touchid-agent v0.9.2

touchid-agent v0.9.2

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.9.1

• deps: bump golang.org/x/{crypto,term,sys} to latest patch (#43)
• Merge pull request #39 from ignaciojimenez/fix/checkout-persist-credentials
• fix(ci): stop persisting GITHUB_TOKEN in read-only checkouts
• Merge pull request #38 from ignaciojimenez/fix/aikido-security-sast-106533960-5xgc
• fix(security): autofix Overly Broad Permissions in GitHub Actions Workflows is risky
• Merge pull request #37 from ignaciojimenez/chore/repo-cleanup
• build: unpin stale govulncheck and always install the pinned version
• Merge #33: bump actions/setup-go from 6 to 7
• Merge #29: bump actions/checkout from 6 to 7
• Merge pull request #36 from ignaciojimenez/docs/release-clarify-fallback
• Merge pull request #34 from ignaciojimenez/dependabot/go_modules/golang.org/x/crypto-0.55.0
• docs: warn that the manual release path duplicates CI
• deps: bump golang.org/x/crypto from 0.53.0 to 0.55.0
• ci: bump actions/setup-go from 6 to 7
• ci: bump actions/checkout from 6 to 7

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.9.1

touchid-agent v0.9.1

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.9.0

• Merge pull request #35 from ignaciojimenez/fix/serialize-biometric-operations
• fix: serialize Touch ID prompts across keys; classify real CryptoKit errors
• Merge pull request #28 from ignaciojimenez/fix/homebrew-deprecated-depends-on
• fix(brew): drop deprecated depends_on macos: DSL from formula template
• Merge pull request #27 from ignaciojimenez/docs/todo-v0.9.0
• docs: mark #19 Phase 1 done (v0.9.0) in TODO

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.9.0

touchid-agent v0.9.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.8.0

• Merge pull request #26 from ignaciojimenez/feat/audit-hash-chain
• feat: tamper-evident audit log hash chain + -verify-audit (#19 Phase 1)
• Merge pull request #25 from ignaciojimenez/docs/review-and-consistency
• docs: currency pass + consistent threat-model taxonomy

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.8.0

touchid-agent v0.8.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.7.0

• Merge pull request #24 from ignaciojimenez/feat/per-key-caller-binding
• feat: per-key caller binding (#20)
• Merge pull request #23 from ignaciojimenez/feat/require-hardened-callers
• feat: optional hardened-runtime requirement for callers (#17 Phase 3)
• Merge pull request #22 from ignaciojimenez/feat/caller-identity-rules
• feat: identity-based caller verification rules (#17 Phase 2)
• Merge pull request #21 from ignaciojimenez/feat/caller-codesign-identity
• feat: resolve caller code-signing identity via audit token (#17 Phase 1)

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.7.0

touchid-agent v0.7.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.6.0

• Merge pull request #18 from ignaciojimenez/feat/default-audit-log
• feat: default audit logging to ~/Library/Logs/touchid-agent-audit.log
• Merge pull request #16 from ignaciojimenez/feat/peer-check-default
• feat: enable peer verification by default (opt-out via -no-peer-check)

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.6.0

touchid-agent v0.6.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.5.0

• Merge pull request #14 from ignaciojimenez/dependabot/go_modules/golang.org/x/crypto-0.53.0
• Merge pull request #8 from ncode/juliano/harden-signing-policy-controls
• deps: bump golang.org/x/crypto from 0.52.0 to 0.53.0
• docs: align peer-check wording with signing-request enforcement
• fix: harden signing controls against keyfile metadata tampering
• Merge pull request #12 from ignaciojimenez/dependabot/go_modules/golang.org/x/sys-0.45.0
• deps: bump golang.org/x/sys from 0.45.0 to 0.46.0
• Merge pull request #13 from ignaciojimenez/dependabot/go_modules/golang.org/x/crypto-0.52.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/crypto-0.52.0
• Merge pull request #11 from ignaciojimenez/dependabot/github_actions/actions/upload-artifact-7
• deps: bump golang.org/x/crypto from 0.51.0 to 0.52.0
• ci: bump actions/upload-artifact from 4 to 7

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.5.0

touchid-agent v0.5.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.4.0

• fix: unblock go vet on managed_darwin null check
• fix: ship allowed_callers in mobileconfig + verify payload at release
• test: add verify-managed-prefs.sh for Track #2 §3 validation
• feat: managed preferences read path + mobileconfig profile (Track #2 §3)
• docs: reposition README around fleet/security differentiation
• docs: mark Track #2 partial, queue config-profile + deployment doc

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.4.0

touchid-agent v0.4.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.3.0

• fix: codesign -dvv for Developer ID detection in build-pkg.sh
• ci: add workflow_dispatch for release.yml dry-runs
• feat: signed .pkg installer for fleet deployment
• Part of this is implemented now as part of the laucnhd deployment feature
• Simplifying documentation
• New todos
• Added new TODOs
• docs: distribution & deployment roadmap
• Removed impossible and irrelevant TODO

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.3.0

touchid-agent v0.3.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.2.0

• Merge pull request #7 from ignaciojimenez/feat/plist-self-management
• Merge branch 'main' into feat/plist-self-management
• Merge pull request #5 from ignaciojimenez/dependabot/go_modules/golang.org/x/crypto-0.51.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/crypto-0.51.0
• Merge pull request #6 from ignaciojimenez/dependabot/go_modules/golang.org/x/term-0.43.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/term-0.43.0
• Merge pull request #4 from ignaciojimenez/dependabot/go_modules/golang.org/x/sys-0.44.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/sys-0.44.0
• Merge pull request #3 from ignaciojimenez/dependabot/github_actions/actions/setup-go-6
• Merge branch 'main' into dependabot/go_modules/golang.org/x/sys-0.44.0
• Merge branch 'main' into dependabot/github_actions/actions/setup-go-6
• Merge pull request #2 from ignaciojimenez/dependabot/github_actions/actions/checkout-6
• Merge branch 'main' into dependabot/go_modules/golang.org/x/term-0.43.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/crypto-0.51.0
• Merge branch 'main' into dependabot/go_modules/golang.org/x/sys-0.44.0
• Merge branch 'main' into dependabot/github_actions/actions/setup-go-6
• Merge branch 'main' into dependabot/github_actions/actions/checkout-6
• feat: -install-plist and -migrate-plist subcommands
• deps: bump golang.org/x/crypto from 0.45.0 to 0.51.0
• deps: bump golang.org/x/term from 0.37.0 to 0.43.0
• deps: bump golang.org/x/sys from 0.38.0 to 0.44.0
• ci: bump actions/setup-go from 5 to 6
• ci: bump actions/checkout from 4 to 6

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.

touchid-agent v0.2.0

touchid-agent v0.2.0

macOS SSH agent backed by the Secure Enclave and Touch ID. Drop-in
replacement for yubikey-agent.

Changes since v0.1.4

• docs: update TODO with remaining improvement items
• feat: -status command, testable notifications, graceful shutdown
• feat: -status command, testable notifications, keystore lifecycle test
• feat: delete cleans up pub key files, -list -json, -delete-all confirmation
• Minor clarification
• feat: add launchd socket activation (-launchd flag)
• Use and update latest versions of go
• Make use cases generic and not tied to ssh or git operations and clarify in all docs
• test: expand hook coverage with env, path, and contrib integration tests
• ci: add staticcheck and Dependabot; fix lint issues
• Docs cleanup: deduplicate, trim, add hook threat analysis

Verifying this release

```
shasum -a 256 -c touchid-agent-VERSION-darwin-universal.tar.gz.sha256
```

The binary is signed with a Developer ID certificate and notarized by Apple.
Gatekeeper validates the notarization ticket online on first launch (flat
Mach-O CLI binaries cannot be stapled).

Installing

```
tar -xzf touchid-agent-VERSION-darwin-universal.tar.gz
sudo install -m 755 touchid-agent /usr/local/bin/
```

See README.md for SSH config and launchd setup.