search

tillitis / tkey-ssh-agent

SSH Agent for TKey, the flexible open hardware/software USB security key 🔑
https://www.tillitis.se
BSD 2-Clause "Simplified" License
131 stars 15 forks source link

Add option to load alternative device app #125

Open jas4711 opened 4 days ago

jas4711 commented 4 days ago

Hi.

Currently the device app is embedded into tkey-ssh-agent. If the device app ever changes, that invalidate older private keys. Users may want to upgrade the tkey-ssh-agent software due to some bug and stay on latest version, which may bump the device app version eventually. Users may also want to use it with earlier version of the device app, or a custom app (such as your upstream-built device app instead of Debian's build).

Would you be open to adding a --device-signer-app /path/to/device-signer-1.0.42.app parameter that would make tkey-ssh-agent use the content of that file instead of the embedded version? Then one can have multiple latest tkey-ssh-agent running each with different device apps.

A separate issue would be to stop embedding the device app, and require the --device-signer-app parameter. How do you feel about that? That would allow the tkey-ssh-agent package in Debian to replace the Build-Depends: on tillitis-tkey-device-signer with a Depends:. This allows the tkey-ssh-agent binary to stay identical and reproducible and untangle it from the device app.

/Simon