ssh-gpg-host-14ffe4 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ssh-gpg-host-14ffe4 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Host-specific constraints for SSH authentication, GPG operations, and git commit signing on the Arch Linux system "hinterland." Activates when the user mentions SSH, GPG, signing, agent, keys, git commit signing, authentication, pinentry, or ssh-agent.
This host uses a unified gpg-agent for both SSH and GPG. The standard ssh-agent is intentionally masked. SSH_AUTH_SOCK is set in three layers:
| Layer | File | Scope |
|---|---|---|
| systemd | ~/.config/environment.d/60-ssh-auth.conf | All systemd user services |
| Shell | ~/.config/bash/bashrc lines 17–20 | Interactive shells (login + non-login) |
| X session | ~/.config/X11/xinitrc lines 44–48 | X session children + dbus propagation |
The bash_profile at ~/.config/bash/bash_profile sources ~/.bashrc (shim) → ~/.config/bash/bashrc at line 85. It does not contain its own SSH exports (they were moved to bashrc).
Startx finds xinitrc via XINITRC env var set in bash_profile line 27.
ssh-agent.socket or ssh-agent.service. They areintentionally masked. Re-enabling poisons systemd user env with SSH_AUTH_SOCK=/run/user/1000/ssh-agent.socket.
SSH_AUTH_SOCK, GPG_TTY, or gpg-connect-agent exports to~/.config/bash/bash_profile. They belong in ~/.config/bash/bashrc.
GPG_AGENT_INFO anywhere. GPG 1.x relic, unused by GPG 2.x.gnome-keyring-daemon.socket. It runs without SSH component(--components=pkcs11,secrets), handling secret-storage only.
sshcontrol file at ~/.gnupg/sshcontrol withoutunderstanding keygrip registration. This file is deprecated upstream in favor of the Use-for-ssh key attribute. See man gpg-agent.
Enabled for default profile (~/.config/git/pngdeity-github.gitconfig): gpgsign = true, signingkey = 0D762ADE0E00C8DF. Work repos under ~/itp/ use nsomers2-github.gitconfig (no signing).
Git config at ~/.config/git/config uses pushInsteadOf to rewrite HTTPS URLs to SSH for push operations. SSH must be functional for git push.
Pinentry for commit signing depends on GPG_TTY and updatestartuptty set in bashrc.
| File | Role |
|---|---|
~/.config/environment.d/60-ssh-auth.conf | Systemd user env (requires daemon-reload) |
~/.config/X11/xinitrc | X session init |
~/.config/bash/bashrc | Interactive shell config (SSH exports at lines 17–20) |
~/.config/bash/bash_profile | Login shell config (no SSH exports) |
~/.gnupg/gpg-agent.conf | Agent options, cache TTLs |
~/.gnupg/sshcontrol | Registered SSH keygrips (deprecated) |
~/.config/git/config | Git profiles, URL rewrites |
~/.config/git/pngdeity-github.gitconfig | Default identity + signing |
~/.config/git/nsomers2-github.gitconfig | Work identity (no signing) |
If SSH stops working, check:
systemctl --user is-active gpg-agent.service # must be: active
ls $(gpgconf --list-dirs agent-ssh-socket) # must exist
echo $SSH_AUTH_SOCK # must match gpgconf output
ssh-add -l # must list ECDSA key
systemctl --user status ssh-agent.socket # must be: masked, inactiveIf openssh package update re-enables vendor presets:
systemctl --user mask ssh-agent.socket ssh-agent.serviceReload environment.d changes:
systemctl --user daemon-reloadFull documentation: ~/downloads/ssh-gpg-configuration.md Man pages: gpg-agent(1), gpgconf(1), environment.d(5), ssh-add(1), systemctl(1)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.