Introduce age plugin for managing encryption and decryption keys.

[jmsnll]

Overview

Adds a new plugin for the age command-line tool to securely handle encryption and decryption credentials with 1Password CLI. Currently supports asymmetric encryption with the same public/private key pair. Users can manually specify multiple recipients as they usually would.

There is no standard location or placement of age identity files so I have not written an importer.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• Relates: Add support for Prepending args in the File Provisioner #508
• Closes: New plugin: Age #510

How To Test

1. Generate a key pair

Use age-keygen to create a public and private key pair. Store these keys in a new credential in 1Password:

• Add a field named private_key to store the private key
• Add a field named public_key to store the public key

Example output from age-keygen

$ age-keygen | tee age.txt
# created: 2025-01-16T00:00:00+01:00
# public key: age109acfr42tp05673rnpzngnuc48p08pma83r5a78kunn63m3hh45EXAMPLE
AGE-SECRET-KEY-1CR6CWDH03049DHY0ZPG9QNNRT39AHP96Q633LQQGEUPS9A0PYVGEXAMPLE

2. Initialise the plugin

Run the following command and select the credential you created:

op plugin init age

The 1Password CLI will now automatically populate the -i/--identity and -R/--recipients flags for encryption and decryption.

3. Using Age with the plugin

Use the age plugin to encrypt a file:

age -o encrypted.txt plaintext.txt

Decrypt the encrypted file:

age -d -o unencrypted.txt encrypted.txt

4. Using Age without plugin

Use the age plugin to encrypt a file:

age -r age109acfr42tp05673rnpzngnuc48p08pma83r5a78kunn63m3hh45EXAMPLE -o encrypted.txt plaintext.txt

Decrypt the encrypted file:

age -d -i age.txt -o unencrypted.txt encrypted.txt

Changelog

Add age plugin for secure key management, auto-populating stored identity and recipients for encryption and decryption.

[NeckBeardPrince]

+1