Proof Portal
Project overview
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
ReportR-2580GitHub issuePublicReceived
Harden ssh client and gpg
Reported by woopstar · filed Aug 21, 2025Closed upstream on 2025-08-31 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
Received and recorded verbatim. Nothing has been checked yet.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
Harden ssh client and gpgrevision 1 · captured 2026-10-04 11:27 UTC via poll
You might want to harden SSH and GPG with inpiration from DrDuh:
https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#prepare-gnupg
https://github.com/drduh/macOS-Security-and-Privacy-Guide?tab=readme-ov-file#ssh
$ cat gpg.conf
personal-cipher-preferences AES256 AES192 AES
personal-digest-preferences SHA512 SHA384 SHA256
personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
s2k-digest-algo SHA512
s2k-cipher-algo AES256
charset utf-8
no-comments
no-emit-version
no-greeting
keyid-format 0xlong
list-options show-uid-validity
verify-options show-uid-validity
with-fingerprint
require-cross-certification
require-secmem
no-symkey-cache
armor
use-agent
throw-keyids$ cat gpg-agent.conf
# https://github.com/drduh/YubiKey-Guide/blob/master/config/gpg-agent.conf
enable-ssh-support
ttyname $GPG_TTY
default-cache-ttl 60
max-cache-ttl 120
# Select a valid program path for PIN entry prompt
# -- Linux (default /usr/bin/pinentry)
#pinentry-program /usr/bin/pinentry
#pinentry-program /usr/bin/pinentry-curses
#pinentry-program /usr/bin/pinentry-gnome3
#pinentry-program /usr/bin/pinentry-tty
#pinentry-program /usr/bin/pinentry-x11
# -- macOS - Intel silicon (default /usr/local/bin/pinentry)
#pinentry-program /usr/local/bin/pinentry
#pinentry-program /usr/local/bin/pinentry-curses
#pinentry-program /usr/local/bin/pinentry-mac
#pinentry-program /usr/local/bin/pinentry-tty
# -- macOS - Apple silicon (default /opt/homebrew/bin/pinentry)
#pinentry-program /opt/homebrew/bin/pinentry
#pinentry-program /opt/homebrew/bin/pinentry-curses
#pinentry-program /opt/homebrew/bin/pinentry-mac
#pinentry-program /opt/homebrew/bin/pinentry-tty
# -- macOS - MacPorts
#pinentry-program /opt/local/bin/pinentry
# -- macOS - MacGPG2
#pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac
# -- Windows
# https://developers.yubico.com/PGP/SSH_authentication/Windows.html
#enable-win32-openssh-support$ cat ssh_config
# https://github.com/drduh/config/blob/main/ssh_config
# https://linux.die.net/man/5/ssh_config
#Host router
# IdentityFile ~/.ssh/router
# HostName 192.168.1.1
# Port 2400
# User sysadm
Host gitlab.com
User git
ControlMaster no
IdentitiesOnly yes
IdentityFile ~/.ssh/gitlab
Host github.com
User git
ControlMaster no
IdentitiesOnly yes
IdentityFile ~/.ssh/github
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
Host *
#ControlMaster auto
#ControlPath ~/.ssh/master-%r@%h:%p
#ControlPersist 300
AddressFamily inet
HashKnownHosts yes
VisualHostKey yes
PasswordAuthentication no
ChallengeResponseAuthentication no
StrictHostKeyChecking ask
VerifyHostKeyDNS yes
ForwardAgent no
ForwardX11 no
ForwardX11Trusted no
ServerAliveInterval 300
ServerAliveCountMax 2
Ciphers [email protected]
MACs [email protected],[email protected]
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519View raw text
You might want to harden SSH and GPG with inpiration from DrDuh: https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#prepare-gnupg https://github.com/drduh/macOS-Security-and-Privacy-Guide?tab=readme-ov-file#ssh ```shell $ cat gpg.conf personal-cipher-preferences AES256 AES192 AES personal-digest-preferences SHA512 SHA384 SHA256 personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed cert-digest-algo SHA512 s2k-digest-algo SHA512 s2k-cipher-algo AES256 charset utf-8 no-comments no-emit-version no-greeting keyid-format 0xlong list-options show-uid-validity verify-options show-uid-validity with-fingerprint require-cross-certification require-secmem no-symkey-cache armor use-agent throw-keyids ``` ```shell $ cat gpg-agent.conf # https://github.com/drduh/YubiKey-Guide/blob/master/config/gpg-agent.conf enable-ssh-support ttyname $GPG_TTY default-cache-ttl 60 max-cache-ttl 120 # Select a valid program path for PIN entry prompt # -- Linux (default /usr/bin/pinentry) #pinentry-program /usr/bin/pinentry #pinentry-program /usr/bin/pinentry-curses #pinentry-program /usr/bin/pinentry-gnome3 #pinentry-program /usr/bin/pinentry-tty #pinentry-program /usr/bin/pinentry-x11 # -- macOS - Intel silicon (default /usr/local/bin/pinentry) #pinentry-program /usr/local/bin/pinentry #pinentry-program /usr/local/bin/pinentry-curses #pinentry-program /usr/local/bin/pinentry-mac #pinentry-program /usr/local/bin/pinentry-tty # -- macOS - Apple silicon (default /opt/homebrew/bin/pinentry) #pinentry-program /opt/homebrew/bin/pinentry #pinentry-program /opt/homebrew/bin/pinentry-curses #pinentry-program /opt/homebrew/bin/pinentry-mac #pinentry-program /opt/homebrew/bin/pinentry-tty # -- macOS - MacPorts #pinentry-program /opt/local/bin/pinentry # -- macOS - MacGPG2 #pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac # -- Windows # https://developers.yubico.com/PGP/SSH_authentication/Windows.html #enable-win32-openssh-support ``` ```shell $ cat ssh_config # https://github.com/drduh/config/blob/main/ssh_config # https://linux.die.net/man/5/ssh_config #Host router # IdentityFile ~/.ssh/router # HostName 192.168.1.1 # Port 2400 # User sysadm Host gitlab.com User git ControlMaster no IdentitiesOnly yes IdentityFile ~/.ssh/gitlab Host github.com User git ControlMaster no IdentitiesOnly yes IdentityFile ~/.ssh/github MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected] Host * #ControlMaster auto #ControlPath ~/.ssh/master-%r@%h:%p #ControlPersist 300 AddressFamily inet HashKnownHosts yes VisualHostKey yes PasswordAuthentication no ChallengeResponseAuthentication no StrictHostKeyChecking ask VerifyHostKeyDNS yes ForwardAgent no ForwardX11 no ForwardX11Trusted no ServerAliveInterval 300 ServerAliveCountMax 2 Ciphers [email protected] MACs [email protected],[email protected] KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256 HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519 ```
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.