This repository has no description
3.1 kB
96 lines
1{ self, ... }:
2{
3 perSystem =
4 {
5 pkgs,
6 system,
7 ...
8 }:
9 {
10 packages.pass = self.wrapLib.makeWrapper {
11 pkgs = pkgs;
12 package = pkgs.passage;
13 runtimeInputs =
14 [
15 pkgs.age-plugin-fido2-hmac
16 pkgs.age-plugin-yubikey
17 self.packages.${system}.pass-otp
18 self.packages.${system}.age-detect
19 ]
20 ++ (pkgs.lib.optionals pkgs.stdenv.isDarwin [
21 pkgs.age-plugin-se
22 ])
23 ++ (pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
24 # Dummy age-plugin-se for Linux (encryption only, no Secure Enclave hardware)
25 (pkgs.writeShellScriptBin "age-plugin-se" ''
26 exec env PYTHONUNBUFFERED=1 ${pkgs.python3.withPackages (ps: [ ps.cryptography ])}/bin/python3 ${./age-plugin-se-dummy.py} "$@"
27 '')
28 ]);
29 aliases = [ "pass" ];
30 wrapper =
31 {
32 exePath,
33 envString,
34 preHook,
35 ...
36 }:
37 ''
38 set -x
39 ${envString}
40 ${preHook}
41
42 # Check if bulk key file should be used for decryption
43 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
44 if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
45 mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
46 ${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
47 fi
48 fi
49
50 # Set up identities for age decryption
51 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
52 # Use bulk key if available
53 export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
54 else
55 # Detect available age keys
56 eval "$(age-detect)"
57
58 # Set up identity file if detected
59 if [[ -n "''${IDENTITY_FILE:-}" ]]; then
60 export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
61 trap 'rm -f "$IDENTITY_FILE"' EXIT
62 fi
63 fi
64
65 # Handle OTP commands by delegating to pass-otp
66 if [[ "''${1:-}" == "otp" ]]; then
67 shift
68 # Extract pass name and options
69 clip_arg=""
70 pass_name=""
71 for arg in "$@"; do
72 case "$arg" in
73 "--clip"|"-c")
74 clip_arg="--clip"
75 ;;
76 *)
77 pass_name="$arg"
78 ;;
79 esac
80 done
81
82 if [[ -z "$pass_name" ]]; then
83 echo "Usage: pass otp [--clip,-c] pass-name"
84 exit 1
85 fi
86
87 # Show pass and pipe to OTP (identities already set up by age-detect)
88 ${exePath} show "$pass_name" | pass-otp $clip_arg
89 else
90 # Pass all other commands directly to passage (identities already set up)
91 ${exePath} "$@"
92 fi
93 '';
94 };
95 };
96}