fix: re-encrypt age secrets with SSH pubkey recipient (-R not -r)

Browse Source

X25519 stanzas from ssh-to-age are incompatible with raw SSH identity.
Use age -R with SSH public key directly to produce ssh-ed25519 stanzas.
Updated AGENTS.md to document the correct process and warn against ssh-to-age.

...

This commit is contained in:

Simon Gardling

2026-03-30 19:34:56 -04:00

parent bef350e5e9

commit 519eb3a3bb

7 changed files with 5 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

secrets/ci-deploy-key.age

Binary file not shown.

BIN

secrets/coturn-auth-secret.age

Binary file not shown.

BIN

secrets/git-crypt-key-dotfiles.age

Binary file not shown.

BIN

secrets/gitea-runner-token.age

Binary file not shown.

BIN

secrets/matrix-reg-token.age

Binary file not shown.

BIN

secrets/murmur-password-env.age

Binary file not shown.