From 5fa37b6b395981799924ecf0e432e45998169225 Mon Sep 17 00:00:00 2001 From: Gab Virebent Date: Mon, 13 Jul 2026 00:40:19 +0200 Subject: Add CLI-first yubicrypt build --- README.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 4 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index f554d81..fc98d94 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -# yubicrypt - -An easy to use public key encryption program for your YubiKey. +# yubicrypt + +An easy to use command-line public key encryption program for your YubiKey. Supported YubiKey algorithms: @@ -33,7 +33,50 @@ sudo systemctl enable pcscd Check the status to ensure it's running sudo systemctl status pcscd -![yubicrypt](img/1.png) +## CLI usage + +Build the CLI: + +```sh +go build -o yubicrypt . +``` + +Commands: + +```sh +./yubicrypt help +./yubicrypt cards +./yubicrypt encrypt --key alice.crt -i msg.txt -o msg.yc +printf '%s\n' "$PIV_PIN" | ./yubicrypt decrypt --pin-stdin -i msg.yc -o msg.txt +printf '%s\n' "$PIV_PIN" | ./yubicrypt sign --pin-stdin -i msg.txt -o msg.sig.txt +./yubicrypt verify -i msg.sig.txt --public-key +./yubicrypt pad --text "message" -o padded.txt +./yubicrypt unpad -i padded.txt -o message.txt +``` + +PIN options for `decrypt` and `sign`: + +- `--pin-stdin`: read the PIV PIN from the first stdin line. +- `--pin-file FILE`: read the PIV PIN from the first line of a file. +- `--pin PIN`: pass the PIV PIN directly. This is less safe because it can leak through shell history or process listings. +- `--card-index N`: select the YubiKey index shown by `./yubicrypt cards`. The default is `0`. + +Common IO options: + +- `-i, --input FILE`: input file, or `-` for stdin. +- `-o, --output FILE`: output file, or `-` for stdout. +- `--text TEXT`: use literal text instead of reading input. +- `--quiet`: suppress status output on stderr. + +## GUI build + +The old Fyne GUI is still available as an explicit build target: + +```sh +go build -tags gui -o yubicrypt-gui . +``` + +![yubicrypt](img/1.png) The copy signature component is intended for usage of my [identicons](https://github.com/Ch1ffr3punk/identicons) program, so that you can create your yubicrypt identicon for websites etc. -- cgit v1.2.3