Unhelpful error ("unknown identity type") decrypting content encrypted with age-plugin-yubikey identity

[charles-dyfis-net]

$ nix-shell -p age age-plugin-yubikey
OK

[nix-shell:~]$ age --version
1.2.1

[nix-shell:~]$ age-plugin-yubikey --version
age-plugin-yubikey 0.5.0

[nix-shell:~]$ age-plugin-yubikey --list | grep -Ev '^$|^#'
age1yubikey1qt9ph9amd635dkhdqms5eune7hkpz4gmmyx35vuz9hxxks4zugz67pakedt

[nix-shell:~]$ age -e -r "$(age-plugin-yubikey --list | grep -Ev '^$|^#')" -o ~/tmp/testme.age <<<'hello world'

[nix-shell:~]$ age -d -i <(age-plugin-yubikey --list | grep -Ev '^$|^#') ~/tmp/testme.age
age: error: reading "/dev/fd/63": failed to read "/dev/fd/63": error at line 1: unknown identity type
age: report unexpected or unhelpful errors at https://filippo.io/age/report

A rage equivalent to this has been filed as str4d/rage#581 (in rage, the error is "identity file contains non-identity data").

Incidentally, exporting AGEDEBUG=plugin adds no additional output during the decryption operation, though it does reveal the plugin being used during encryption.

[FiloSottile]

Thank you for the report! What would have been a more helpful error? Maybe "invalid identity (this looks like a recipient, not an identity)"?

[charles-dyfis-net]

Yup, that would indeed have pointed me in the right direction!

[FiloSottile]

By the way, in case you haven't debugged it yet, the working command would be

age -d -i <(age-plugin-yubikey --identity) ~/tmp/testme.age

because --list gives the recipients (the public keys, so to speak) and --identity gives the identities (the private keys, in a way).