This repository has no description
3.2 kB
99 lines
1{ self, ... }:
2{
3 perSystem =
4 {
5 pkgs,
6 system,
7 ...
8 }:
9 {
10 packages.pass = self.wrapLib.makeWrapper {
11 pkgs = pkgs;
12 package = pkgs.passage;
13 runtimeInputs = [
14 pkgs.age-plugin-fido2-hmac
15 pkgs.age-plugin-yubikey
16 pkgs.age-plugin-tpm
17 self.packages.${system}.pass-otp
18 self.packages.${system}.age-detect
19 ]
20 ++ (pkgs.lib.optionals pkgs.stdenv.isDarwin [
21 pkgs.age-plugin-se
22 ])
23 ++ (pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
24 # Dummy age-plugin-se for Linux (encryption only, no Secure Enclave hardware)
25 (pkgs.writeShellScriptBin "age-plugin-se" ''
26 exec env PYTHONUNBUFFERED=1 ${
27 pkgs.python3.withPackages (ps: [ ps.cryptography ])
28 }/bin/python3 ${./age-plugin-se-dummy.py} "$@"
29 '')
30 ]);
31 aliases = [ "pass" ];
32 wrapper =
33 {
34 exePath,
35 envString,
36 preHook,
37 ...
38 }:
39 ''
40 set -x
41 ${envString}
42 ${preHook}
43
44 # Check if bulk key file should be used for decryption
45 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
46 if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
47 mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
48 ${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
49 fi
50 fi
51
52 # Set up identities for age decryption
53 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
54 # Use bulk key if available
55 export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
56 else
57 # Detect available age keys
58 export AGE_DETECT_KEYS_DIR="${self}/keys"
59 eval "$(age-detect)"
60
61 # Set up identity file if detected
62 if [[ -n "''${IDENTITY_FILE:-}" ]]; then
63 export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
64 trap 'rm -f "$IDENTITY_FILE"' EXIT
65 fi
66 fi
67
68 # Handle OTP commands by delegating to pass-otp
69 if [[ "''${1:-}" == "otp" ]]; then
70 shift
71 # Extract pass name and options
72 clip_arg=""
73 pass_name=""
74 for arg in "$@"; do
75 case "$arg" in
76 "--clip"|"-c")
77 clip_arg="--clip"
78 ;;
79 *)
80 pass_name="$arg"
81 ;;
82 esac
83 done
84
85 if [[ -z "$pass_name" ]]; then
86 echo "Usage: pass otp [--clip,-c] pass-name"
87 exit 1
88 fi
89
90 # Show pass and pipe to OTP (identities already set up by age-detect)
91 ${exePath} show "$pass_name" | pass-otp $clip_arg
92 else
93 # Pass all other commands directly to passage (identities already set up)
94 ${exePath} "$@"
95 fi
96 '';
97 };
98 };
99}