Wednesday, 29 July 2026 @ 16:01 UTC~1013,752154,727

OpenPubkey SSH

OpenPubkey·openpubkey.opkssh

A tool which enables SSH to be used with OpenID Connect, allowing SSH access management via identities like alice@example.com instead of long-lived SSH keys.

opkssh is a tool which enables ssh to be used with OpenID Connect allowing SSH access management via identities like alice@example.com instead of long-lived SSH keys. It does not replace ssh, but rather generates ssh public keys that contain PK Tokens and configures sshd to verify the PK Token in the ssh public key. These PK Tokens contain standard OpenID Connect ID Tokens. This protocol builds on the OpenPubkey which adds user public keys to OpenID Connect without breaking compatibility with existing OpenID Provider.

winget install --id openpubkey.opkssh --exact --source winget

Latest 0.16.0·July 14, 2026

Release Notes

A Note on Compatibility for GQ signatures Includes security fix to GitLab-CI GQ commitment PK Tokens by updating to OpenPubkey v0.25.0. As OPKSSH does not currently support GitLab-CI, and only currently supports GitLab user OP, there should be no security impact to OPKSSH. However this does introduce a breaking change to how GQ signatures are verified. If GitHub is being used with GQ signatures then signatures created prior to this release will not verify on OPKSSH after this change and signatures created after this release will not verify against on OPKSSH before this change. See openpubkey/openpubkey#379 Changes

  • Update to OpenPubkey v0.25.0 @EthanHeilman (#569)
  • fix(deps): Update Docker @renovate[bot] (#566)
  • fix(deps): Update go toolchain directive to v1.26.5 @renovate[bot] (#567)
  • fix(deps): Update actions/cache action to v6.1.0 @renovate[bot] (#556)
  • feat(enforcer): add glob support to github-actions @gastmaier (#558)
  • chore(deps): bump github.com/go-chi/chi/v5 from 5.2.2 to 5.2.4 @dependabot[bot] (#540)
  • Imports slices rather exp/slices @EthanHeilman (#565)
  • feat: produce Android binaries on CI @bltavares (#550)
  • fix(deps): Update Docker @renovate[bot] (#555)
  • fix(deps): Update docker/build-push-action action to v7.3.0 @renovate[bot] (#560)
  • fix(deps): Update goreleaser/goreleaser-action action to v7.2.3 @renovate[bot] (#557)
  • fix(deps): Update release-drafter/release-drafter action to v7.5.1 @renovate[bot] (#554)
  • fix(deps): Update release-drafter/release-drafter action to v7 @renovate[bot] (#551)
  • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.4 @dependabot[bot] (#539) 🐛 Bug Fixes
  • Fix release drafter @EthanHeilman (#561)
  • fix(deps): Update actions/cache action to v6 @renovate[bot] (#543)
  • fix(deps): Update actions/checkout action to v7 @renovate[bot] (#545)
  • fix(deps): Update actions/setup-go action to v6.5.0 @renovate[bot] (#553)
  • fix(deps): Update dependency golangci/golangci-lint to v2.12.2 @renovate[bot] (#552)
  • fix(deps): Update Docker @renovate[bot] (#549)
  • fix(deps): Update actions/setup-go action to v6.4.0 @renovate[bot] (#541)
  • fix(deps): Update dependency golangci/golangci-lint to v2.11.4 @renovate[bot] (#489)
  • fix(deps): Update zizmorcore/zizmor-action action to v0.5.7 @renovate[bot] (#535)
  • fix(deps): Update Docker @renovate[bot] (#469) 🧰 Maintenance
  • fix(deps): Update Docker @renovate[bot] (#469)

Installer type: portable

x64—DB8991CEAAC7AC224B704510CA6FBA2114998291D4283DE4BC2D3B8EFA66AD07

Details

Homepage
https://github.com/openpubkey/opkssh
License
Apache-2.0
Publisher
OpenPubkey
Support
https://github.com/openpubkey/opkssh/issues
Moniker
opkssh

Tags

encryptionkeysopenidconnectpktokenssecureshelldaemonsshdserversshkeyssshpublickeys

Older versions (14)

0.15.0
x64—2763FBF981DE54EC92792668C94FFA2F34F8207E8CDB05303B166E1B352666FF
0.14.0
x64—BFCFAFDA088258243B49111C58CCAF7EA2041D05A15C481C627F4BEC3F1610F3
0.13.0
x64—0686E456126BC6B2ED5C1583F28857A6D78E8D6C469AC7B1C20EBCE26A834DD1
0.12.0
x64—E2CDF9F10C75923FA904ABF8ACF5EB3C4882AE3D2C63C394637AA8D3217DA3B5
0.11.0
x64—33430FCBC16A73FC421171A021ECC188955E965E935445AEBDFE34F674970E9C
0.10.0
x64—DEA9BA153365E9151E43A13ABB16BF19A97567AC02E4CEF24CD454ACB0EA9F85
0.9.0
x64—59975CCF84961AE04B03022A93257189BA03EF4F950509B38199F8159BAB3CC4
0.8.0
x64—175F8B6BB08B6508B118E4EF855A342CBF64B9008B4665A56984FF1F5B32F8F6
0.7.0
x64—FA2FBDEB3CB716C8EA9941C0A13E14EA83DE3C49E9CAFB33F83CBC2FCE9E4BD3
0.6.1
x64—9FD481FC6682BF56D7723B6672FAB71BB942DFEFDD2E166B1C276F3F7D4767BA
0.6.0
x64—A80AEB7679E74363065E07C05D1E765A296D81A1E8D4496161C309466381052F
0.5.1
x64—DDD11D8BEB15677C269EBA8101B8CFB19A3CF5F85DB8AFB8C34C0F303C8131E3
0.4.0
x64—2CE152F1C5E62201B34D7012D14A67ACE4DB62DE914CE1A9A4DC3D36335B56E0
0.3.0
x64—D864576A0007E9CAD914420A94DB51EA74B3473EA22F88317492AFC0B7B4F895