Hardware Keys Without GnuPG: The Rust OpenPGP Card Stack, Now in FreeBSD Ports

I have kept my SSH and signing keys on hardware for years. The private key lives on an OpenPGP card or a Nitrokey, it never touches the disk, and a stolen laptop is a stolen laptop rather than a stolen identity. What changed over the last year is the software I use to talk to those cards. For SSH authentication and Git signing I no longer go through GnuPG at all. I use three small Rust programs from the OpenPGP Card project instead. I use them daily on Fedora and on my FreeBSD T480. On FreeBSD I had been running them from ~/.cargo/bin, which works but is not how software should arrive on a FreeBSD machine. So I wrote ports for them, and all three have now been committed to the FreeBSD ports tree: Port Binary Job Upstream security/openpgp-card-tools oct Inspect and administer cards openpgp-card-tools security/openpgp-card-tools-git oct-git Sign and verify Git commits and tags oct-git security/openpgp-card-ssh-agent openpgp-card-ssh-agent SSH agent backed by the card’s authentication…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town