This repository has no description
6.8 kB
175 lines
1{ self, inputs, ... }:
2{
3 perSystem =
4 {
5 pkgs,
6 system,
7 ...
8 }:
9 {
10 packages.pass = inputs.wrappers.lib.wrapPackage {
11 pkgs = pkgs;
12 package = pkgs.passage;
13 runtimeInputs = [
14 pkgs.age-plugin-fido2-hmac
15 pkgs.age-plugin-yubikey
16 pkgs.age-plugin-tpm
17 self.packages.${system}.age-plugin-gpg
18 self.packages.${system}.pass-otp
19 self.packages.${system}.age-detect
20 ]
21 ++ (pkgs.lib.optionals pkgs.stdenv.isLinux [
22 self.packages.${system}.pinentry-rofi-age
23 ])
24 ++ (pkgs.lib.optionals pkgs.stdenv.isDarwin [
25 pkgs.age-plugin-se
26 ])
27 ++ (pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
28 # Dummy age-plugin-se for Linux (encryption only, no Secure Enclave hardware)
29 (pkgs.writeShellScriptBin "age-plugin-se" ''
30 exec env PYTHONUNBUFFERED=1 ${
31 pkgs.python3.withPackages (ps: [ ps.cryptography ])
32 }/bin/python3 ${./age-plugin-se-dummy.py} "$@"
33 '')
34 ]);
35 aliases = [ "pass" ];
36 wrapper =
37 {
38 exePath,
39 envString,
40 preHook,
41 ...
42 }:
43 ''
44 ${envString}
45 ${preHook}
46
47 # Determine if the command needs decryption
48 needs_decrypt=true
49 case "''${1:-}" in
50 ls|find|git|insert|generate|rm|mv|cp|help|version|init)
51 needs_decrypt=false
52 ;;
53 esac
54
55 ${
56 if pkgs.stdenv.isLinux then
57 ''
58 maybe_set_tpm_pin() {
59 local target="''${1:-<stdin>}"
60 if [[ "''${KEY_TYPE:-}" != "tpm" ]]; then
61 return 0
62 fi
63 if [[ -n "''${AGE_TPM_PIN:-}" ]]; then
64 return 0
65 fi
66 AGE_TPM_PIN="$(${self.packages.${system}.pinentry-rofi-age}/bin/pinentry-rofi-age "$target")"
67 export AGE_TPM_PIN
68 }
69 ''
70 else
71 ''
72 # No TPM on Darwin, define no-op
73 maybe_set_tpm_pin() { :; }
74 ''
75 }
76
77 setup_identities() {
78 # Always detect available age keys first
79 export AGE_DETECT_KEYS_DIR="${
80 builtins.path {
81 path = self + "/keys";
82 name = "keys";
83 }
84 }"
85 eval "$(age-detect)"
86
87 # Set up identity file if detected
88 if [[ -n "''${IDENTITY_FILE:-}" ]]; then
89 export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
90 trap 'rm -f "$IDENTITY_FILE"' EXIT
91 fi
92
93 # Try to decrypt and cache the bulk key using the detected identity
94 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
95 if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
96 mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
97 maybe_set_tpm_pin "bulk-operations/age-key"
98 ${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
99 fi
100 # Switch to bulk key for subsequent operations if available
101 if [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
102 export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
103 # Bulk key is a plain age key, no TPM PIN needed for decryption
104 export KEY_TYPE=bulk
105 fi
106 fi
107 }
108
109 if [[ "$needs_decrypt" == true ]]; then
110 setup_identities
111 fi
112
113 ${
114 if pkgs.stdenv.isLinux then
115 ''
116 decrypt_target=""
117 if [[ "''${1:-}" == "show" ]]; then
118 decrypt_target="''${2:-}"
119 elif [[ -n "''${1:-}" ]] && [[ "''${1:-}" != -* ]] && [[ "''${1:-}" != "otp" ]]; then
120 # Skip passage subcommands that don't need decryption
121 case "''${1:-}" in
122 ls|find|git|insert|generate|rm|mv|cp|help|version|init)
123 ;;
124 edit|grep|reencrypt)
125 # These commands do decrypt, prompt with command as target
126 decrypt_target="''${2:-''${1:-}}"
127 ;;
128 *)
129 # Bare pass-name (implicit show)
130 decrypt_target="''${1:-}"
131 ;;
132 esac
133 fi
134
135 if [[ -n "$decrypt_target" ]]; then
136 maybe_set_tpm_pin "$decrypt_target"
137 fi
138 ''
139 else
140 ""
141 }
142
143 # Handle OTP commands by delegating to pass-otp
144 if [[ "''${1:-}" == "otp" ]]; then
145 shift
146 # Extract pass name and options
147 clip_arg=""
148 pass_name=""
149 for arg in "$@"; do
150 case "$arg" in
151 "--clip"|"-c")
152 clip_arg="--clip"
153 ;;
154 *)
155 pass_name="$arg"
156 ;;
157 esac
158 done
159
160 if [[ -z "$pass_name" ]]; then
161 echo "Usage: pass otp [--clip,-c] pass-name"
162 exit 1
163 fi
164
165 # Show pass and pipe to OTP (identities already set up by age-detect)
166 maybe_set_tpm_pin "$pass_name"
167 ${exePath} show "$pass_name" | pass-otp $clip_arg
168 else
169 # Pass all other commands directly to passage (identities already set up)
170 ${exePath} "$@"
171 fi
172 '';
173 };
174 };
175}