forked from
lass.pds.lassul.us/superconfig
This repository has no description
tools.pass: fix on darwin
author
lassulus
date
(Feb 15, 2026, 8:29 PM CET)
commit
22127e4f
22127e4fb30ced2bbc7568019d5fd061a813f5aa
parent
5da6db46
5da6db46e953dd989528cc5e94453f29dd78fbee
+85
-73
+85
-73
tools/pass/flake-module.nix
+85
-73
tools/pass/flake-module.nix
···
16
16
pkgs.age-plugin-tpm
17
17
self.packages.${system}.pass-otp
18
18
self.packages.${system}.age-detect
19
-
self.packages.${system}.pinentry-rofi-age
20
19
]
20
+
++ (pkgs.lib.optionals pkgs.stdenv.isLinux [
21
+
self.packages.${system}.pinentry-rofi-age
22
+
])
21
23
++ (pkgs.lib.optionals pkgs.stdenv.isDarwin [
22
24
pkgs.age-plugin-se
23
25
])
···
38
40
...
39
41
}:
40
42
''
41
-
set -x
42
-
${envString}
43
-
${preHook}
43
+
set -x
44
+
${envString}
45
+
${preHook}
44
46
45
-
# Check if bulk key file should be used for decryption
46
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
47
-
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
48
-
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
49
-
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
50
-
fi
51
-
fi
47
+
# Check if bulk key file should be used for decryption
48
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
49
+
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
50
+
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
51
+
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
52
+
fi
53
+
fi
52
54
53
-
# Set up identities for age decryption
54
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
55
-
# Use bulk key if available
56
-
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
57
-
else
58
-
# Detect available age keys
59
-
export AGE_DETECT_KEYS_DIR="${self}/keys"
60
-
eval "$(age-detect)"
55
+
# Set up identities for age decryption
56
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
57
+
# Use bulk key if available
58
+
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
59
+
else
60
+
# Detect available age keys
61
+
export AGE_DETECT_KEYS_DIR="${self}/keys"
62
+
eval "$(age-detect)"
61
63
62
-
# Set up identity file if detected
63
-
if [[ -n "''${IDENTITY_FILE:-}" ]]; then
64
-
export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
65
-
trap 'rm -f "$IDENTITY_FILE"' EXIT
66
-
fi
67
-
fi
64
+
# Set up identity file if detected
65
+
if [[ -n "''${IDENTITY_FILE:-}" ]]; then
66
+
export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
67
+
trap 'rm -f "$IDENTITY_FILE"' EXIT
68
+
fi
69
+
fi
68
70
69
-
maybe_set_tpm_pin() {
70
-
local target="''${1:-<stdin>}"
71
-
if [[ "''${KEY_TYPE:-}" != "tpm" ]]; then
72
-
return 0
73
-
fi
74
-
if [[ -n "''${AGE_TPM_PIN:-}" ]]; then
75
-
return 0
76
-
fi
77
-
AGE_TPM_PIN="$(${self.packages.${system}.pinentry-rofi-age}/bin/pinentry-rofi-age "$target")"
78
-
export AGE_TPM_PIN
71
+
${
72
+
if pkgs.stdenv.isLinux then
73
+
''
74
+
maybe_set_tpm_pin() {
75
+
local target="''${1:-<stdin>}"
76
+
if [[ "''${KEY_TYPE:-}" != "tpm" ]]; then
77
+
return 0
78
+
fi
79
+
if [[ -n "''${AGE_TPM_PIN:-}" ]]; then
80
+
return 0
81
+
fi
82
+
AGE_TPM_PIN="$(${self.packages.${system}.pinentry-rofi-age}/bin/pinentry-rofi-age "$target")"
83
+
export AGE_TPM_PIN
84
+
}
85
+
86
+
decrypt_target=""
87
+
if [[ "''${1:-}" == "show" ]]; then
88
+
decrypt_target="''${2:-}"
89
+
elif [[ -n "''${1:-}" ]] && [[ "''${1:-}" != -* ]] && [[ "''${1:-}" != "otp" ]]; then
90
+
decrypt_target="''${1:-}"
91
+
fi
92
+
93
+
if [[ -n "$decrypt_target" ]]; then
94
+
maybe_set_tpm_pin "$decrypt_target"
95
+
fi
96
+
''
97
+
else
98
+
''
99
+
# No TPM on Darwin, define no-op
100
+
maybe_set_tpm_pin() { :; }
101
+
''
79
102
}
80
103
81
-
decrypt_target=""
82
-
if [[ "''${1:-}" == "show" ]]; then
83
-
decrypt_target="''${2:-}"
84
-
elif [[ -n "''${1:-}" ]] && [[ "''${1:-}" != -* ]] && [[ "''${1:-}" != "otp" ]]; then
85
-
decrypt_target="''${1:-}"
86
-
fi
104
+
# Handle OTP commands by delegating to pass-otp
105
+
if [[ "''${1:-}" == "otp" ]]; then
106
+
shift
107
+
# Extract pass name and options
108
+
clip_arg=""
109
+
pass_name=""
110
+
for arg in "$@"; do
111
+
case "$arg" in
112
+
"--clip"|"-c")
113
+
clip_arg="--clip"
114
+
;;
115
+
*)
116
+
pass_name="$arg"
117
+
;;
118
+
esac
119
+
done
87
120
88
-
if [[ -n "$decrypt_target" ]]; then
89
-
maybe_set_tpm_pin "$decrypt_target"
90
-
fi
121
+
if [[ -z "$pass_name" ]]; then
122
+
echo "Usage: pass otp [--clip,-c] pass-name"
123
+
exit 1
124
+
fi
91
125
92
-
# Handle OTP commands by delegating to pass-otp
93
-
if [[ "''${1:-}" == "otp" ]]; then
94
-
shift
95
-
# Extract pass name and options
96
-
clip_arg=""
97
-
pass_name=""
98
-
for arg in "$@"; do
99
-
case "$arg" in
100
-
"--clip"|"-c")
101
-
clip_arg="--clip"
102
-
;;
103
-
*)
104
-
pass_name="$arg"
105
-
;;
106
-
esac
107
-
done
108
-
109
-
if [[ -z "$pass_name" ]]; then
110
-
echo "Usage: pass otp [--clip,-c] pass-name"
111
-
exit 1
112
-
fi
113
-
114
-
# Show pass and pipe to OTP (identities already set up by age-detect)
115
-
maybe_set_tpm_pin "$pass_name"
116
-
${exePath} show "$pass_name" | pass-otp $clip_arg
117
-
else
118
-
# Pass all other commands directly to passage (identities already set up)
119
-
${exePath} "$@"
120
-
fi
126
+
# Show pass and pipe to OTP (identities already set up by age-detect)
127
+
maybe_set_tpm_pin "$pass_name"
128
+
${exePath} show "$pass_name" | pass-otp $clip_arg
129
+
else
130
+
# Pass all other commands directly to passage (identities already set up)
131
+
${exePath} "$@"
132
+
fi
121
133
'';
122
134
};
123
135
};