Commit ff79098f1d11

Vincent Demeester <vincent@sbr.pm>
2026-07-28 16:04:50
feat(kyushu): switch git signing to TPM key
Replaced FIDO2 resident key with TPM-sealed ecdsa key for commit signing on kyushu, matching the aomi/okinawa pattern.
main
1 parent 7d7b104
Changed files (1)
home
common
shell
git.nix
home/common/shell/git.nix
@@ -29,8 +29,8 @@ let
     "src/knative-sandbox"
   ];
   sshkeyPerHost = {
-    # FIDO2 resident key (ssh:signing) - no touch required for signing
-    kyushu = "${pkgs.writeText "yubikey5-fido2-signing" "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGF/BoGqFc5/pM40bF/2UhWzRFaDmS4hJ45VtpXjUh36AAAAC3NzaDpzaWduaW5n"}";
+    # kyushu (Fedora): TPM-sealed ecdsa key via ssh-tpm-agent (machine-bound, no touch)
+    kyushu = "${pkgs.writeText "kyushu-tpm" "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBc8oKSsUPsgbOB+yrqLpxdI3lt0ONhlHhTwbnrobSgDat5J/w0ZOsHJUPNU/O2Hyqd9l0UXz3d7rnwfN1sO0tQ= vdemeest@kyushu-tpm"}";
     # Okinawa: TPM-sealed ecdsa key via ssh-tpm-agent (machine-bound, no touch)
     okinawa = "${pkgs.writeText "okinawa-tpm" "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBODwU2/sE+S51ShfL8t+QA9IMcVuQL+VLYuENUc5VDVD4AVoVj97BggowbAhtqDW6hdc0S3XSVrZs+aOSd9ukbg= vincent@okinawa-tpm"}";
     # aomi (Fedora): TPM-sealed ecdsa key via ssh-tpm-agent (machine-bound, no touch)
@@ -47,7 +47,7 @@ let
   # List of allowed SSH signing keys for git commit verification
   allowedSigners = ''
     vincent@aomi ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGEL1A++UUsFnGmnrIR8S6A8IUFkR5WyxDPol2bs02TY0O+sWOPJFJZIAKqcWVSUIkxRoktUBMRe0mMZyiHa3jw=
-    vincent@kyushu sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGF/BoGqFc5/pM40bF/2UhWzRFaDmS4hJ45VtpXjUh36AAAAC3NzaDpzaWduaW5n
+    vincent@kyushu ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBc8oKSsUPsgbOB+yrqLpxdI3lt0ONhlHhTwbnrobSgDat5J/w0ZOsHJUPNU/O2Hyqd9l0UXz3d7rnwfN1sO0tQ=
     vincent@okinawa ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBODwU2/sE+S51ShfL8t+QA9IMcVuQL+VLYuENUc5VDVD4AVoVj97BggowbAhtqDW6hdc0S3XSVrZs+aOSd9ukbg=
   '';
 in