Using GPG with a YubiKey

L: I wrote a new post here, amending some of the things here, but uh, do still read this post for reference (as in, read both posts before you create or modify a key or any config files)Update: This post explains how ya can get the public key from the smartcard, no need for storing a temporary fileUpdate: Added a warning in the commands list to edit key before putting it on the card, updated backup stuff, fixed some commandUpdate: zshrc changes

While PGP has some issues, it is currently the only viable solution for Git commit signing (there is some work being done on signing commits with Minisign, its level of integration is nowhere near that of GPG). Due to that, I recently read this guide, which seemed quite nice at first, given I have a YubiKey. However, I found some issues with it ‒ the actual Git commit signing, as well as, later on when I tried that as well, the SSH key authentication, would not work.

T.: Now, you could go on trying to explain the amendments you made to the instructions in the original guide, or you just put a nicely commented script and some config files in here.
fc17: I could, but…
T.: But what? You'd even have the advantage of this information staying relevant even if the linked blog post goes down.
L: Are you going to argue all day?
T.: No, lmao. So, dear reader of this post, here's that script I (editor's note: we (T.'s note on editor's note: nobody allowed you to write stuff into what I say, F., and this is little more than a shameless plug of the fact you contributed a bit to the script as well)) wrote:

# Don't actually run this as a script# Assumes you're on macOS and have `brew` aliased to a sudo command that switches you to the separate user you use for Homebrew# Install some stuffbrew 'brew install gpg ykman'# Upgrade from 2fa lite to actual 2fa (you will now be required to touch it every time you perform an operation (after entering the passphrase))ykman openpgp keys set-touch enc onykman openpgp keys set-touch sig onykman openpgp keys set-touch aut on# switch to a temporary directory for our next actionscd $(mktemp -d)# keygengpg --expert --full-gen-key # RSA is lame; use ECC with curve25519# Now copy the key ID you get somewhere towards the end into your clipboardexport KEYID="paste clipboard here"# Generate subkeysgpg --expert --edit-key ${KEYID}# addkey three times, one for encrypting, authentication (use the one where you set your own caps, disable signing, and enable auth) and signing each, use ECC and curve25519 again# now quit with `quit`# Generate a backupgpg --armor --export-secret-keys ${KEYID} > mastersub.key# Put this somewhere, make a paper backup, maybe with a QR code, Idc# Get your public key and put it somewhere nicegpg --armor --export ${KEYID} > /somewhere/nice/myusername.asc# Set your YK smartcard up (defaults are 123456 and 12345678)gpg --card-edit# Now admin, then passwd, also don't make this a literal PIN, use an actual passphrase from your password manager or something# maybe also name, lang and login# Now quit with `quit`# The exciting part# DO ANNOTATIONS AND STUFF BEFORE THIS! YOU WON'T BE ABLE TO EDIT YOUR KEY AFTERWARDS! (Ya need those for Keyoxide)gpg --edit-key ${KEYID}# key 1, keytocard, key 1, key 2, keytocard, key 2, key 3, keytocard, save# Set up Gitgit config --global user.signingkey ${KEYID}git config --global commit.gpgsign true# On other machines, after transferring the public key overgpg --import /somewhere/nice/myusername.asc# Add stuff to the config files as shown below# Initialize stuff. ~/.zshrc# Keep your public SSH key in a nice placessh-add -L > ~/.ssh/yubikey.pub# Make WKD (sauce: https://www.kuketz-blog.de/gnupg-web-key-directory-wkd-einrichten/)mkdir -p .well-known/openpgpkey/yourdomain.xyz/hutouch .well-known/openpgpkey/yourdomain.xyz/policygpg --with-wkd-hash --fingerprint ${KEYID} # Copy the hash before the @yourdomain.xyzgpg --no-armor --export ${KEYID} > .well-known/openpgpkey/yourdomain.xyz/hu/yourclipboardhere# Now put the .well-known into / of openpgpkey.yourdomain.xyz

~/.gnupg/gnupg-agent.conf

use-standard-socketenable-ssh-support

~/.zshrc

gpgconf --kill gpg-agentgpg --card-status > /dev/nullgpg-connect-agent updatestartuptty /bye > /dev/nullexport "SSH_AUTH_SOCK=/Users/artemis/.gnupg/S.gpg-agent.ssh"alias git-commit='gpg --sign "$(mktemp)" && git commit' # makes Git commit signing work properly