Windows (WSL)

enveigh runs inside Ubuntu on WSL 2 (Windows Subsystem for Linux) as the ordinary Linux terminal edition. It protects agents that run inside that WSL distribution. It does not serve PowerShell or native Windows programs.

Status: not yet verified on Windows. The package, first run, vault, GPG approval, enveigh run, MCP and the Cloud sign-in were tested in a clean Ubuntu 24.04 container, the same userland as Ubuntu on WSL. The WSL-specific parts (the Windows browser and the Windows clipboard) are covered by unit tests only. If something below does not work for you, write to support@enveigh.com.

WSL support starts with the 0.3.0 Linux beta. The files are on the beta page.

Install

1. In PowerShell, install Ubuntu 24.04 on WSL 2, then open Ubuntu and create your Linux user:

   wsl --install -d Ubuntu-24.04
   wsl -l -v

   wsl -l -v should show the distribution at version 2.

2. In Ubuntu, download the package and its checksum into your Linux home folder, not under /mnt/c, check it, and install it. Use arm64 instead of amd64 on Windows on ARM.

   cd ~
   curl -fsSLO https://enveigh.com/enveigh_0.3.0~linux.2_amd64.deb
   curl -fsSLO https://enveigh.com/enveigh_0.3.0~linux.2_amd64.sha256
   sha256sum --ignore-missing -c enveigh_0.3.0~linux.2_amd64.sha256
   sudo apt install ./enveigh_0.3.0~linux.2_amd64.deb

3. Run enveigh as your normal user, as on any Linux machine.

The background service and systemd

With systemd, enveigh installs and enables its user service as on a Linux desktop. WSL turns systemd on per distribution. Add this to /etc/wsl.conf (create the file with sudo if it is missing):

[boot]
systemd=true

Then run wsl --shutdown in PowerShell and open Ubuntu again. systemctl --user status should answer.

Without systemd, enveigh starts a background enveigh serve itself and logs to ~/.local/share/enveigh/service.log. WSL stops a distribution some time after its last terminal closes, and that ends the service and every task session. Run enveigh again after reopening Ubuntu.

GPG and pinentry

The package uses pinentry-curses, which asks for your GPG passphrase inside the terminal. For other GPG use, add export GPG_TTY=$(tty) to ~/.bashrc. If WSLg shows a Linux window for the passphrase instead, put pinentry-program /usr/bin/pinentry-curses in ~/.gnupg/gpg-agent.conf and run gpgconf --reload gpg-agent.

Cloud sign-in in the Windows browser

enveigh cloud opens the sign-in page in your Windows browser. It tries wslview from the wslu package (sudo apt install wslu), then the Windows URL handler through WSL interop, then xdg-open. If none of them opens a page, the address stays on screen. Copy it into any browser.

Clipboard

On Windows 11, WSLg shares one clipboard between Windows and Linux. With wl-clipboard installed (sudo apt install wl-clipboard), enveigh reads it as on a Wayland desktop. Without it, enveigh reads the Windows clipboard through PowerShell. That needs WSL interop (on by default) and drive C mounted at /mnt/c. PowerShell starts slowly, so clipboard watch checks every 5 seconds there instead of every 2.

Copy value for 45 seconds works only through WSLg with wl-clipboard, because Windows gives enveigh no way to take the value back. Otherwise reveal the value instead.

Known limits

• No hardware key by default. WSL does not see USB devices. A YubiKey needs USB passthrough with usbipd-win.
• Windows Hello is not used. Approvals use your GPG passphrase, as on other Linux machines.
• Windows programs can read your WSL files through \\wsl$, including the vault folder. Values stay GPG-encrypted, but treat software on the Windows side as running as you.
• Agents must run inside WSL. An agent running on Windows cannot reach the enveigh service inside WSL.
• Notifications need notify-send and a notification service inside WSL, which WSL does not provide by default. The audit log still records every access.