e3b
Author: Nic Boet <nic@boet.cc>
Date: Sun Nov 8 00:38:27 2026 -0600
app-crypt/ssh-tpm-agent: 0.9.0 from the signed release, drop the snapshot
Build from upstream's signed v0.9.0 tarball (verify-sig, inline-signed
.gpg) instead of the master snapshot, and backport 71cf1f39:
ssh-tpm-keygen overwrote the key even when answering "n".
Go deps come from the golang-dist fork nabbi/ssh-tpm-agent, built by
GitHub CI from the tag (projg2/golang-dist-action). The snapshot's deps
URL never existed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 6da91afb9babd7960d19ab6b663b778665247111
Author: Nic Boet <nic@boet.cc>
Date: Sat Nov 7 23:54:52 2026 -0600
app-crypt/ssh-tpm-agent
Signed-off-by: Nic Boet <nic@boet.cc>