UX: "identity file contains non-identity data" when attempting to decrypt w/ age1yubikey identity

[charles-dyfis-net]

What were you trying to do

Decrypt a file encrypted with a key associated with an attached yubikey.

Filing under UX as it's not clear what the underlying problem is, but it is clear that the error message is not unambiguously describing that problem.

What happened

$ nix-shell -p rage age-plugin-yubikey

[nix-shell:~]$ rage --version
rage 0.11.1

[nix-shell:~]$ age-plugin-yubikey --version
age-plugin-yubikey 0.5.0

[nix-shell:~]$ age-plugin-yubikey --list | grep -Ev '^$|^#'
age1yubikey1qt9ph9amd635dkhdqms5eune7hkpz4gmmyx35vuz9hxxks4zugz67pakedt

[nix-shell:~]$ rage -e -r "$(age-plugin-yubikey --list | grep -Ev '^$|^#')" -o ~/tmp/testme.age <<<'hello world'

[nix-shell:~]$ rage -d -i <(age-plugin-yubikey --list | grep -Ev '^$|^#') ~/tmp/testme.age
Error: identity file contains non-identity data on line 1

[ Did rage not do what you expected? Could an error be more useful? ]
[ Tell us: https://str4d.xyz/rage/report                            ]

The issue isn’t a bug in rage or the age‑plugin‑yubikey; it happens because you passed the wrong kind of data to the -i/--identity flag. The command age-plugin-yubikey --list outputs recipient strings that begin with “age1yubikey…”, which are public keys meant for encryption and therefore belong with -r or -R. Decryption instead needs an identity, a private‑key descriptor that starts with “AGE-PLUGIN-YUBIKEY…”, produced by running age-plugin-yubikey --identity (optionally with --slot 9a or whatever slot your key lives in). When rage reads the recipient string where it expects an identity, it quite correctly says “identity file contains non‑identity data on line 1.” To decrypt your file, first generate an identity—e.g., age-plugin-yubikey --identity --slot 9a > ~/.config/age/yubikey-identity.txt—and then use that file with rage -d -i ~/.config/age/yubikey-identity.txt ~/tmp/testme.age. If you don’t want a temporary file, you can substitute a process substitution instead: rage -d -i <(age-plugin-yubikey --identity --slot 9a) ~/tmp/testme.age. In short, use --identity for decryption and --list only for encryption, and the error disappears.