# Install tkey-ssh-agent with Homebrew, apk, apt, Nix, winget SSH agent for use with the TKey security stick. Version 1.1.1 via Homebrew; verified 2026-06-06. ## Install ```sh sudo av install brew:tkey-ssh-agent ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tkey-ssh-agent ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add tkey-ssh-agent ``` Evidence: Alpine Linux edge package indexes: tkey-ssh-agent from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install golang-github-tillitis-tkey-ssh-agent-dev ``` Evidence: Debian stable package indexes: golang-github-tillitis-tkey-ssh-agent-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#tkey-ssh-agent ``` Evidence: nixpkgs package indexes: pkgs/by-name/tk/tkey-ssh-agent/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - winget (92%): ```sh winget install --id Tillitis.TKeySSHAgent -e ``` Evidence: Windows Package Manager source index: Tillitis.TKeySSHAgent from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:tkey-ssh-agent - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.1.1 - **Source summary:** SSH agent for use with the TKey security stick - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-only - **Source archive:** - **Last updated:** 2026-06-06T11:29:14Z - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - tkey-ssh-agent (cli) - tkey-ssh-agent (alias) ## Dependencies - pinentry-mac ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Service: declared - Caveats: To use this SSH agent, set this variable in your ~/.zshrc and/or ~/.bashrc: export SSH_AUTH_SOCK="$HOMEBREW_PREFIX/var/run/tkey-ssh-agent.sock" - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.1.1 - Package-manager updated: 2026-06-06 - Local data: ok - Upstream repository: https://github.com/tillitis/tkey-ssh-agent - Upstream latest detected: v1.1.1 (current) ## Project history and usage tkey-ssh-agent is an OpenSSH-compatible agent for the Tillitis TKey USB security token. It bridges the standard SSH agent protocol with a small open hardware/software signing device. ### Project history The official README describes tkey-ssh-agent as an OpenSSH-compatible agent for use with the Tillitis TKey USB security token. The project embeds a signer device application and warns users to prefer tagged releases because changes to the signer app, user-supplied secret, or user device secret can change the resulting SSH key pair. The release notes show an early v0.0.1 phase focused on a revised SSH agent for Linux distributions, daemon operation, udev-based TKey detection, and pinentry for the user-supplied secret. Version 1.0.0 separated related apps, libraries, and packages into their own repositories, embedded the binary signer to enable go install, and added release/package builds with GoReleaser. ### Adoption history The project is aimed at TKey users who want SSH authentication without storing private keys on a general-purpose computer. Its packaging path followed both source installs and OS packages: the README mentions operating-system package systems, go install, manual pages, udev rules, and systemd units. The supplied package-manager facts show availability through Homebrew, Alpine/apk, Debian source packaging, Nix, and winget, which is unusually broad for a hardware-token-specific SSH utility. ### How it is used A typical use starts the agent on a chosen socket, optionally selects the serial port, then points SSH_AUTH_SOCK at that socket before using OpenSSH. The README also documents a public-key display mode and USS flags for user-supplied secrets. For package nerds, the interesting part is that the installed CLI is only half the artifact: udev rules, systemd service files, manual pages, embedded signer binaries, and reproducible release packages all matter for a usable install. ### Why package nerds care tkey-ssh-agent sits at the intersection of open hardware, SSH agent ergonomics, and distro packaging. Its release notes make key continuity a packaging concern because changing firmware, signer binaries, or secret handling can change the generated SSH identity. It is a useful example of a niche security package where version pinning, tagged releases, and release notes are operationally important rather than cosmetic. ### Timeline - v0.0.1: Release notes describe the revised SSH agent with daemon operation, udev detection, and pinentry support. - v1.0.0: Related apps and libraries moved to separate repositories; embedded signer enabled go install; GoReleaser package builds added. - 2026-03-24: GitHub releases page lists v1.1.1 with updated tkeyclient handling for TKey Unlocked. ### Related projects - Tillitis TKey is the hardware/software USB security token targeted by the agent. - OpenSSH is the client ecosystem consuming the SSH agent socket. - tkey-device-signer, tkeyclient, and tkeysign are related Tillitis components named in the release notes. ### Sources - - - - source_facts.package-manager for package availability ## Security Notes broad file, network, media, or database tool signal. formula declares a Homebrew service. - **Geiger risk:** orange / medium - broad file, network, media, or database tool signal - formula declares a Homebrew service ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tkey-ssh-agent - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - golang-github-tillitis-tkey-ssh-agent-dev - 1.0.0+ds-4: normalized package name match | Debian stable package indexes: golang-github-tillitis-tkey-ssh-agent-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | SSH Agent for Tillitis TKey (Go development library) | https://github.com/tillitis/tkey-ssh-agent - Debian apt - tillitis-tkey-udev - 1.0.0+ds-4: normalized package name match | Debian stable package indexes: tillitis-tkey-udev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Tillitis TKey udev rule | https://github.com/tillitis/tkey-ssh-agent - Debian apt - tkey-ssh-agent - 1.0.0+ds-4+b2: normalized package name match | Debian stable package indexes: tkey-ssh-agent from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | SSH Agent for Tillitis TKey (application) | https://github.com/tillitis/tkey-ssh-agent - Nix - tkey-ssh-agent: normalized package name match | nixpkgs package indexes: pkgs/by-name/tk/tkey-ssh-agent/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - tkey-ssh-agent - 1.1.1-r2: normalized package name match | Alpine Linux edge package indexes: tkey-ssh-agent from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH Agent for TKey, a flexible open hardware/software USB security key | https://www.tillitis.se/ - apk - tkey-ssh-agent-doc - 1.1.1-r2: normalized package name match | Alpine Linux edge package indexes: tkey-ssh-agent-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH Agent for TKey, a flexible open hardware/software USB security key (documentation) | https://www.tillitis.se/ - apk - tkey-ssh-agent-udev - 1.1.1-r2: normalized package name match | Alpine Linux edge package indexes: tkey-ssh-agent-udev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSH Agent for TKey, a flexible open hardware/software USB security key (udev rules) | https://www.tillitis.se/ - winget - Tillitis.TKeySSHAgent: normalized package name match | Windows Package Manager source index: Tillitis.TKeySSHAgent from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [pinentry-mac](https://www.automicvault.com/pkg/brew/pinentry-mac/) - Runtime dependency declared by Homebrew. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [yubikey-agent](https://www.automicvault.com/pkg/brew/yubikey-agent/) - Shares av.db curated category or tags: cli, hardware-token, security, ssh, ssh-agent. - [skm](https://www.automicvault.com/pkg/brew/skm/) - Shares av.db curated category or tags: cli, security, ssh. - [sshguard](https://www.automicvault.com/pkg/brew/sshguard/) - Shares av.db curated category or tags: cli, security, ssh. - [openssh](https://www.automicvault.com/pkg/brew/openssh/) - Shares av.db curated category or tags: cli, security, ssh. - [pam-u2f](https://www.automicvault.com/pkg/brew/pam-u2f/) - Shares av.db curated category or tags: cli, hardware-token, security. - [ssh-audit](https://www.automicvault.com/pkg/brew/ssh-audit/) - Shares av.db curated category or tags: cli, security, ssh. - [ssh-copy-id](https://www.automicvault.com/pkg/brew/ssh-copy-id/) - Shares av.db curated category or tags: cli, security, ssh. - [ssh-mitm](https://www.automicvault.com/pkg/brew/ssh-mitm/) - Shares av.db curated category or tags: cli, security, ssh. - [onlykey-agent](https://www.automicvault.com/pkg/brew/onlykey-agent/) - Security-sensitive metadata or terminology overlaps. Shared terms: agent, cli, hardware, security, ssh. ## Combined YAML source View the package source record on GitHub. [combined/tkey-ssh-agent.yml](https://github.com/automic-vault/db/blob/main/combined/tkey-ssh-agent.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph