v1.0.0 🏁

[FiloSottile]

age—pronounced [aɡe̞], like the Italian “aghe”—is a simple, modern and secure file encryption tool, format, and Go library.

It features small explicit keys, no config options, and UNIX-style composability.

$ age-keygen -o key.txt
Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
$ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz

v1.0.0 is the first stable release of the Go CLI and API, twenty months after the first beta.

Learn more by reading the README, the age(1) man page, the Go API reference, or the original design document.

Watch the repository or follow @FiloSottile on Twitter to be notified of new releases.

---

This discussion was created from the release v1.0.0 🏁.

[developerfred]

ah muleke! Awesome :D 🚀

[cmoog]

Nice! Thanks for all your work on this.

What is the status of the proposed age plugin system, as implemented in rage? Wondering what this milestone means for hardware key support (IMHO built in support in symmetric mode would be better.)

Apologies if this is already documented somewhere.

[FiloSottile]

It's on the roadmap for v1.1.0! I will put up a project board or something like that with planned work.

[rayterrill]

Just used age for a project (using sops) and it worked so well! Documentation was excellent as well. Congrats!!

[tmc]

Awesome release! Could you publish a checksum file so it’s easier to reliably reference these binaries in CI/build tools?

[FiloSottile]

Where would you see it being published? It feels a bit useless putting it next to the release binaries: if you trust HTTPS to get the checksums file, you can trust the binaries themselves, and pipe it into the checksum program of your choice if you need to pin.

[alerque]

For the purposes of distro packaging, even placing it right next to the release binaries is helpful. Of course a third channel of some sort is better (and serves a different purpose), but attached to the release just like the binaries at least covers the use case of verifying downloads completed and are the right file. Usually distro packages just assume the file they got is complete and the right one, thereafter pinning the checksum helps serve the purpose of catching download corruption, incorrect file downloads/renames, etc. It also catches upstream re-publishing that should be looked into. Having upstream published checksums just ups the ante a little bit my making sure the original packager didn't have a corrupt download. It is less a safety thing (since a repo compromise or MITM could attach the checksum as well as the download) that it is a simple integrity check of the download step (not just the wire part but also on-disk handling, etc.).

[jtdowney]

Just a heads up that the branch rename to main broke the README and man page links in the release notes.

[FiloSottile]

Thank you! Fixed!

[alessiodionisi]

🚀🚀🚀🚀

[cyb3rz3us]

This is a great milestone. I've been using age for just about 18 months in a variety of applications and it has become one of my 2 goto apps in this arena. Great work to all those involved and thank you for all you've done here...