I'm using vagrant for building and signing my debian/ubuntu packages but I'd prefer to not have have to copy my GPG keys into the virtual machine just to sign packages. It just feels insecure. Is there any way to forward my local gpg-agent socket so it can be used in vagrant?

I know that OpenSSH 6.7 has support for socket forwarding, but for the moment I'd prefer to not replace the OpenSSH 6.2 included with OSX 10.10, since software updates are bound to blow away any changes made to SSH installed via homebrew.

All the gpg/ssh/socat tutorials I've found depend on the deprecated GPG_AGENT_INFO. How are others using GPG on remote hosts without transferring their keys?

  • 1
    I'd guess most are using subkeys for this task, which can be easily revoked and exchanged if necessary. You could also pass a smartcard reader into the virtual machine. Software installed via homebrew should not be affected by system updates at all, as they all go into /usr/local. – Jens Erat Jun 1 '15 at 20:46
  • @Jens-erat That's a really interesting angle. Certainly worth investigating. – notpeter Jun 2 '15 at 0:29
  • 4
    Possible duplicate of How can I forward a gpg key via ssh-agent? – phs Oct 2 '16 at 22:03
  • 1
    This was useful to me. – phs Dec 5 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.