From d16b02130585263d3abceca44c47dfcadbed0bb4 Mon Sep 17 00:00:00 2001
From: Richard Ulmer <42150522+codesoap@users.noreply.github.com>
Date: Sat, 29 Aug 2026 00:37:00 +0200
Subject: [PATCH] README: add syntax highlighting to code blocks (#713)

---
 README.md | 25 +++++++++++--------------
 SIGSUM.md |  4 ++--
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index d65caf5..ac4c61a 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ age is a simple, modern and secure file encryption tool, format, and Go library.
 
 It features small explicit keys, post-quantum support, no config options, and UNIX-style composability.
 
-```
+```console
 $ age-keygen -o key.txt
 Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
 $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
@@ -150,11 +150,9 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
 
 On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.
 
-```
-https://dl.filippo.io/age/latest?for=linux/amd64
-https://dl.filippo.io/age/v1.3.1?for=darwin/arm64
-...
-```
+- [https://dl.filippo.io/age/latest?for=linux/amd64](https://dl.filippo.io/age/latest?for=linux/amd64)
+- [https://dl.filippo.io/age/v1.3.1?for=darwin/arm64](https://dl.filippo.io/age/v1.3.1?for=darwin/arm64)
+- ...
 
 If you download the pre-built binaries, you can check their [Sigsum proofs](./SIGSUM.md).
 
@@ -239,7 +237,7 @@ default in the future.
 Post-quantum identities start with `AGE-SECRET-KEY-PQ-1...` and recipients with
 `age1pq1...`. The recipients are unfortunately ~2000 characters long.
 
-```
+```console
 $ age-keygen -pq -o key.txt
 $ age-keygen -y key.txt > recipient.txt
 $ age -R recipient.txt example.jpg > example.jpg.age
@@ -256,7 +254,7 @@ identities with `age-plugin-pq -identity`.
 
 Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
 
-```
+```console
 $ age -p secrets.txt > secrets.txt.age
 Enter passphrase (leave empty to autogenerate a secure one):
 Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
@@ -268,7 +266,7 @@ Enter passphrase:
 
 If an identity file passed to `-i` is a passphrase encrypted age file, it will be automatically decrypted.
 
-```
+```console
 $ age-keygen | age -p > key.age
 Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
 Enter passphrase (leave empty to autogenerate a secure one):
@@ -284,7 +282,7 @@ Passphrase-protected identity files are not necessary for most use cases, where
 
 As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
 
-```
+```console
 $ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
 $ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
 ```
@@ -295,7 +293,7 @@ Note that SSH key support employs more complex cryptography, and embeds a public
 
 Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
 
-```
+```console
 $ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
 ```
 
@@ -305,7 +303,7 @@ Keep in mind that people might not protect SSH keys long-term, since they are re
 
 The `age-inspect` command can display metadata about an encrypted file without decrypting it, including the recipient types, whether it uses post-quantum encryption, and the payload size.
 
-```
+```console
 $ age-inspect secrets.age
 secrets.age is an age file, version "age-encryption.org/v1".
 
@@ -322,6 +320,5 @@ Size breakdown (assuming it decrypts successfully):
                         -------------------
     Total                       1701 bytes
 
+Tip: for machine-readable output, use --json.
 ```
-
-For scripting, use `--json` to get machine-readable output.
diff --git a/SIGSUM.md b/SIGSUM.md
index 41b397c..b5b2c58 100644
--- a/SIGSUM.md
+++ b/SIGSUM.md
@@ -5,7 +5,7 @@ public append-only log, so the age project can be held accountable for every
 binary release we ever produced. This is similar to what the [Go Checksum
 Database](https://go.dev/blog/module-mirror-launch) provides.
 
-```
+```shell
 cat << EOF > age-sigsum-key.pub
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
@@ -26,7 +26,7 @@ docs](https://www.sigsum.org/getting-started/).
 
 Dear future me, to sign a new release and produce Sigsum proofs, run the following
 
-```
+```shell
 VERSION=v1.3.1
 go install sigsum.org/sigsum-go/cmd/sigsum-verify@latest
 go install github.com/tillitis/tkey-ssh-agent/cmd/tkey-ssh-agent@main