YubiKey unlock

fd0 can use a YubiKey PIV slot as an unlock method. The slot private key stays on the device. Install the yubikey client flavor so both fd0 and fd0-agent include PIV support.

Install

$ curl -fsSL https://fd0.sh/install | sh -s -- --yubikey
$ fd0 version
fd0 0.11.0 yubikey
$ fd0 doctor

Enroll

$ fd0 auth add --yubikey
$ fd0 auth default yubikey
$ fd0 lock
$ fd0 unlock --method=yubikey

fd0 auth default yubikey stores a device-local preference in ~/.fd0/config.toml, so plain fd0 unlock uses the YubiKey on this machine. fd0 doctor reports whether the CLI and running agent are both the YubiKey flavor. After an update, run fd0 agent restart before testing unlock.

Update

$ fd0 update
$ fd0 update --flavor=standard   # switch away deliberately

A YubiKey install stays on the YubiKey release flavor during normal fd0 update. Switching back to the standard flavor is explicit.

Multiple readers

If more than one compatible reader is present, set FD0_YUBIKEY_CARD=<substring>. Without it, fd0 refuses to choose a card silently.