This repository has no description
3.6 kB
96 lines
1{ self, ... }:
2{
3 perSystem =
4 { pkgs, system, ... }:
5 {
6 packages.pass = pkgs.writeShellApplication {
7 name = "pass";
8 runtimeInputs = [
9 pkgs.passage
10 pkgs.age-plugin-se
11 pkgs.age-plugin-fido2-hmac
12 pkgs.age-plugin-yubikey
13 self.packages.${system}.pass-otp
14 ];
15 text = ''
16 # Ensure age identity exists
17 if [ ! -f ~/.passage/identities ]; then
18 echo "Error: Age identity not found at ~/.passage/identities"
19 echo "Please copy your age private key to ~/.passage/identities"
20 exit 1
21 fi
22
23 # Handle OTP commands by delegating to pass-otp
24 if [[ "''${1:-}" == "otp" ]]; then
25 shift
26 # Extract pass name and options
27 clip_arg=""
28 pass_name=""
29 for arg in "$@"; do
30 case "$arg" in
31 "--clip"|"-c")
32 clip_arg="--clip"
33 ;;
34 *)
35 pass_name="$arg"
36 ;;
37 esac
38 done
39
40 if [[ -z "$pass_name" ]]; then
41 echo "Usage: pass otp [--clip,-c] pass-name"
42 exit 1
43 fi
44
45 # Get the password entry and pipe to pass-otp
46 passage show "$pass_name" | pass-otp $clip_arg
47 # Handle bulk operations and reencrypt with bulk key + SE fallback
48 elif [[ "''${1:-}" == "bulk" ]] || [[ "''${1:-}" == "reencrypt" ]]; then
49 if [[ "''${1:-}" == "bulk" ]]; then
50 shift # Remove 'bulk' from args
51 fi
52
53 # For reencrypt, try bulk key first, fallback to SE for failures
54 if [[ "''${1:-}" == "reencrypt" ]]; then
55 echo "Re-encrypting with bulk key first, SE fallback for failures..."
56
57 # First pass: try with bulk operations key
58 temp_bulk_identity=$(mktemp)
59 temp_se_identity=$(mktemp)
60 cleanup() { rm -f "$temp_bulk_identity" "$temp_se_identity"; }
61 trap cleanup EXIT
62
63 # Extract bulk key (this requires one hardware auth)
64 if passage show bulk-operations/age-key > "$temp_bulk_identity" 2>/dev/null; then
65 echo "First pass: using bulk operations key..."
66 PASSAGE_IDENTITIES_FILE="$temp_bulk_identity" passage reencrypt 2>/dev/null || {
67 echo "Some files failed with bulk key, retrying failed files with SE..."
68 # Re-enable SE identity for fallback
69 sed 's/^# AGE-PLUGIN-SE/AGE-PLUGIN-SE/' ~/.passage/identities > "$temp_se_identity"
70 PASSAGE_IDENTITIES_FILE="$temp_se_identity" passage reencrypt
71 }
72 else
73 echo "Bulk key not available, using SE for all files..."
74 passage reencrypt
75 fi
76 else
77 # Regular bulk operations
78 temp_identity=$(mktemp)
79 trap 'rm -f "$temp_identity"' EXIT
80
81 if passage show bulk-operations/age-key > "$temp_identity" 2>/dev/null; then
82 echo "Using bulk operations key..."
83 PASSAGE_IDENTITIES_FILE="$temp_identity" passage "$@"
84 else
85 echo "Bulk key not available, using normal identities..."
86 passage "$@"
87 fi
88 fi
89 else
90 # Pass all other commands directly to passage
91 passage "$@"
92 fi
93 '';
94 };
95 };
96}