Kernel Seeds { News/Updates }

Keychain 3.0.0_beta3 is now available, offering improved agent socket protection, better support for hardware-backed SSH keys, and continued tightening of the built-in documentation.

Stable agent sockets

The most notable change in 3.0.0_beta3 is related to robustness: Keychain now does a much better job protecting its managed ssh-agent socket.

Keychain now keeps its managed ssh-agent socket in a stable location under ~/.keychain/ instead of depending on the temporary /tmp/ssh-* socket directories created by ssh-agent.

This matters because temporary socket directories can disappear while the agent process itself is still alive. We saw this happen under WSL restarts, but the issue isn't necessarily just WSL-specific. For Keychain's long-running-agent model, the new default location is superior to ssh-agent's /tmp default.

PKCS#11-backed SSH keys

Keychain 3.0.0_beta3 now adds direct support for PKCS#11-backed SSH tokens, requested in issue #216. This allows Keychain to work more naturally with SSH keys stored on smartcards, security keys, and similar hardware-backed devices. Use as follows:

$ keychain add pkcs11:/path/to/provider.so

Keychain then asks OpenSSH to enumerate the provider's public keys, compares them with identities already held by the running agent, and loads the provider when needed.

Documentation and config cleanup

Keychain 3 has an ambitious new integrated documentation system, which was in a state of flux. With 3.0.0_beta3, the rendering, structure, tags, and overall completeness have been tightened up considerably, and the integrated docs are now very close to release-quality.

keychain man now has better formatting, pager support, and more complete coverage of .keychainrc settings (issue #217). Several issues have been fixed that caused certain config settings to not appear in the documentation.

You can view a full Keychain manual, now with included pager support, with:

$ keychain man

Which will now render a nicely formatted and colored manual, and fire up your favorite pager:

keychain man --list shows you available documentation tags, and also serves as a structured index of the full man page:

$ keychain man --list

To specifically reference a key or topic, you can reference the doc-tag directly:

$ keychain man config:agent.env.ssh_args
$ keychain man topic:coordination

Install or update

Download the .pyz artifact from GitHub:

github.com/danielrobbins/keychain/releases/tag/3.0.0_beta3

Run it directly:

$ chmod +x keychain-3.0.0_beta3.pyz
$ ./keychain-3.0.0_beta3.pyz --version
Keychain 3.0.0_beta3

Or install it as keychain:

$ sudo cp keychain-3.0.0_beta3.pyz /usr/local/bin/keychain
$ sudo chmod 755 /usr/local/bin/keychain
$ keychain inspect

The next release of Keychain will very likely be 3.0.0, so now is your opportunity to test the (probably) final beta before its initial non-beta release! Please report issues here:

github.com/danielrobbins/keychain/issues

Thanks!