fix(yubikey): polish enrollment UX — no duplicate footer, useful title, auto-load via SSH config#298
Merged
Merged
Conversation
…, auto-load via SSH config)
Three follow-ups from real macOS dogfooding after enrolling on a fresh
FIPS YubiKey:
1. Suppress yk-ssh-new's 'Next steps' footer when wrapped by yk-enroll.
Output was duplicated: yk-ssh-new printed its own 'Next steps' block,
then yk-enroll printed its 'Done. Next steps for serial' block. New
--no-summary flag on yk-ssh-new lets yk-enroll own the summary.
2. Drop the unhelpful 'host-yk-serial' default title; use device type.
Suggested title is now 'YubiKey 5C NFC FIPS @ Jean-Pauls-Mini' instead
of '<host>-yk-<serial>'. The wizard already knows device_type from
step 2, so use it. Bare yk-ssh-new (without yk-enroll) just shows
'<descriptive title>' as a placeholder.
3. Auto-discover per-serial keys in ~/.ssh/config so ssh-add is unneeded.
~/.ssh/config already has 'AddKeysToAgent yes', so once SSH tries an
IdentityFile the key auto-loads to the agent. The template only
listed id_ed25519_sk (no suffix) though — yk-enroll's per-serial
files (id_ed25519_sk_<serial>) weren't discovered, so the user had
to run ssh-add manually. The template now uses chezmoi's glob
function to enumerate every id_{ed25519,ecdsa}_sk* file and emit an
IdentityFile line for each. yk-enroll's Done block tells users to
re-run 'chezmoi apply' once after enrolling so the glob picks up the
new key.
Tests: 24 cases green (1 new). yk-ssh-new gains a --no-summary test.
yk-enroll's happy-path test now also asserts the device-type-based
title, the absence of yk-ssh-new's 'Next steps:' footer, and the
presence of yk-enroll's 'Done. Next steps for serial' block.
This was referenced May 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three follow-ups from real macOS dogfooding after enrolling on a fresh FIPS YubiKey.
1. Stop printing two "Next steps" blocks
The wizard wraps
yk-ssh-new, butyk-ssh-newwas unconditionally printing its ownNext steps:footer. Result: every successful enrollment ended with bothNext steps:(fromyk-ssh-new) andDone. Next steps for serial …(fromyk-enroll).Fix: new
--no-summaryflag onyk-ssh-new.yk-enrollpasses it. Bareyk-ssh-newinvocations still get the footer.2. Use the device type in the suggested GitHub title
Old:
gh ssh-key add … --title "Jean-Pauls-Mini-yk-35984479"→ user immediately replaced it with"YubiKey 5C NFC FIPS Keyring".New:
gh ssh-key add … --title "YubiKey 5C NFC FIPS @ Jean-Pauls-Mini"—yk-enrollalready knowsdevice_typefrom step 2, so it just uses it. Bareyk-ssh-new(no wizard) shows<descriptive title>as a placeholder.3. Auto-load the key via
~/.ssh/config(no manualssh-add)~/.ssh/configalready hasAddKeysToAgent yes, so once SSH tries anIdentityFilethe key gets added to the agent automatically. But the template only emittedIdentityFile ~/.ssh/id_ed25519_sk(no suffix) —yk-enroll's per-serial files (id_ed25519_sk_<serial>) were invisible to SSH, so the user had tossh-addmanually.Now
home/private_dot_ssh/config.tmpluses chezmoi'sglobtemplate function to enumerate everyid_{ed25519,ecdsa}_sk*file in~/.ssh/and emits anIdentityFileline for each.yk-enroll'sDone.block tells users to re-runchezmoi applyonce after enrolling so the glob picks up the new key, and that step 2 is justssh -T git@github.comrather than a manualssh-add.Verify
24/24 green. New assertions:
yk-ssh-new: --no-summary suppresses Next steps footeryk-enroll: full happy pathnow asserts (a) the device-type-based title appears, (b)yk-ssh-new'sNext steps:is absent, (c)yk-enroll'sDone. Next steps for serialis presentFiles
home/dot_config/shell/functions/yk-ssh-new.sh—--no-summary, friendlier footerhome/dot_config/fish/functions/yk_ssh_new.fish— samehome/dot_config/shell/functions/yk-enroll.sh— passes--no-summary, device-type title,chezmoi applyreminderhome/dot_config/fish/functions/yk_enroll.fish— samehome/private_dot_ssh/config.tmpl—globforid_*_sk_*filestests/bash/yk-enroll.bats+tests/bash/yk-ssh-new.bats— assertions added