{"id":13513036,"url":"https://github.com/santiago-mooser/yubikey-provisioning-scripts","last_synced_at":"2026-04-30T03:45:20.770Z","repository":{"id":129021434,"uuid":"525140229","full_name":"santiago-mooser/yubikey-provisioning-scripts","owner":"santiago-mooser","description":"A set of scripts to automate the provisioning of yubikey's openPGP applet.They set up your yubikey for git commit signing and SSH so you don't have to!","archived":false,"fork":false,"pushed_at":"2024-11-01T02:42:48.000Z","size":77,"stargazers_count":58,"open_issues_count":0,"forks_count":9,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-11-01T03:24:27.695Z","etag":null,"topics":["automation","gpg","linux","macos","openpgp","shell-script","yubikey","yubikeys"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/santiago-mooser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-15T21:11:06.000Z","updated_at":"2024-11-01T02:42:52.000Z","dependencies_parsed_at":"2024-11-01T03:22:17.103Z","dependency_job_id":"3a0228b0-286a-426b-bde9-aab5e896b5a1","html_url":"https://github.com/santiago-mooser/yubikey-provisioning-scripts","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santiago-mooser%2Fyubikey-provisioning-scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santiago-mooser%2Fyubikey-provisioning-scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santiago-mooser%2Fyubikey-provisioning-scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santiago-mooser%2Fyubikey-provisioning-scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/santiago-mooser","download_url":"https://codeload.github.com/santiago-mooser/yubikey-provisioning-scripts/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246399816,"owners_count":20770907,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["automation","gpg","linux","macos","openpgp","shell-script","yubikey","yubikeys"],"created_at":"2024-08-01T04:00:36.732Z","updated_at":"2026-04-30T03:45:20.699Z","avatar_url":"https://github.com/santiago-mooser.png","language":"Shell","funding_links":[],"categories":["Tools"],"sub_categories":["Third-party Tools"],"readme":"\n# Yubikey provisioning scripts\n\nThe scripts found in this repo help automate the provisioning of a yubikey's OpenPGP applet. It essentially automates the instructions found in @drduh 's repository to provision a yubikey's OpenPGP applet: https://github.com/drduh/YubiKey-Guide\n\n## Table of contents\n\n- [Yubikey provisioning scripts](#yubikey-provisioning-scripts)\n  - [Table of contents](#table-of-contents)\n  - [Usage](#usage)\n  - [Individual scripts](#individual-scripts)\n  - [Using the scripts](#using-the-scripts)\n  - [Assumptions about the scripts](#assumptions-about-the-scripts)\n  - [Compatibility](#compatibility)\n  - [Futher documentation on scripts](#futher-documentation-on-scripts)\n  - [Authors](#authors)\n\n## Usage\n\nThe simplest way to use these scripts is to simply clone the repo and run the main [yubikey_provision.sh](./yubikey_provision.sh) script:\n\n```bash\ngit clone https://github.com/santiago-mooser/yubikey-provisioning-scripts.git\ncd yubikey-provisioning-scripts\n./yubikey_provision.sh -h\n   This script provisions a yubikey by generating a master key, 3 subkeys and moving the subkeys to the yubikey. Please read the documentation for more information.\n\n   Usage: yubikey_provision.sh [-e|--email EMAIL_ADDRESS] [-u|--user-pin USER_PIN] [-a|--admin-pin ADMIN_PIN] [-y|--yes]\n\n   optional arguments:\n     -h, --help           show this help message and exit.\n     -e, --email          provide email used for PGP key. If it is not provided, the user is prompted for an email.\n     -f, --first-name     provide first name used for PGP key. Defaults to an empty string.\n     -l, --last-name      provide last name used for PGP key. Defaults to an empty string.\n     -c, --comment        provide comment used for PGP key. Defaults to an empty string.\n         --username       provide username used for PGP key. Defaults to an empty string.\n     -p, --password       provide password used for PGP key. If it is not provided, a random one is generated.\n     -u, --user-pin       provide new user pin for the yubikey. If none is provided, a random one is generated.\n     -a, --admin-pin      provide new admin pin for the yubikey. If none is provided, a random one is generated.\n     -y, --yes            skips prompts to reset the yubikey.\n     -v, --version        prints out the version number.\n```\n\nThis script will help you run all of the other helper scripts in the right order and with the right flags to create a new private key, subkeys, reset the openPGP applet of the connected yubikey and upload the subkeys to the yubikey.\n\n⚠️⚠️**WARNING**⚠️⚠️\n\nThe script will also **upload your public key** to openPGP's public key server! Please disable this in the script if this is not what you want.\n\n⚠️⚠️**WARNING**⚠️⚠️\n\nTo understand how the scripts work, I recommend reading through the various scripts found in the [helper scripts folder](./helper_scripts/). All of the code is commented so if you're familiar with Shell scripts, it shouldn't be too hard to understand what they all do.\n\n## Individual scripts\n\nThe [helper scripts folder](./helper_scripts/) holds the various scripts used by the main script to provision yubikeys. The scripts do the following tings:\n\n1. [reset_smartcard.sh](./helper_scripts/reset_smartcard.sh): Reset the connected yubikey's OpenPGP applet.\n2. [gen_key.sh](./helper_scripts/gen_key.sh): Create a master PGP key.\n3. [subkey_gen.sh](./helper_scripts/subkey_gen.sh): Create three PGP subkeys (One each for Encryption, Authentication and Signing).\n4. [key_to_card.sh](./helper_scripts/key_to_card.sh): Move PGP subkeys to smartcard (private keys are not kept! they are *moved*).\n5. [yubikey_change_pin.sh](./helper_scripts/yubikey_change_attributes.sh): Change the attributes of the connected yubikey (name, comment, url, etc...).\n\nThe [yubikey_provision.sh](./yubikey_provision.sh) script will fully provision a yubikey by running all the above scripts in the given order.\n\n## Using the scripts\n\n⚠️⚠️**WARNING**⚠️⚠️\n\nThe private key of the yubikey is **not** exported. If you would like to export your private keys, please uncomment the lines 363-365 of the [yubikey_provision.sh script](yubikey_provision.sh#L362)\n\nAlternatively, to reprovision new subkeys, please create new subkeys as per [this official yubikey guide](https://github.com/drduh/YubiKey-Guide#sub-keys), but select option `14` and continue with the rest of the guide (including moving the subkeys to the yubikey):\n\n⚠️⚠️**WARNING**⚠️⚠️\n\n```bash\n[...]\ngpg\u003e addkey\nSecret parts of primary key are stored on-card.\nPlease select what kind of key you want:\n   (3) DSA (sign only)\n   (4) RSA (sign only)\n   (5) Elgamal (encrypt only)\n   (6) RSA (encrypt only)\n  (14) Existing key from card\nYour selection?\n[...]\n```\n\n## Assumptions about the scripts\n\n1. All scripts\n   1. The utility `expect` is installed and available in PATH.\n   2. The `gpg` commandline utility is installed and available in PATH (for MacOS the GnuPG suite needs to be installed).\n   3. The `scdaemon` utility is installed (Ubuntu only) OR GnuPG suite is installed (MacOS)\n\n## Compatibility\n\nThis script has been tested with MacOS Monetrrey and Ventura and Ubutuntu 20.04 LTS onwards. It will likely work with earlier versions, but it's not a guarantee.\n\n## Futher documentation on scripts\n\nSome extra documentation can be found in the [docs/ folder](./docs/).\n\n1. [docs/yubikey_provision.md](./docs/yubikey_provision.md)\n\n## Authors\n\nSantiago Espinosa Mooser - (yps@santiago-mooser.com)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsantiago-mooser%2Fyubikey-provisioning-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsantiago-mooser%2Fyubikey-provisioning-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsantiago-mooser%2Fyubikey-provisioning-scripts/lists"}