From 877ca247e3a8131cb486c78986868853a5fe603a Mon Sep 17 00:00:00 2001
From: zhsj <zsj950618@gmail.com>
Date: Sat, 22 Apr 2023 17:53:03 +0800
Subject: [PATCH] .github/workflows: update ronn to 0.9 (#483)

This fixes apostrophes in generated manpage.
Apostrophes should be entered as `'` ; using `\'` produces an acute accent.

ronn in Ubuntu is from https://github.com/apjanke/ronn-ng
---
 .github/workflows/ronn.yml          |   6 +-
 .github/workflows/ronn/Dockerfile   |   8 --
 .github/workflows/ronn/Gemfile      |   5 -
 .github/workflows/ronn/Gemfile.lock |  20 ----
 .github/workflows/ronn/action.yml   |   4 -
 doc/age-keygen.1                    |  38 +------
 doc/age-keygen.1.html               |  35 +++---
 doc/age.1                           | 155 ++------------------------
 doc/age.1.html                      | 163 +++++++++++++++++-----------
 9 files changed, 140 insertions(+), 294 deletions(-)
 delete mode 100644 .github/workflows/ronn/Dockerfile
 delete mode 100644 .github/workflows/ronn/Gemfile
 delete mode 100644 .github/workflows/ronn/Gemfile.lock
 delete mode 100644 .github/workflows/ronn/action.yml

diff --git a/.github/workflows/ronn.yml b/.github/workflows/ronn.yml
index eb4f50c0..504a77b6 100644
--- a/.github/workflows/ronn.yml
+++ b/.github/workflows/ronn.yml
@@ -6,7 +6,6 @@ on:
     paths:
       - '**.ronn'
       - '**/ronn.yml'
-      - '**/ronn/**'
 permissions:
   contents: read
 jobs:
@@ -16,9 +15,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+      - name: Install ronn
+        run: sudo apt-get update && sudo apt-get install -y ronn
       - name: Run ronn
-        uses: ./.github/workflows/ronn
-        id: ronn
+        run: bash -O globstar -c 'ronn **/*.ronn'
       - name: Undo email mangling
         # rdiscount randomizes the output for no good reason, which causes
         # changes to always get committed. Sigh.
diff --git a/.github/workflows/ronn/Dockerfile b/.github/workflows/ronn/Dockerfile
deleted file mode 100644
index f373ec3b..00000000
--- a/.github/workflows/ronn/Dockerfile
+++ /dev/null
@@ -1,8 +0,0 @@
-FROM ruby:3.0.1-buster
-
-RUN apt-get update && apt-get install -y groff
-RUN bundle config --global frozen 1
-COPY Gemfile Gemfile.lock ./
-RUN bundle install
-ENTRYPOINT ["bash", "-O", "globstar", "-c", \
-    "/usr/local/bundle/bin/ronn **/*.ronn"]
diff --git a/.github/workflows/ronn/Gemfile b/.github/workflows/ronn/Gemfile
deleted file mode 100644
index 544b2e3c..00000000
--- a/.github/workflows/ronn/Gemfile
+++ /dev/null
@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-source "https://rubygems.org"
-
-gem "ronn", "~> 0.7.3"
diff --git a/.github/workflows/ronn/Gemfile.lock b/.github/workflows/ronn/Gemfile.lock
deleted file mode 100644
index 45c7cd56..00000000
--- a/.github/workflows/ronn/Gemfile.lock
+++ /dev/null
@@ -1,20 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    hpricot (0.8.6)
-    mustache (1.1.1)
-    rdiscount (2.2.0.2)
-    ronn (0.7.3)
-      hpricot (>= 0.8.2)
-      mustache (>= 0.7.0)
-      rdiscount (>= 1.5.8)
-
-PLATFORMS
-  aarch64-linux
-  x86_64-linux
-
-DEPENDENCIES
-  ronn (~> 0.7.3)
-
-BUNDLED WITH
-   2.2.15
diff --git a/.github/workflows/ronn/action.yml b/.github/workflows/ronn/action.yml
deleted file mode 100644
index 47344992..00000000
--- a/.github/workflows/ronn/action.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-name: Ronn
-runs:
-  using: docker
-  image: Dockerfile
diff --git a/doc/age-keygen.1 b/doc/age-keygen.1
index 3aced705..65f65aaa 100644
--- a/doc/age-keygen.1
+++ b/doc/age-keygen.1
@@ -1,88 +1,56 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "AGE\-KEYGEN" "1" "September 2022" "" ""
-.
+.\" generated with Ronn-NG/v0.9.1
+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
+.TH "AGE\-KEYGEN" "1" "January 2023" ""
 .SH "NAME"
 \fBage\-keygen\fR \- generate age(1) key pairs
-.
 .SH "SYNOPSIS"
 \fBage\-keygen\fR [\fB\-o\fR \fIOUTPUT\fR]
-.
 .br
 \fBage\-keygen\fR \fB\-y\fR [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
-.
 .br
-.
 .SH "DESCRIPTION"
 \fBage\-keygen\fR generates a new native age(1) key pair, and outputs the identity to standard output or to the \fIOUTPUT\fR file\. The output includes the public key and the current time as comments\.
-.
 .P
 If the output is not going to a terminal, \fBage\-keygen\fR prints the public key to standard error\.
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-o\fR, \fB\-\-output\fR=\fIOUTPUT\fR
 Write the identity to \fIOUTPUT\fR instead of standard output\.
-.
 .IP
 If \fIOUTPUT\fR already exists, it is not overwritten\.
-.
 .TP
 \fB\-y\fR
 Read an identity file from \fIINPUT\fR or from standard input and output the corresponding recipient(s), one per line, with no comments\.
-.
 .TP
 \fB\-\-version\fR
 Print the version and exit\.
-.
 .SH "EXAMPLES"
 Generate a new identity:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-keygen
 # created: 2021\-01\-02T15:30:45+01:00
 # public key: age1lvyvwawkr0mcnnnncaghunadrqkmuf9e6507x9y920xxpp866cnql7dp2z
 AGE\-SECRET\-KEY\-1N9JEPW6DWJ0ZQUDX63F5A03GX8QUW7PXDE39N8UYF82VZ9PC8UFS3M7XA9
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Write a new identity to \fBkey\.txt\fR:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-keygen \-o key\.txt
 Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Convert an identity to a recipient:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-keygen \-y key\.txt
 age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
-.
 .fi
-.
 .IP "" 0
-.
 .SH "SEE ALSO"
 age(1)
-.
 .SH "AUTHORS"
 Filippo Valsorda \fIage@filippo\.io\fR
diff --git a/doc/age-keygen.1.html b/doc/age-keygen.1.html
index 167ca324..d0c69fd4 100644
--- a/doc/age-keygen.1.html
+++ b/doc/age-keygen.1.html
@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <meta http-equiv='content-type' value='text/html;charset=utf8'>
-  <meta name='generator' value='Ronn/v0.7.3 (http://github.com/rtomayko/ronn/tree/0.7.3)'>
+  <meta http-equiv='content-type' content='text/html;charset=utf8'>
+  <meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
   <title>age-keygen(1) - generate age(1) key pairs</title>
   <style type='text/css' media='all'>
   /* style: man */
@@ -68,15 +68,16 @@
     <li class='tr'>age-keygen(1)</li>
   </ol>
 
-  <h2 id="NAME">NAME</h2>
+  
+
+<h2 id="NAME">NAME</h2>
 <p class="man-name">
   <code>age-keygen</code> - <span class="man-whatis">generate <a class="man-ref" href="age.1.html">age<span class="s">(1)</span></a> key pairs</span>
 </p>
-
 <h2 id="SYNOPSIS">SYNOPSIS</h2>
 
-<p><code>age-keygen</code> [<code>-o</code> <var>OUTPUT</var>]<br />
-<code>age-keygen</code> <code>-y</code> [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br /></p>
+<p><code>age-keygen</code> [<code>-o</code> <var>OUTPUT</var>]<br>
+<code>age-keygen</code> <code>-y</code> [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br></p>
 
 <h2 id="DESCRIPTION">DESCRIPTION</h2>
 
@@ -90,15 +91,20 @@ <h2 id="DESCRIPTION">DESCRIPTION</h2>
 <h2 id="OPTIONS">OPTIONS</h2>
 
 <dl>
-<dt><code>-o</code>, <code>--output</code>=<var>OUTPUT</var></dt><dd><p>  Write the identity to <var>OUTPUT</var> instead of standard output.</p>
-
-<p>  If <var>OUTPUT</var> already exists, it is not overwritten.</p></dd>
-<dt class="flush"><code>-y</code></dt><dd><p>  Read an identity file from <var>INPUT</var> or from standard input and output the
-  corresponding recipient(s), one per line, with no comments.</p></dd>
-<dt><code>--version</code></dt><dd><p>  Print the version and exit.</p></dd>
+<dt>
+<code>-o</code>, <code>--output</code>=<var>OUTPUT</var>
+</dt>
+<dd>  Write the identity to <var>OUTPUT</var> instead of standard output.
+
+    <p>If <var>OUTPUT</var> already exists, it is not overwritten.</p>
+</dd>
+<dt><code>-y</code></dt>
+<dd>  Read an identity file from <var>INPUT</var> or from standard input and output the
+  corresponding recipient(s), one per line, with no comments.</dd>
+<dt><code>--version</code></dt>
+<dd>  Print the version and exit.</dd>
 </dl>
 
-
 <h2 id="EXAMPLES">EXAMPLES</h2>
 
 <p>Generate a new identity:</p>
@@ -129,10 +135,9 @@ <h2 id="AUTHORS">AUTHORS</h2>
 
 <p>Filippo Valsorda <a href="mailto:age@filippo.io" data-bare-link="true">age@filippo.io</a></p>
 
-
   <ol class='man-decor man-foot man foot'>
     <li class='tl'></li>
-    <li class='tc'>September 2022</li>
+    <li class='tc'>January 2023</li>
     <li class='tr'>age-keygen(1)</li>
   </ol>
 
diff --git a/doc/age.1 b/doc/age.1
index 1307843b..b4a6a70f 100644
--- a/doc/age.1
+++ b/doc/age.1
@@ -1,281 +1,184 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "AGE" "1" "September 2022" "" ""
-.
+.\" generated with Ronn-NG/v0.9.1
+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
+.TH "AGE" "1" "January 2023" ""
 .SH "NAME"
 \fBage\fR \- simple, modern, and secure file encryption
-.
 .SH "SYNOPSIS"
-\fBage\fR [\fB\-\-encrypt\fR] (\fB\-r\fR \fIRECIPIENT\fR | \fB\-R\fR \fIPATH\fR)\.\.\. [\fB\-\-armor\fR] [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
-.
+\fBage\fR [\fB\-\-encrypt\fR] (\fB\-r\fR \fIRECIPIENT\fR | \fB\-R\fR \fIPATH\fR)\|\.\|\.\|\. [\fB\-\-armor\fR] [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
 .br
 \fBage\fR [\fB\-\-encrypt\fR] \fB\-\-passphrase\fR [\fB\-\-armor\fR] [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
-.
 .br
-\fBage\fR \fB\-\-decrypt\fR [\fB\-i\fR \fIPATH\fR | \fB\-j\fR \fIPLUGIN\fR]\.\.\. [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
-.
+\fBage\fR \fB\-\-decrypt\fR [\fB\-i\fR \fIPATH\fR | \fB\-j\fR \fIPLUGIN\fR]\|\.\|\.\|\. [\fB\-o\fR \fIOUTPUT\fR] [\fIINPUT\fR]
 .br
-.
 .SH "DESCRIPTION"
 \fBage\fR encrypts or decrypts \fIINPUT\fR to \fIOUTPUT\fR\. The \fIINPUT\fR argument is optional and defaults to standard input\. Only a single \fIINPUT\fR file may be specified\. If \fB\-o\fR is not specified, \fIOUTPUT\fR defaults to standard output\.
-.
 .P
-If \fB\-p\fR/\fB\-\-passphrase\fR is specified, the file is encrypted with a passphrase requested interactively\. Otherwise, it\'s encrypted to one or more \fIRECIPIENTS\fR specified with \fB\-r\fR/\fB\-\-recipient\fR or \fB\-R\fR/\fB\-\-recipients\-file\fR\. Every recipient can decrypt the file\.
-.
+If \fB\-p\fR/\fB\-\-passphrase\fR is specified, the file is encrypted with a passphrase requested interactively\. Otherwise, it's encrypted to one or more \fIRECIPIENTS\fR specified with \fB\-r\fR/\fB\-\-recipient\fR or \fB\-R\fR/\fB\-\-recipients\-file\fR\. Every recipient can decrypt the file\.
 .P
 In \fB\-d\fR/\fB\-\-decrypt\fR mode, passphrase\-encrypted files are detected automatically and the passphrase is requested interactively\. Otherwise, one or more \fIIDENTITIES\fR specified with \fB\-i\fR/\fB\-\-identity\fR are used to decrypt the file\.
-.
 .P
 \fBage\fR encrypted files are binary and not malleable, with around 200 bytes of overhead per recipient, plus 16 bytes every 64KiB of plaintext\.
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-o\fR, \fB\-\-output\fR=\fIOUTPUT\fR
 Write encrypted or decrypted file to \fIOUTPUT\fR instead of standard output\. If \fIOUTPUT\fR already exists it will be overwritten\.
-.
 .IP
 If encrypting without \fB\-\-armor\fR, \fBage\fR will refuse to output binary to a TTY\. This can be forced by specifying \fB\-\fR as \fIOUTPUT\fR\.
-.
 .TP
 \fB\-\-version\fR
 Print the version and exit\.
-.
 .SS "Encryption options"
-.
 .TP
 \fB\-e\fR, \fB\-\-encrypt\fR
 Encrypt \fIINPUT\fR to \fIOUTPUT\fR\. This is the default\.
-.
 .TP
 \fB\-r\fR, \fB\-\-recipient\fR=\fIRECIPIENT\fR
 Encrypt to the explicitly specified \fIRECIPIENT\fR\. See the \fIRECIPIENTS AND IDENTITIES\fR section for possible recipient formats\.
-.
 .IP
 This option can be repeated and combined with other recipient flags, and the file can be decrypted by all provided recipients independently\.
-.
 .TP
 \fB\-R\fR, \fB\-\-recipients\-file\fR=\fIPATH\fR
 Encrypt to the \fIRECIPIENTS\fR listed in the file at \fIPATH\fR, one per line\. Empty lines and lines starting with \fB#\fR are ignored as comments\.
-.
 .IP
 If \fIPATH\fR is \fB\-\fR, the recipients are read from standard input\. In this case, the \fIINPUT\fR argument must be specified\.
-.
 .IP
 This option can be repeated and combined with other recipient flags, and the file can be decrypted by all provided recipients independently\.
-.
 .TP
 \fB\-p\fR, \fB\-\-passphrase\fR
 Encrypt with a passphrase, requested interactively from the terminal\. \fBage\fR will offer to auto\-generate a secure passphrase\.
-.
 .IP
-This option can\'t be used with other recipient flags\.
-.
+This option can't be used with other recipient flags\.
 .TP
 \fB\-a\fR, \fB\-\-armor\fR
 Encrypt to an ASCII\-only "armored" encoding\.
-.
 .IP
 \fBage\fR armor is a strict version of PEM with type \fBAGE ENCRYPTED FILE\fR, canonical "strict" Base64, no headers, and no support for leading and trailing extra data\.
-.
 .IP
 Decryption transparently detects and decodes ASCII armoring\.
-.
 .TP
 \fB\-i\fR, \fB\-\-identity\fR=\fIPATH\fR
 Encrypt to the \fIRECIPIENTS\fR corresponding to the \fIIDENTITIES\fR listed in the file at \fIPATH\fR\. This is equivalent to converting the file at \fIPATH\fR to a recipients file with \fBage\-keygen \-y\fR and then passing that to \fB\-R\fR/\fB\-\-recipients\-file\fR\.
-.
 .IP
 For the format of \fIPATH\fR, see the definition of \fB\-i\fR/\fB\-\-identity\fR in the \fIDecryption options\fR section\.
-.
 .IP
 \fB\-e\fR/\fB\-\-encrypt\fR must be explicitly specified when using \fB\-i\fR/\fB\-\-identity\fR in encryption mode to avoid confusion\.
-.
 .TP
 \fB\-j\fR \fIPLUGIN\fR
 Encrypt using the data\-less \fIplugin\fR \fIPLUGIN\fR\.
-.
 .IP
 This is equivalent to using \fB\-i\fR/\fB\-\-identity\fR with a file that contains a single plugin \fBIDENTITY\fR that encodes no plugin\-specific data\.
-.
 .IP
 \fB\-e\fR/\fB\-\-encrypt\fR must be explicitly specified when using \fB\-j\fR in encryption mode to avoid confusion\.
-.
 .SS "Decryption options"
-.
 .TP
 \fB\-d\fR, \fB\-\-decrypt\fR
 Decrypt \fIINPUT\fR to \fIOUTPUT\fR\.
-.
 .IP
 If \fIINPUT\fR is passphrase encrypted, it will be automatically detected and the passphrase will be requested interactively\. Otherwise, the \fIIDENTITIES\fR specified with \fB\-i\fR/\fB\-\-identity\fR are used\.
-.
 .IP
 ASCII armoring is transparently detected and decoded\.
-.
 .TP
 \fB\-i\fR, \fB\-\-identity\fR=\fIPATH\fR
 Decrypt using the \fIIDENTITIES\fR at \fIPATH\fR\.
-.
 .IP
 \fIPATH\fR may be one of the following:
-.
 .IP
 a\. A file listing \fIIDENTITIES\fR one per line\. Empty lines and lines starting with "\fB#\fR" are ignored as comments\.
-.
 .IP
 b\. A passphrase encrypted age file, containing \fIIDENTITIES\fR one per line like above\. The passphrase is requested interactively\. Note that passphrase\-protected identity files are not necessary for most use cases, where access to the encrypted identity file implies access to the whole system\.
-.
 .IP
 c\. An SSH private key file, in PKCS#1, PKCS#8, or OpenSSH format\. If the private key is password\-protected, the password is requested interactively only if the SSH identity matches the file\. See the \fISSH keys\fR section for more information, including supported key types\.
-.
 .IP
 d\. "\fB\-\fR", causing one of the options above to be read from standard input\. In this case, the \fIINPUT\fR argument must be specified\.
-.
 .IP
-This option can be repeated\. Identities are tried in the order in which are provided, and the first one matching one of the file\'s recipients is used\. Unused identities are ignored, but it is an error if the \fIINPUT\fR file is passphrase\-encrypted and \fB\-i\fR/\fB\-\-identity\fR is specified\.
-.
+This option can be repeated\. Identities are tried in the order in which are provided, and the first one matching one of the file's recipients is used\. Unused identities are ignored, but it is an error if the \fIINPUT\fR file is passphrase\-encrypted and \fB\-i\fR/\fB\-\-identity\fR is specified\.
 .TP
 \fB\-j\fR \fIPLUGIN\fR
 Decrypt using the data\-less \fIplugin\fR \fIPLUGIN\fR\.
-.
 .IP
 This is equivalent to using \fB\-i\fR/\fB\-\-identity\fR with a file that contains a single plugin \fBIDENTITY\fR that encodes no plugin\-specific data\.
-.
 .SH "RECIPIENTS AND IDENTITIES"
 \fBRECIPIENTS\fR are public values, like a public key, that a file can be encrypted to\. \fBIDENTITIES\fR are private values, like a private key, that allow decrypting a file encrypted to the corresponding \fBRECIPIENT\fR\.
-.
 .SS "Native X25519 keys"
 Native \fBage\fR key pairs are generated with age\-keygen(1), and provide small encodings and strong encryption based on X25519\. They are the recommended recipient type for most applications\.
-.
 .P
 A \fBRECIPIENT\fR encoding begins with \fBage1\fR and looks like the following:
-.
 .IP "" 4
-.
 .nf
-
 age1gde3ncmahlqd9gg50tanl99r960llztrhfapnmx853s4tjum03uqfssgdh
-.
 .fi
-.
 .IP "" 0
-.
 .P
 An \fBIDENTITY\fR encoding begins with \fBAGE\-SECRET\-KEY\-1\fR and looks like the following:
-.
 .IP "" 4
-.
 .nf
-
 AGE\-SECRET\-KEY\-1KTYK6RVLN5TAPE7VF6FQQSKZ9HWWCDSKUGXXNUQDWZ7XXT5YK5LSF3UTKQ
-.
 .fi
-.
 .IP "" 0
-.
 .P
-An encrypted file can\'t be linked to the native recipient it\'s encrypted to without access to the corresponding identity\.
-.
+An encrypted file can't be linked to the native recipient it's encrypted to without access to the corresponding identity\.
 .SS "SSH keys"
 As a convenience feature, \fBage\fR also supports encrypting to RSA or Ed25519 ssh(1) keys\. RSA keys must be at least 2048 bits\. This feature employs more complex cryptography, and should only be used when a native key is not available for the recipient\. Note that SSH keys might not be protected long\-term by the recipient, since they are revokable when used only for authentication\.
-.
 .P
 A \fBRECIPIENT\fR encoding is an SSH public key in \fBauthorized_keys\fR format (see the \fBAUTHORIZED_KEYS FILE FORMAT\fR section of sshd(8)), starting with \fBssh\-rsa\fR or \fBssh\-ed25519\fR, like the following:
-.
 .IP "" 4
-.
 .nf
-
-ssh\-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDULTit0KUehbi[\.\.\.]GU4BtElAbzh8=
-ssh\-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9pO5pz22JZEas[\.\.\.]l1uZc31FGYMXa
-.
+ssh\-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDULTit0KUehbi[\|\.\|\.\|\.]GU4BtElAbzh8=
+ssh\-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9pO5pz22JZEas[\|\.\|\.\|\.]l1uZc31FGYMXa
 .fi
-.
 .IP "" 0
-.
 .P
 The comment at the end of the line, if present, is ignored\.
-.
 .P
 In recipient files passed to \fB\-R\fR/\fB\-\-recipients\-file\fR, unsupported but valid SSH public keys are ignored with a warning, to facilitate using \fBauthorized_keys\fR or GitHub \fB\.keys\fR files\. (See \fIEXAMPLES\fR\.)
-.
 .P
 An \fBIDENTITY\fR is an SSH private key \fIfile\fR passed individually to \fB\-i\fR/\fB\-\-identity\fR\. Note that keys held on hardware tokens such as YubiKeys or accessed via ssh\-agent(1) are not supported\.
-.
 .P
 An encrypted file \fIcan\fR be linked to the SSH public key it was encrypted to\. This is so that \fBage\fR can identify the correct SSH private key before requesting its password, if any\.
-.
 .SS "Plugins"
 \fBage\fR can be extended through plugins\. A plugin is only loaded if a corresponding \fBRECIPIENT\fR or \fBIDENTITY\fR is specified\. (Simply decrypting a file encrypted with a plugin will not cause it to load, for security reasons among others\.)
-.
 .P
 A \fBRECIPIENT\fR for a plugin named \fBexample\fR starts with \fBage1example1\fR, while an \fBIDENTITY\fR starts with \fBAGE\-PLUGIN\-EXAMPLE\-1\fR\. They both encode arbitrary plugin\-specific data, and are generated by the plugin\.
-.
 .P
 When either is specified, \fBage\fR searches for \fBage\-plugin\-example\fR in the PATH and executes it to perform the file header encryption or decryption\. The plugin may request input from the user through \fBage\fR to complete the operation\.
-.
 .P
 Plugins can be freely mixed with other plugins or natively supported keys\.
-.
 .P
 A plugin is not bound to only encrypt or decrypt files meant for or generated by the plugin\. For example, a plugin can be used to decrypt files encrypted to a native X25519 \fBRECIPIENT\fR or even with a passphrase\. Similarly, a plugin can encrypt a file such that it can be decrypted without the use of any plugin\.
-.
 .P
-Plugins for which the \fBIDENTITY\fR/\fBRECIPIENT\fR distinction doesn\'t make sense (such as a symmetric encryption plugin) may generate only an \fBIDENTITY\fR and instruct the user to perform encryption with the \fB\-e\fR/\fB\-\-encrypt\fR and \fB\-i\fR/\fB\-\-identity\fR flags\. Plugins for which the concept of separate identities doesn\'t make sense (such as a password\-encryption plugin) may instruct the user to use the \fB\-j\fR flag\.
-.
+Plugins for which the \fBIDENTITY\fR/\fBRECIPIENT\fR distinction doesn't make sense (such as a symmetric encryption plugin) may generate only an \fBIDENTITY\fR and instruct the user to perform encryption with the \fB\-e\fR/\fB\-\-encrypt\fR and \fB\-i\fR/\fB\-\-identity\fR flags\. Plugins for which the concept of separate identities doesn't make sense (such as a password\-encryption plugin) may instruct the user to use the \fB\-j\fR flag\.
 .SH "EXIT STATUS"
 \fBage\fR will exit 0 if and only if encryption or decryption are successful for the full length of the input\.
-.
 .P
 If an error occurs during decryption, partial output might still be generated, but only if it was possible to securely authenticate it\. No unauthenticated output is ever released\.
-.
 .SH "BACKWARDS COMPATIBILITY"
 Files encrypted with a stable version (not alpha, beta, or release candidate) of \fBage\fR, or with any v1\.0\.0 beta or release candidate, will decrypt with any later version of the tool\.
-.
 .P
 If decrypting older files poses a security risk, doing so might cause an error by default\. In this case, a flag will be provided to force the operation\.
-.
 .SH "EXAMPLES"
 Generate a new identity, encrypt data, and decrypt:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-keygen \-o key\.txt
 Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
 
 $ tar cvz ~/data | age \-r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data\.tar\.gz\.age
 
 $ age \-d \-o data\.tar\.gz \-i key\.txt data\.tar\.gz\.age
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt \fBexample\.jpg\fR to multiple recipients and output to \fBexample\.jpg\.age\fR:
-.
 .IP "" 4
-.
 .nf
-
 $ age \-o example\.jpg\.age \-r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \e
     \-r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example\.jpg
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt to a list of recipients:
-.
 .IP "" 4
-.
 .nf
-
 $ cat > recipients\.txt
 # Alice
 age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
@@ -283,36 +186,24 @@ age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
 age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
 
 $ age \-R recipients\.txt example\.jpg > example\.jpg\.age
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt and decrypt a file using a passphrase:
-.
 .IP "" 4
-.
 .nf
-
 $ age \-p secrets\.txt > secrets\.txt\.age
 Enter passphrase (leave empty to autogenerate a secure one):
 Using the autogenerated passphrase "release\-response\-step\-brand\-wrap\-ankle\-pair\-unusual\-sword\-train"\.
 
 $ age \-d secrets\.txt\.age > secrets\.txt
 Enter passphrase:
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt and decrypt with a passphrase\-protected identity file:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-keygen | age \-p > key\.age
 Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
 Enter passphrase (leave empty to autogenerate a secure one):
@@ -322,58 +213,36 @@ $ age \-r age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5 secrets
 
 $ age \-d \-i key\.age secrets\.txt\.age > secrets\.txt
 Enter passphrase for identity file "key\.age":
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt and decrypt with an SSH public key:
-.
 .IP "" 4
-.
 .nf
-
 $ age \-R ~/\.ssh/id_ed25519\.pub example\.jpg > example\.jpg\.age
 
 $ age \-d \-i ~/\.ssh/id_ed25519 example\.jpg\.age > example\.jpg
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt and decrypt with age\-plugin\-yubikey:
-.
 .IP "" 4
-.
 .nf
-
 $ age\-plugin\-yubikey # run interactive setup, generate identity file and obtain recipient
 
 $ age \-r age1yubikey1qwt50d05nh5vutpdzmlg5wn80xq5negm4uj9ghv0snvdd3yysf5yw3rhl3t secrets\.txt > secrets\.txt\.age
 
 $ age \-d \-i age\-yubikey\-identity\-388178f3\.txt secrets\.txt\.age
-.
 .fi
-.
 .IP "" 0
-.
 .P
 Encrypt to the SSH keys of a GitHub user:
-.
 .IP "" 4
-.
 .nf
-
 $ curl https://github\.com/benjojo\.keys | age \-R \- example\.jpg > example\.jpg\.age
-.
 .fi
-.
 .IP "" 0
-.
 .SH "SEE ALSO"
 age\-keygen(1)
-.
 .SH "AUTHORS"
 Filippo Valsorda \fIage@filippo\.io\fR
diff --git a/doc/age.1.html b/doc/age.1.html
index 189a4588..d94235df 100644
--- a/doc/age.1.html
+++ b/doc/age.1.html
@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <meta http-equiv='content-type' value='text/html;charset=utf8'>
-  <meta name='generator' value='Ronn/v0.7.3 (http://github.com/rtomayko/ronn/tree/0.7.3)'>
+  <meta http-equiv='content-type' content='text/html;charset=utf8'>
+  <meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
   <title>age(1) - simple, modern, and secure file encryption</title>
   <style type='text/css' media='all'>
   /* style: man */
@@ -71,16 +71,17 @@
     <li class='tr'>age(1)</li>
   </ol>
 
-  <h2 id="NAME">NAME</h2>
+  
+
+<h2 id="NAME">NAME</h2>
 <p class="man-name">
   <code>age</code> - <span class="man-whatis">simple, modern, and secure file encryption</span>
 </p>
-
 <h2 id="SYNOPSIS">SYNOPSIS</h2>
 
-<p><code>age</code> [<code>--encrypt</code>] (<code>-r</code> <var>RECIPIENT</var> | <code>-R</code> <var>PATH</var>)... [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br />
-<code>age</code> [<code>--encrypt</code>] <code>--passphrase</code> [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br />
-<code>age</code> <code>--decrypt</code> [<code>-i</code> <var>PATH</var> | <code>-j</code> <var>PLUGIN</var>]... [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br /></p>
+<p><code>age</code> [<code>--encrypt</code>] (<code>-r</code> <var>RECIPIENT</var> | <code>-R</code> <var>PATH</var>)... [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br>
+<code>age</code> [<code>--encrypt</code>] <code>--passphrase</code> [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br>
+<code>age</code> <code>--decrypt</code> [<code>-i</code> <var>PATH</var> | <code>-j</code> <var>PLUGIN</var>]... [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br></p>
 
 <h2 id="DESCRIPTION">DESCRIPTION</h2>
 
@@ -104,107 +105,148 @@ <h2 id="DESCRIPTION">DESCRIPTION</h2>
 <h2 id="OPTIONS">OPTIONS</h2>
 
 <dl>
-<dt><code>-o</code>, <code>--output</code>=<var>OUTPUT</var></dt><dd><p>  Write encrypted or decrypted file to <var>OUTPUT</var> instead of standard output.
-  If <var>OUTPUT</var> already exists it will be overwritten.</p>
-
-<p>  If encrypting without <code>--armor</code>, <code>age</code> will refuse to output binary to a
-  TTY. This can be forced by specifying <code>-</code> as <var>OUTPUT</var>.</p></dd>
-<dt><code>--version</code></dt><dd><p>  Print the version and exit.</p></dd>
+<dt>
+<code>-o</code>, <code>--output</code>=<var>OUTPUT</var>
+</dt>
+<dd>  Write encrypted or decrypted file to <var>OUTPUT</var> instead of standard output.
+  If <var>OUTPUT</var> already exists it will be overwritten.
+
+    <p>If encrypting without <code>--armor</code>, <code>age</code> will refuse to output binary to a
+  TTY. This can be forced by specifying <code>-</code> as <var>OUTPUT</var>.</p>
+</dd>
+<dt><code>--version</code></dt>
+<dd>  Print the version and exit.</dd>
 </dl>
 
-
 <h3 id="Encryption-options">Encryption options</h3>
 
 <dl>
-<dt><code>-e</code>, <code>--encrypt</code></dt><dd><p>  Encrypt <var>INPUT</var> to <var>OUTPUT</var>. This is the default.</p></dd>
-<dt><code>-r</code>, <code>--recipient</code>=<var>RECIPIENT</var></dt><dd><p>  Encrypt to the explicitly specified <var>RECIPIENT</var>. See the
-  <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS AND IDENTITIES</a> section for possible recipient formats.</p>
-
-<p>  This option can be repeated and combined with other recipient flags,
-  and the file can be decrypted by all provided recipients independently.</p></dd>
-<dt><code>-R</code>, <code>--recipients-file</code>=<var>PATH</var></dt><dd><p>  Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> listed in the
+<dt>
+<code>-e</code>, <code>--encrypt</code>
+</dt>
+<dd>  Encrypt <var>INPUT</var> to <var>OUTPUT</var>. This is the default.</dd>
+<dt>
+<code>-r</code>, <code>--recipient</code>=<var>RECIPIENT</var>
+</dt>
+<dd>  Encrypt to the explicitly specified <var>RECIPIENT</var>. See the
+  <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS AND IDENTITIES</a> section for possible recipient formats.
+
+    <p>This option can be repeated and combined with other recipient flags,
+  and the file can be decrypted by all provided recipients independently.</p>
+</dd>
+<dt>
+<code>-R</code>, <code>--recipients-file</code>=<var>PATH</var>
+</dt>
+<dd>  Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> listed in the
   file at <var>PATH</var>, one per line. Empty lines and lines starting with <code>#</code>
-  are ignored as comments.</p>
+  are ignored as comments.
 
-<p>  If <var>PATH</var> is <code>-</code>, the recipients are read from standard input. In
+    <p>If <var>PATH</var> is <code>-</code>, the recipients are read from standard input. In
   this case, the <var>INPUT</var> argument must be specified.</p>
 
-<p>  This option can be repeated and combined with other recipient flags,
-  and the file can be decrypted by all provided recipients independently.</p></dd>
-<dt><code>-p</code>, <code>--passphrase</code></dt><dd><p>  Encrypt with a passphrase, requested interactively from the terminal.
-  <code>age</code> will offer to auto-generate a secure passphrase.</p>
-
-<p>  This option can't be used with other recipient flags.</p></dd>
-<dt><code>-a</code>, <code>--armor</code></dt><dd><p>  Encrypt to an ASCII-only "armored" encoding.</p>
-
-<p>  <code>age</code> armor is a strict version of PEM with type <code>AGE ENCRYPTED FILE</code>,
+    <p>This option can be repeated and combined with other recipient flags,
+  and the file can be decrypted by all provided recipients independently.</p>
+</dd>
+<dt>
+<code>-p</code>, <code>--passphrase</code>
+</dt>
+<dd>  Encrypt with a passphrase, requested interactively from the terminal.
+  <code>age</code> will offer to auto-generate a secure passphrase.
+
+    <p>This option can't be used with other recipient flags.</p>
+</dd>
+<dt>
+<code>-a</code>, <code>--armor</code>
+</dt>
+<dd>  Encrypt to an ASCII-only "armored" encoding.
+
+    <p><code>age</code> armor is a strict version of PEM with type <code>AGE ENCRYPTED FILE</code>,
   canonical "strict" Base64, no headers, and no support for leading and
   trailing extra data.</p>
 
-<p>  Decryption transparently detects and decodes ASCII armoring.</p></dd>
-<dt><code>-i</code>, <code>--identity</code>=<var>PATH</var></dt><dd><p>  Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> corresponding to the
+    <p>Decryption transparently detects and decodes ASCII armoring.</p>
+</dd>
+<dt>
+<code>-i</code>, <code>--identity</code>=<var>PATH</var>
+</dt>
+<dd>  Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> corresponding to the
   <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> listed in the file at <var>PATH</var>. This
   is equivalent to converting the file at <var>PATH</var> to a recipients file with
-  <code>age-keygen -y</code> and then passing that to <code>-R</code>/<code>--recipients-file</code>.</p>
+  <code>age-keygen -y</code> and then passing that to <code>-R</code>/<code>--recipients-file</code>.
 
-<p>  For the format of <var>PATH</var>, see the definition of <code>-i</code>/<code>--identity</code> in the
+    <p>For the format of <var>PATH</var>, see the definition of <code>-i</code>/<code>--identity</code> in the
   <a href="#Decryption-options" title="Decryption options" data-bare-link="true">Decryption options</a> section.</p>
 
-<p>  <code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-i</code>/<code>--identity</code>
-  in encryption mode to avoid confusion.</p></dd>
-<dt><code>-j</code> <var>PLUGIN</var></dt><dd><p>  Encrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.</p>
+    <p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-i</code>/<code>--identity</code>
+  in encryption mode to avoid confusion.</p>
+</dd>
+<dt>
+<code>-j</code> <var>PLUGIN</var>
+</dt>
+<dd>  Encrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.
 
-<p>  This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
+    <p>This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
   single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p>
 
-<p>  <code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-j</code> in encryption
-  mode to avoid confusion.</p></dd>
+    <p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-j</code> in encryption
+  mode to avoid confusion.</p>
+</dd>
 </dl>
 
-
 <h3 id="Decryption-options">Decryption options</h3>
 
 <dl>
-<dt><code>-d</code>, <code>--decrypt</code></dt><dd><p>  Decrypt <var>INPUT</var> to <var>OUTPUT</var>.</p>
+<dt>
+<code>-d</code>, <code>--decrypt</code>
+</dt>
+<dd>  Decrypt <var>INPUT</var> to <var>OUTPUT</var>.
 
-<p>  If <var>INPUT</var> is passphrase encrypted, it will be automatically detected
+    <p>If <var>INPUT</var> is passphrase encrypted, it will be automatically detected
   and the passphrase will be requested interactively. Otherwise, the
   <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> specified with <code>-i</code>/<code>--identity</code>
   are used.</p>
 
-<p>  ASCII armoring is transparently detected and decoded.</p></dd>
-<dt><code>-i</code>, <code>--identity</code>=<var>PATH</var></dt><dd><p>  Decrypt using the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> at <var>PATH</var>.</p>
+    <p>ASCII armoring is transparently detected and decoded.</p>
+</dd>
+<dt>
+<code>-i</code>, <code>--identity</code>=<var>PATH</var>
+</dt>
+<dd>  Decrypt using the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> at <var>PATH</var>.
 
-<p>  <var>PATH</var> may be one of the following:</p>
+    <p><var>PATH</var> may be one of the following:</p>
 
-<p>  a. A file listing <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> one per line.
+    <p>a. A file listing <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> one per line.
   Empty lines and lines starting with "<code>#</code>" are ignored as comments.</p>
 
-<p>  b. A passphrase encrypted age file, containing
+    <p>b. A passphrase encrypted age file, containing
   <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> one per line like above.
   The passphrase is requested interactively. Note that passphrase-protected
   identity files are not necessary for most use cases, where access to the
   encrypted identity file implies access to the whole system.</p>
 
-<p>  c. An SSH private key file, in PKCS#1, PKCS#8, or OpenSSH format.
+    <p>c. An SSH private key file, in PKCS#1, PKCS#8, or OpenSSH format.
   If the private key is password-protected, the password is requested
   interactively only if the SSH identity matches the file. See the
   <a href="#SSH-keys" title="SSH keys" data-bare-link="true">SSH keys</a> section for more information, including supported key types.</p>
 
-<p>  d. "<code>-</code>", causing one of the options above to be read from standard input.
+    <p>d. "<code>-</code>", causing one of the options above to be read from standard input.
   In this case, the <var>INPUT</var> argument must be specified.</p>
 
-<p>  This option can be repeated. Identities are tried in the order in which are
+    <p>This option can be repeated. Identities are tried in the order in which are
   provided, and the first one matching one of the file's recipients is used.
   Unused identities are ignored, but it is an error if the <var>INPUT</var> file is
-  passphrase-encrypted and <code>-i</code>/<code>--identity</code> is specified.</p></dd>
-<dt><code>-j</code> <var>PLUGIN</var></dt><dd><p>  Decrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.</p>
-
-<p>  This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
-  single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p></dd>
+  passphrase-encrypted and <code>-i</code>/<code>--identity</code> is specified.</p>
+</dd>
+<dt>
+<code>-j</code> <var>PLUGIN</var>
+</dt>
+<dd>  Decrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.
+
+    <p>This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
+  single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p>
+</dd>
 </dl>
 
-
 <h2 id="RECIPIENTS-AND-IDENTITIES">RECIPIENTS AND IDENTITIES</h2>
 
 <p><code>RECIPIENTS</code> are public values, like a public key, that a file can be encrypted
@@ -388,10 +430,9 @@ <h2 id="AUTHORS">AUTHORS</h2>
 
 <p>Filippo Valsorda <a href="mailto:age@filippo.io" data-bare-link="true">age@filippo.io</a></p>
 
-
   <ol class='man-decor man-foot man foot'>
     <li class='tl'></li>
-    <li class='tc'>September 2022</li>
+    <li class='tc'>January 2023</li>
     <li class='tr'>age(1)</li>
   </ol>