add configs and memos about gpg

config/scripts/.local/scripts/gpg-init

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Description:
+#   Initialize gpg-agent for SSH support and set up environment variables.
+#   Designed to replace manual ssh-agent management.
+
+GPG_SSH_SOCKET=$(gpgconf --list-dirs agent-ssh-socket)
+
+if [ -z "$SSH_AUTH_SOCK" ] || [ "$SSH_AUTH_SOCK" != "$GPG_SSH_SOCKET" ]; then
+    echo "export SSH_AUTH_SOCK='$GPG_SSH_SOCKET';"
+fi
+
+# Ensure gpg-agent is aware of the current tty (for passphrase prompts)
+gpg-connect-agent updatestartuptty /bye > /dev/null 2>&1

config/shell/.bash_profile

@@ -18,6 +18,9 @@ prepend_path() {
 	esac
 }
 
+# .profile is not included in the repo
+[ -f "$HOME/.profile" ] && . "$HOME/.profile"
+
 # Better than nothing
 export XDG_CONFIG_HOME="$HOME/.config"
 export XDG_DATA_HOME="$HOME/.local/share"
@@ -43,14 +46,15 @@ if command -v fnm &>/dev/null; then
 	eval $(fnm env --shell bash)
 fi
 
-# SSH with cross-session ssh-agent
-if [ -x "$HOME/.local/scripts/ssh-init" ]; then
+# export ENABLE_GPG_AGENT_SSH=1 in .profile to enable GPG agent for SSH
+if [ -x "$HOME/.local/scripts/gpg-init" ] && [ -n "$ENABLE_GPG_AGENT_SSH" ] && [ "$ENABLE_GPG_AGENT_SSH" != "0" ]; then
+	# GPG agent for SSH
+	eval "$($HOME/.local/scripts/gpg-init 2>/dev/null)" >/dev/null 2>&1
+elif [ -x "$HOME/.local/scripts/ssh-init" ]; then
+	# SSH with cross-session ssh-agent
 	eval "$($HOME/.local/scripts/ssh-init 2>/dev/null)" >/dev/null 2>&1
 fi
 
-# .profile is not included in the repo
-[ -f "$HOME/.profile" ] && . "$HOME/.profile"
-
 # Triggered in SSH sessions
 if [[ $- == *i* ]]; then
 	# Set EDITOR and VISUAL, mainly for sudoedit

config/shell/.config/fish/conf.d/10-sshs.fish

@@ -1,6 +1,13 @@
 # ssh with encrypted private keys
-# $ssh_keys should be set in advance or left empty to use the default keys
-if type -q ssh
+# $ssh_key_hashes should be set in advance or left empty to use the default keys
+
+if set -q ENABLE_GPG_AGENT_SSH; and test $ENABLE_GPG_AGENT_SSH != "0";\
+   and type -q gpg-init; and type -q gpgconf
+    # GPG agent for SSH
+    bass $(gpg-init) > /dev/null 2>&1
+
+else if type -q ssh-init; and type -q ssh-add
+    # SSH with cross-session ssh-agent
     bass $(ssh-init) > /dev/null 2>&1
 
     # avoid entering passphrase every time