drduh / drduh/YubiKey-Guide

Proposed Update: Reliable Windows & WSL SSH Bridge (GnuPG 2.4+)

Open
#532 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
HTML
Stars
12.5k
Forks
1.3k
Avg merge
1d 4h
Merged PRs (30d)
2

Description

(Yes, I found this solution with help from an AI agent.)

## The Problem

The current guide's Windows/WSL section often leads to `invalid format` or `communication with agent failed` errors. This is usually because:

1. GnuPG and the native Windows OpenSSH Agent compete for the same named pipe.
2. WSL cannot natively "read" Windows-style socket files on the host file system.
3. Git for Windows defaults to its own bundled SSH client instead of the system-native one.

## The Solution: "The Named Pipe Bridge"

This approach uses GnuPG 2.4+ native Win32 support to emulate the Windows OpenSSH agent directly and then relays that pipe into WSL.

### Step 1: Windows Host Configuration

1. Stop Conflict: Disable the `OpenSSH Authentication Agent` service in `services.msc`.
2. Configure GPG Agent: Add the following to `%APPDATA%\gnupg\gpg-agent.conf`:
```plaintext
enable-ssh-support
enable-win32-openssh-support
```
3. Set Environment: Set a User Environment Variable `SSH_AUTH_SOCK` to `\\.\pipe\openssh-ssh-agent`.
4. Fix Git: Force Git for Windows to use the system-native SSH client:
```PowerShell
git config --global core.sshCommand "C:/Windows/System32/OpenSSH/ssh.exe"
```

### Step 2: WSL Integration (The Relay)

To allow WSL to use the Windows-hosted GPG agent simultaneously:
1. Install `socat` in WSL and download [npiperelay.exe](https://github.com/jstarks/npiperelay/releases) to a Windows folder (e.g., `C:\bin\`).
2. Add this relay script to `~/.bashrc`:
```bash
export SSH_AUTH_SOCK=$HOME/.ssh/agent.sock
if ! pgrep -f npiperelay.exe > /dev/null; then
rm -f "$SSH_AUTH_SOCK"
# Update path to your npiperelay.exe location
NPIPERELAY="/mnt/c/bin/npiperelay.exe"
(setsid socat UNIX-LISTEN:"$SSH_AUTH_SOCK",fork EXEC:"$NPIPERELAY -ei -s //./pipe/openssh-ssh-agent",nofork &) >/dev/null 2>&1
fi
```

## Benefits
* True Simultaneity: YubiKey SSH works in PowerShell and WSL at the same time.
* Hardware Stability: No need to "attach/detach" USB devices via `usbipd`.
* Format Compatibility: Eliminates "invalid format" errors by using the native Windows pipe as the source of truth.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.