Would it be possible to add similar support for GPG keys?

I'm still super interested in this because I'd like to be able to more natively use 1password as the central hub to store keys used to sign published artifacts generated in CI. It'd be super-handy if I could easily generate a new signing subkey and revoke one which was compromised when a CI system's cloud provider gets hacked again, all without having to change a thing about the ci logic. Bonus points for also auto-publishing to one or more keyservers on-change. For one example. Right now I have to locally export a key, import that into 1password as a text field, then have automation fetch the armored key before importing it into a local agent, etc. It's kind of a convoluted process compared to something like telling a package signing process to just use a local key agent which can just speak to 1password connect -- for another example. :) Git commit signing is technically on the list, but more of a side effect to me personally.

Big +1 SSH commit signing is fine until you need to rotate keys. Revoking a GPG key will continue to show commits in GitHub (unsure about GitLab) as "verified (expired)". The only way I've found to do the same with SSH keys is to remove the old key completely, but then commits show as "unverified" which defeats the point of supply chain integrity since it's not possible to distinguish a commit that was signed with an old key, or a commit that was not signed, or signed with another key that's not allowed. The alternative is to not rotate signing keys, but then you compromise supply chain integrity further by not ensuring keys are rotated in a timely fashion.

Just to throw my opinion into the mix: SSH keys cannot be substituted for PGP keys in all cases. A PGP key is closer to a digital certificate than it is to an SSH key; whereas an SSH key is really just a raw public key with a tiny amount of metadata attached, a PGP key can and generally does contain a wealth of additional metadata, and is also used for a much wider variety of purposes, like certifying other public keys or containing attached subkeys. In concrete terms, an SSH key cannot be substituted for a PGP key for many use cases, like E2E encrypted email, YubiKey, cryptocurrency wallets etc. If 1Password were to support a GnuPG authentication agent, it would make storing private keys in a centralized location easier and more secure, and the process of performing common PGP-related tasks more transparent. While GnuPG is pretty widely supported nowadays, and there is a wide variety of FOSS out there for managing keys, having my PGP keys stored in 1Password would make life a little easier. It's a small quality-of-life improvement, but not really a significant ask from me personally. I use 1Password because it has the best user experience and broadest compatibility of all of the password managers I've tried, and I intend to keep using it regardless of whether or not PGP keys are supported.

IMO, GPG is a fairly complex standard that sees use in many many ways. Adding support for all of these myriad ways into 1Password maybe reinventing the wheel because GPG already has a large number of tools available. And these tools are quite modern in their implementation (but often not in their UI/UX). At the same time, I do want to be able to store my GPG keys in 1Password. After all, what I am paying for is having to remember just "one password".

Thanks for sharing your interest svish I appreciate it. I've let the team know this would be a valuable addition to your toolkit. PB-47362504

GPG support? (like SSH) | 1Password Community

86 Replies

XIII
Super Contributor
3 years ago
Now that GitHub supports signing commits via SSH (and 1Password supports that too!) I no longer need GPG support...
Former Member
3 years ago
Would love to see this feature added. I can think of several use cases:
1. Restoring keys (ssh/gpg) for developers when transitioning new laptops/workstations, etc.
2. This gets around the issue that now GitLab is experiencing where they're getting a flood of requests for ssh signing support, specifically because 1Password added this feature. https://gitlab.com/gitlab-org/gitlab/-/issues/343879#note_1092959291
3. It could provide some great synergy between apps like GPG Keychain (for macOS) and 1Password for better/smoother development workflows.

Would love to see where this feature goes...I would be all over it day one, and would even beta test if you want (or if this is possible).
Former Member
3 years ago
+10^10
Michael_Mercuri
Dedicated Contributor
3 years ago
+1
itsTyrion
New Contributor
3 years ago
waiting for this too 👀
Former Member
3 years ago
Really looking forward to that feature!
I'm also using GPG keys to sign git commits to have verified commits, and I have configured the GPG to use Yubikey security key to access the private key. When I experienced the SSH workflow with 1Password, I think it will be awesome to have the same experience with GPG keys as well.
Former Member
3 years ago
Hey @nrfirth - would you be willing to join our Developer Slack Workspace to chat with me about this more? You can https://join.slack.com/t/1password-devs/shared_invite/zt-15k6lhima-GRb5Ga%7Efo7mjS9xPzDaF2A and then send me a DM (Tyler Durkin). I'd love to ask some additional questions if you have the time!
Former Member
3 years ago
I would really appreciate the ability to store and use GPG keys as well. I recently switched to signing git commits with SSH keys instead (though GitHub only just started implementing the ability to use SSH for verified commits in vigilant mode) and 1Password works great there! GPG in 1Password would be icing on the cake!
Former Member
3 years ago
+1
Kitforbes
Occasional Contributor
3 years ago
+1. This would be a great addition!

Forum Discussion

GPG support? (like SSH)

86 Replies

Featured discussions

Meet the 1Password team at KubeCon Europe

Recent discussions

Multiple account support in op run

Concatenate password with OTP

op CLI hangs on macOS Tahoe

How do I use the SSH agent in headless Linux?

Sudo support