add SSH key support

[flypenguin]

apparently git-age does not support the age SSH key encryption:

$ git-age add-recipient myself -k $HOME/.ssh/id_ed25519.pub
git-age: error: failed to get identities: error at line 1: unknown identity type: "ssh-ed25519 [...]"

age itself seems to support it:

$ age -h
Usage:
[...]
RECIPIENT can be an age public key generated by age-keygen ("age1...")
or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
[...]
Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
one per line, or an SSH key. [...]

this would be super helpful.

greetings! :)

[prskr]

Hey,

I'll have a look this evening, doesn't sound like much effort.

If you don't mind me saying, I would strongly recommend to use post-quantum secure keys if possible.
Post-quantum secure keys are already supported. The author of age also urges everyone to use post-quantum secure algorithms where possible.

But nevertheless, I'll have a look :)

[flypenguin]

i don't believe in post-quantum without concrete evidence i actually need it, i very much believe in the practicality of having an SSH key anyways ;) ... maybe i will be very wrong about this one day, until then practicality beats post-quantum security every time 🤣 .

do you personally create a new age key for every repo you access? i'm really curious how other people deal with this.

[prskr]

😅 well, I looked into it and...no matter whether you believe in post quantum crypto, the author of age does and he also doesn't really want SSH keys to be used with age if there are alternatives, which is why he made it quite cumbersome to use them with age as a consumer of the public API of the package. So instead of simply calling age.ParseRecipients(...) or age.ParseIdentities(...) I'd have to replace the whole parsing logic with custom code that handles all edge cases, especially the SSH keys.

Considering that SSH agent is also not supported in age, I am really wondering if that is the right way to go.

As for your question: to be honest, I am not using git-age myself anymore 😅 but I'm trying to maintain it at least a little bit so others you might have valid use cases can continue to benefit from it. But until I moved on, yes, I had one key per repository and additional keys for infrastructure services (like ArgoCD).
For some time there's a plugin API similar to the one in age to store credentials for instance in the MacOS keychain. That way I didn't have to keep the keys in the file system.
I thought about re-using the plugin API of age but that would've meant to replicate the whole 'server' code of age because it's not exported as a library and I wasn't really fond of rebuilding the custom protocol the author designed 😅

Coming back to your problem: why exactly do you prefer to use SSH keys from the file system over using age keys from the file system?