Language

Go. The host gets one static binary and nothing else to install: no Python, no pip, and no OpenSSL.

crypto/tls and crypto/ed25519 are in the standard library. That covers the TLS 1.3 handshake and the signature check.

Build with CGO_ENABLED=0. The result is a single file to copy onto the machine. GOOS=linux GOARCH=arm64 produces the arm64 build from an amd64 machine. build.sh builds every target.

Libraries

kin imports golang.org/x/crypto, golang.org/x/term and golang.org/x/sys. These are the official Go libraries, pure Go, compiled into the same binary. The host still has nothing to install.

• x/crypto/ssh parses SSH public keys and OpenSSH private key files, including encrypted ones, which need bcrypt_pbkdf. x/crypto/ssh/agent talks to ssh-agent.
• x/term puts the client's terminal in raw mode and reads passphrases, on Linux and macOS.
• x/sys/unix has the pty ioctls and waitid for the daemon.

The module needs Go 1.26 or later.

Other languages

Rust also ends as one binary. The cost shows up while building: rustls, a tokio runtime, and an SSH key crate bring a long crate graph and a long compile.

C moves the dependency into whichever TLS library is linked.