forked from
lass.pds.lassul.us/superconfig
This repository has no description
tools/pass: simplify wrapper and use makeWrapper
- Remove identities file requirement
- Convert from writeShellApplication to makeWrapper
- Use PASS_BULK_KEY_FILE environment variable for bulk decryption
- Auto-create bulk key file from password store if needed
- Remove complex bulk operations logic
author
lassulus
date
(Jun 28, 2025, 7:40 PM CEST)
commit
43759bd4
43759bd43adab0736017e0da9c9f21257dfa97d1
parent
ba270441
ba270441a815696b60488918f7fa0f8fa4e38db2
+56
-74
+56
-74
tools/pass/flake-module.nix
+56
-74
tools/pass/flake-module.nix
···
1
1
{ self, ... }:
2
2
{
3
3
perSystem =
4
-
{ pkgs, system, ... }:
5
4
{
6
-
packages.pass = pkgs.writeShellApplication {
7
-
name = "pass";
5
+
pkgs,
6
+
system,
7
+
...
8
+
}:
9
+
{
10
+
packages.pass = self.libWithPkgs.${system}.makeWrapper pkgs.passage {
8
11
runtimeInputs = [
9
-
pkgs.passage
10
12
pkgs.age-plugin-se
11
13
pkgs.age-plugin-fido2-hmac
12
14
pkgs.age-plugin-yubikey
13
15
self.packages.${system}.pass-otp
14
16
];
15
-
text = ''
16
-
# Ensure age identity exists
17
-
if [ ! -f ~/.passage/identities ]; then
18
-
echo "Error: Age identity not found at ~/.passage/identities"
19
-
echo "Please copy your age private key to ~/.passage/identities"
20
-
exit 1
21
-
fi
17
+
wrapper =
18
+
{
19
+
exePath,
20
+
envString,
21
+
preHook,
22
+
...
23
+
}:
24
+
''
25
+
${envString}
26
+
${preHook}
22
27
23
-
# Handle OTP commands by delegating to pass-otp
24
-
if [[ "''${1:-}" == "otp" ]]; then
25
-
shift
26
-
# Extract pass name and options
27
-
clip_arg=""
28
-
pass_name=""
29
-
for arg in "$@"; do
30
-
case "$arg" in
31
-
"--clip"|"-c")
32
-
clip_arg="--clip"
33
-
;;
34
-
*)
35
-
pass_name="$arg"
36
-
;;
37
-
esac
38
-
done
39
-
40
-
if [[ -z "$pass_name" ]]; then
41
-
echo "Usage: pass otp [--clip,-c] pass-name"
42
-
exit 1
28
+
# Check if bulk key file should be used for decryption
29
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
30
+
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
31
+
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
32
+
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
33
+
fi
43
34
fi
44
35
45
-
# Get the password entry and pipe to pass-otp
46
-
passage show "$pass_name" | pass-otp $clip_arg
47
-
# Handle bulk operations and reencrypt with bulk key + SE fallback
48
-
elif [[ "''${1:-}" == "bulk" ]] || [[ "''${1:-}" == "reencrypt" ]]; then
49
-
if [[ "''${1:-}" == "bulk" ]]; then
50
-
shift # Remove 'bulk' from args
51
-
fi
36
+
# Handle OTP commands by delegating to pass-otp
37
+
if [[ "''${1:-}" == "otp" ]]; then
38
+
shift
39
+
# Extract pass name and options
40
+
clip_arg=""
41
+
pass_name=""
42
+
for arg in "$@"; do
43
+
case "$arg" in
44
+
"--clip"|"-c")
45
+
clip_arg="--clip"
46
+
;;
47
+
*)
48
+
pass_name="$arg"
49
+
;;
50
+
esac
51
+
done
52
52
53
-
# For reencrypt, try bulk key first, fallback to SE for failures
54
-
if [[ "''${1:-}" == "reencrypt" ]]; then
55
-
echo "Re-encrypting with bulk key first, SE fallback for failures..."
53
+
if [[ -z "$pass_name" ]]; then
54
+
echo "Usage: pass otp [--clip,-c] pass-name"
55
+
exit 1
56
+
fi
56
57
57
-
# First pass: try with bulk operations key
58
-
temp_bulk_identity=$(mktemp)
59
-
temp_se_identity=$(mktemp)
60
-
cleanup() { rm -f "$temp_bulk_identity" "$temp_se_identity"; }
61
-
trap cleanup EXIT
62
-
63
-
# Extract bulk key (this requires one hardware auth)
64
-
if passage show bulk-operations/age-key > "$temp_bulk_identity" 2>/dev/null; then
65
-
echo "First pass: using bulk operations key..."
66
-
PASSAGE_IDENTITIES_FILE="$temp_bulk_identity" passage reencrypt 2>/dev/null || {
67
-
echo "Some files failed with bulk key, retrying failed files with SE..."
68
-
# Re-enable SE identity for fallback
69
-
sed 's/^# AGE-PLUGIN-SE/AGE-PLUGIN-SE/' ~/.passage/identities > "$temp_se_identity"
70
-
PASSAGE_IDENTITIES_FILE="$temp_se_identity" passage reencrypt
71
-
}
58
+
# Use bulk key for decryption if available
59
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
60
+
PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE" ${exePath} show "$pass_name" | pass-otp $clip_arg
72
61
else
73
-
echo "Bulk key not available, using SE for all files..."
74
-
passage reencrypt
62
+
${exePath} show "$pass_name" | pass-otp $clip_arg
63
+
fi
64
+
# Handle show commands with bulk key optimization
65
+
elif [[ "''${1:-}" == "show" ]]; then
66
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
67
+
PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE" ${exePath} "$@"
68
+
else
69
+
${exePath} "$@"
75
70
fi
76
71
else
77
-
# Regular bulk operations
78
-
temp_identity=$(mktemp)
79
-
trap 'rm -f "$temp_identity"' EXIT
80
-
81
-
if passage show bulk-operations/age-key > "$temp_identity" 2>/dev/null; then
82
-
echo "Using bulk operations key..."
83
-
PASSAGE_IDENTITIES_FILE="$temp_identity" passage "$@"
84
-
else
85
-
echo "Bulk key not available, using normal identities..."
86
-
passage "$@"
87
-
fi
72
+
# Pass all other commands directly to passage
73
+
${exePath} "$@"
88
74
fi
89
-
else
90
-
# Pass all other commands directly to passage
91
-
passage "$@"
92
-
fi
93
-
'';
75
+
'';
94
76
};
95
77
};
96
78
}