# yubikey-agent mit Homebrew, apk, apt, Nix installieren Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für yubikey-agent in AI-Agent-Workflows. ## Installation ```sh sudo av install brew:yubikey-agent ``` Weitere Installationsbefehle: ### macOS - Homebrew (100%): ```sh brew install yubikey-agent ``` Evidenz: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add yubikey-agent ``` Evidenz: Alpine Linux edge package indexes: yubikey-agent from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install yubikey-agent ``` Evidenz: Debian stable package indexes: yubikey-agent from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#yubikey-agent ``` Evidenz: nixpkgs package indexes: pkgs/by-name/yu/yubikey-agent/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Paketfakten - **Paketschlüssel:** brew:yubikey-agent - **Paketmanager:** Homebrew - **Version:** 0.1.6 - **Quellzusammenfassung:** Seamless ssh-agent for YubiKeys and other PIV tokens - **Homepage:** - **Repository:** - **Zuletzt aktualisiert:** 2026-07-25T21:32:50+02:00 - **Generiert:** 2026-08-03T19:37:03+00:00 ## Executables - yubikey-agent (Alias) ## Installationsverhalten - Bottle: nicht verfügbar ## Version und Aktualität - Seite generiert: 2026-08-03 - Manager-Version: 0.1.6 ## Projektgeschichte und Nutzung yubikey-agent is Filippo Valsorda’s Go ssh-agent for YubiKeys and other PIV tokens, packaged because it makes hardware-backed SSH keys feel like a normal SSH_AUTH_SOCK workflow. ### Projektgeschichte The project appeared publicly in 2020, in the same period when OpenSSH 8.2 introduced native FIDO/U2F security-key support. yubikey-agent chose a different compatibility path: use the YubiKey PIV applet to present ordinary SSH public keys through an agent interface, so existing servers did not need support for the newer `-sk` SSH key types. The README emphasizes three design goals that shaped its history: one-command setup, resilience across unplugging and sleep, and keys generated on the YubiKey so private material cannot be extracted. It is written in Go and built on go-piv/piv-go plus Go’s SSH libraries. Its documentation also candidly records the tradeoffs: keeping a persistent PIV transaction helps PIN caching and UX, but can conflict with gpg-agent, YubiKey Manager, and other tools that want the same PIV applet. ### Adoptionsgeschichte Early adoption came from security-conscious developers who wanted hardware-backed SSH without the fragility of gpg-agent, manual PKCS#11 loading, or server-side FIDO2 support. A Hacker News launch discussion in May 2020 framed it as a friendly way to plug in a key and SSH securely with minimal setup. Packaging spread through Homebrew, AUR/Arch-style packaging, NixOS modules, FreeBSD ports, Alpine testing, Debian, and Ubuntu. The README’s install instructions are package-manager first, which helped the tool become a normal service rather than a custom local build. ### Wie es verwendet wird Users install the package, start the service, run `yubikey-agent -setup` to generate a key on the YubiKey, and point `SSH_AUTH_SOCK` or per-host `IdentityAgent` settings at the agent socket. After that, SSH sees an ordinary agent while the YubiKey enforces PIN and touch policy. The tool is commonly compared with OpenSSH FIDO2 keys, gpg-agent with the OpenPGP applet, raw ssh-agent PKCS#11 loading, pivy-agent, and macOS Secure Enclave tools such as Secretive. Its niche is the compatibility and UX middle ground: hardware-backed keys with ordinary SSH public-key compatibility. ### Warum Paket-Nerds sich dafür interessieren yubikey-agent is a package-nerd favorite because it collapses a historically fiddly stack into one daemon and one socket. It is not the only hardware-backed SSH route, but it is one of the cleanest examples of wrapping smart-card behavior in a familiar Unix interface. It also tells a packaging story about defaults: Homebrew services, systemd user units, NixOS services, pcscd, and SSH_AUTH_SOCK all matter as much as the binary itself. ### Zeitleiste - 2020-02: OpenSSH 8.2 introduces built-in FIDO/U2F security-key SSH support, setting the context for hardware-backed SSH alternatives. - 2020-04: Early yubikey-agent issue traffic discusses PIV applet locking behavior with YubiKey Manager. - 2020-05-10: yubikey-agent is discussed on Hacker News as an easy Go ssh-agent for YubiKeys. - 2020-06: Go module metadata shows early v0.1.x releases such as v0.1.2 and v0.1.3. - 2020s: The package lands across Homebrew, NixOS/nixpkgs, FreeBSD ports, Arch/AUR, Debian/Ubuntu, and Alpine testing. ### Related projects - Related projects include go-piv/piv-go, yubico-piv-tool, YKCS11, OpenSSH, gpg-agent, OpenSC, pivy-agent, Secretive, SeKey, YubiKey Manager, and OpenSSH FIDO2 security-key support. ### Quellen - - - - - - - - ## Sicherheitshinweise broad file, network, media, or database tool signal. formula declares a Homebrew service. - **Geiger-Risiko:** orange / mittel - broad file, network, media, or database tool signal - formula declares a Homebrew service ## Andere Paketmanager-Einträge - Debian apt - yubikey-agent - 0.1.4-2+b19: normalized package name match | Debian stable package indexes: yubikey-agent from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | seamless ssh agent for YubiKeys | https://github.com/FiloSottile/yubikey-agent - Nix - yubikey-agent: normalized package name match | nixpkgs package indexes: pkgs/by-name/yu/yubikey-agent/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - yubikey-agent - 0.1.4-2build1: normalized package name match | Ubuntu 24.04 LTS package indexes: yubikey-agent from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | seamless ssh agent for YubiKeys | https://github.com/FiloSottile/yubikey-agent - apk - yubikey-agent - 0.1.6-r23: normalized package name match | Alpine Linux edge package indexes: yubikey-agent from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Seamless ssh-agent for YubiKeys | https://github.com/FiloSottile/yubikey-agent ## Combined YAML source View the package source record on GitHub. [combined/yubikey-agent.yml](https://github.com/mxcl/pkgdb/blob/main/combined/yubikey-agent.yml) ## Quellen - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph