agent-forwarding
| Version | 2026.144.1443 |
| Repo | superproject |
Agent forwarding support — GPG, SSH, and direnv client tooling for the .secrets workflow
agent-forwarding is a pure composition candy: it installs nothing of
its own but pulls in gnupg, direnv, and ssh-client so a box can USE
host GPG and SSH agent sockets that are bind-mounted from the host at
charly shell / charly start (direct mode) runtime. The observable,
verifiable effect of the composition is that the gpg, ssh, ssh-add,
and direnv client binaries are all present in any box that composes
this candy — that is what the scenarios and check block assert.
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
check |
the GnuPG client binary is installed so a forwarded host GPG agent socket can be used for signing and decryption |
check |
the SSH client is installed so git and ssh use the forwarded host SSH agent |
check |
ssh-add is installed so the forwarded host agent’s keys can be listed |
check |
the direnv binary is installed for the .secrets/.envrc autoload workflow |
agent-check |
with a host SSH agent forwarded at runtime, ssh-add -l inside the deployment lists the host’s keys |
check |
package=gnupg |
check |
package=openssh-client |
check |
package=direnv |
check |
command=/usr/bin/gpg –version |
check |
command=/usr/bin/direnv version |