Does chezmoi support using age plugins like age-plugin-se or age-plugin-yubikey?

[strayer]

For age-encrypted files in Git repositories I usually use plugins like age-plugin-se or age-plugin-yubikey to have unique, safely stored keys per machine. When using a key generated with the Secure Enclave plugin and trying to apply a decrypted file I see this error:

❯ chezmoi apply test_encryption
age: se plugin: Authentifizierung abgebrochen.
age: error: no identity matched any of the recipients
age: report unexpected or unhelpful errors at https://filippo.io/age/report
chezmoi: test_encryption: exit status 1

I assume the plugin for some reason can't do its authentication thingy (as in showing the biometric prompt from macOS). Is this to be expected? Or should plugins like these work in general?

[twpayne]

What is the output of chezmoi doctor on your machine?

[strayer]

RESULT    CHECK                       MESSAGE
ok        version                     v2.70.0, commit 6624b49786a9f039f05b4d929c35fd4f4bf17337, built at 2026-03-09T23:24:30Z, built by Homebrew
ok        latest-version              v2.70.0
ok        os-arch                     darwin/arm64
ok        uname                       Darwin hostname-redacted 25.3.0 Darwin Kernel Version 25.3.0: Wed Jan 28 20:55:08 PST 2026; root:xnu-12377.91.3~2/RELEASE_ARM64_T6020 arm64
ok        go-version                  go1.26.1 (gc)
ok        executable                  /opt/homebrew/bin/chezmoi
ok        upgrade-method              brew-upgrade
ok        config-file                 found ~/.config/chezmoi/chezmoi.toml, last modified 2026-03-17T10:22:03+01:00
warning   source-dir                  ~/.local/share/chezmoi is a git working tree (dirty)
ok        suspicious-entries          no suspicious entries
warning   working-tree                ~/.local/share/chezmoi is a git working tree (dirty)
ok        dest-dir                    ~ is a directory
ok        hardlink                    created hardlink from ~/.local/share/chezmoi to /var/folders/gn/7_324s756pj9hf4z4c9pqtgw0000gn/T/
ok        symlink                     created symlink from .new-name to .old-name
ok        umask                       022
ok        cd-command                  found /opt/homebrew/bin/fish
ok        cd-args                     /opt/homebrew/bin/fish
info      diff-command                not set
ok        edit-command                found /opt/homebrew/bin/nvim
ok        edit-args                   /opt/homebrew/bin/nvim
ok        git-command                 found /opt/homebrew/bin/git, version 2.53.0
ok        merge-command               found /usr/bin/vimdiff
ok        shell-command               found /opt/homebrew/bin/fish
ok        shell-args                  /opt/homebrew/bin/fish
ok        age-command                 found /opt/homebrew/bin/age, version 1.3.1
ok        gpg-command                 found /opt/homebrew/bin/gpg, version 2.5.18
info      pinentry-command            not set
info      1password-command           op not found in $PATH
ok        bitwarden-command           found /opt/homebrew/bin/bw, version 2026.2.0
info      bitwarden-secrets-command   bws not found in $PATH
info      dashlane-command            dcli not found in $PATH
info      doppler-command             doppler not found in $PATH
ok        gopass-command              found /opt/homebrew/bin/gopass, version 1.16.1
ok        keepassxc-command           found /opt/homebrew/bin/keepassxc-cli, version 2.7.12
info      keepassxc-db                not set
info      keeper-command              keeper not found in $PATH
info      lastpass-command            lpass not found in $PATH
ok        pass-command                found /opt/homebrew/bin/pass, version 1.7.4
info      passhole-command            ph not found in $PATH
info      protonpass-command          pass-cli not found in $PATH
info      rbw-command                 rbw not found in $PATH
info      vault-command               vault not found in $PATH
info      secret-command              not set