SlimPass
A dependency-free SSH passphrase and secret prompt for hardened Linux desktops — TPM or biometric unlock, wayland-native, no Qt, no KDE, no X11.
Linux sysadmins and security-conscious developers on minimal Wayland distros
- Single statically-linked binary using GTK4 only, no Qt or X11 in the dependency tree
- TPM2 and fingerprint unlock for SSH key passphrases stored in a kernel keyring
- Pipe-friendly mode for build tools like the Go toolchain that need to prompt during a non-TTY build
- Audit log of every passphrase prompt with timestamp and requesting PID
The HN post shows there's real demand for a Wayland-native, minimal askpass; current options all drag in X11 or full KDE stacks.
Multiple forum threads (unix.stackexchange, Arch BBS, spencerkrum.com) show real but narrow pain around ssh-askpass on Wayland/Sway; HN traction was a modest 34 points, indicating a small but real audience.Using ssh-askpass with wayland - Spencer Krum ↗How do I get ssh-askpass working in Wayland, on KDE? ↗
Not wide open: wayprompt already ships a Wayland-native ssh-askpass via wl-clipboard, and Marius just published a GTK4/Zig ssh-askpass targeting exactly this niche on hardened Gentoo/Sway.wayprompt: Drop-in pinentry replacement for Wayland ↗マリウス . A GTK4 ssh-askpass in Zig ↗
Hard to monetize: this is a ~hundred-line CLI shim, the entire category (ksshaskpass, lxqt-openssh-askpass, gnome-ssh-askpass, wayprompt, Marius's tool) ships free under permissive licenses; sysadmin users expect FOSS for desktop plumbing.マリウス . A GTK4 ssh-askpass in Zig ↗wayprompt: Drop-in pinentry replacement for Wayland ↗
SSH and ssh-agent aren't going away, and Wayland is the directional default for major Linux desktops (Fedora, Ubuntu, Debian, Gentoo), so the pain point persists, but TPM-resident keys (ssh-tpm-agent) and hardware keys (FIDO2/-sk) are quietly reducing passphrase-prompt frequency for the target user.GitHub - Foxboron/ssh-tpm-agent ↗
Tiny, well-defined scope: a Wayland-native ssh-askpass is essentially a stdin reader + one Wayland surface or GTK4 window; Marius shipped a working version in Zig single-handedly, and wayprompt proves the wl-clipboard/direct approach is also small.マリウス . A GTK4 ssh-askpass in Zig ↗wayprompt: Drop-in pinentry replacement for Wayland ↗