This repository has no description
3.2 kB
98 lines
1{ self, ... }:
2{
3 perSystem =
4 {
5 pkgs,
6 system,
7 ...
8 }:
9 {
10 packages.pass = self.wrapLib.makeWrapper {
11 pkgs = pkgs;
12 package = pkgs.passage;
13 runtimeInputs =
14 [
15 pkgs.age-plugin-fido2-hmac
16 pkgs.age-plugin-yubikey
17 pkgs.age-plugin-tpm
18 self.packages.${system}.pass-otp
19 self.packages.${system}.age-detect
20 ]
21 ++ (pkgs.lib.optionals pkgs.stdenv.isDarwin [
22 pkgs.age-plugin-se
23 ])
24 ++ (pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
25 # Dummy age-plugin-se for Linux (encryption only, no Secure Enclave hardware)
26 (pkgs.writeShellScriptBin "age-plugin-se" ''
27 exec env PYTHONUNBUFFERED=1 ${pkgs.python3.withPackages (ps: [ ps.cryptography ])}/bin/python3 ${./age-plugin-se-dummy.py} "$@"
28 '')
29 ]);
30 aliases = [ "pass" ];
31 wrapper =
32 {
33 exePath,
34 envString,
35 preHook,
36 ...
37 }:
38 ''
39 set -x
40 ${envString}
41 ${preHook}
42
43 # Check if bulk key file should be used for decryption
44 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
45 if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
46 mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
47 ${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
48 fi
49 fi
50
51 # Set up identities for age decryption
52 if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
53 # Use bulk key if available
54 export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
55 else
56 # Detect available age keys
57 export AGE_DETECT_KEYS_DIR="${self}/keys"
58 eval "$(age-detect)"
59
60 # Set up identity file if detected
61 if [[ -n "''${IDENTITY_FILE:-}" ]]; then
62 export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
63 trap 'rm -f "$IDENTITY_FILE"' EXIT
64 fi
65 fi
66
67 # Handle OTP commands by delegating to pass-otp
68 if [[ "''${1:-}" == "otp" ]]; then
69 shift
70 # Extract pass name and options
71 clip_arg=""
72 pass_name=""
73 for arg in "$@"; do
74 case "$arg" in
75 "--clip"|"-c")
76 clip_arg="--clip"
77 ;;
78 *)
79 pass_name="$arg"
80 ;;
81 esac
82 done
83
84 if [[ -z "$pass_name" ]]; then
85 echo "Usage: pass otp [--clip,-c] pass-name"
86 exit 1
87 fi
88
89 # Show pass and pipe to OTP (identities already set up by age-detect)
90 ${exePath} show "$pass_name" | pass-otp $clip_arg
91 else
92 # Pass all other commands directly to passage (identities already set up)
93 ${exePath} "$@"
94 fi
95 '';
96 };
97 };
98}