This repository has no description
tools.pass: use pinentry-rofi-age for bulk key decryption
author
lassulus
date
(Mar 10, 2026, 11:15 AM CET)
commit
21eba715
21eba71576fad37a84c829bc56ed8b4c7f373f0e
parent
9b95512d
9b95512d3af8e54baa664e2976727d4714e9feab
+40
-34
+40
-34
tools/pass/flake-module.nix
+40
-34
tools/pass/flake-module.nix
···
51
51
;;
52
52
esac
53
53
54
-
setup_identities() {
55
-
# Check if bulk key file should be used for decryption
56
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
57
-
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
58
-
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
59
-
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
60
-
fi
61
-
fi
62
-
63
-
# Set up identities for age decryption
64
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
65
-
# Use bulk key if available
66
-
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
67
-
else
68
-
# Detect available age keys
69
-
export AGE_DETECT_KEYS_DIR="${self}/keys"
70
-
eval "$(age-detect)"
71
-
72
-
# Set up identity file if detected
73
-
if [[ -n "''${IDENTITY_FILE:-}" ]]; then
74
-
export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
75
-
trap 'rm -f "$IDENTITY_FILE"' EXIT
76
-
fi
77
-
fi
78
-
}
79
-
80
-
if [[ "$needs_decrypt" == true ]]; then
81
-
setup_identities
82
-
fi
83
-
84
54
${
85
55
if pkgs.stdenv.isLinux then
86
56
''
···
95
65
AGE_TPM_PIN="$(${self.packages.${system}.pinentry-rofi-age}/bin/pinentry-rofi-age "$target")"
96
66
export AGE_TPM_PIN
97
67
}
68
+
''
69
+
else
70
+
''
71
+
# No TPM on Darwin, define no-op
72
+
maybe_set_tpm_pin() { :; }
73
+
''
74
+
}
98
75
76
+
setup_identities() {
77
+
# Always detect available age keys first
78
+
export AGE_DETECT_KEYS_DIR="${self}/keys"
79
+
eval "$(age-detect)"
80
+
81
+
# Set up identity file if detected
82
+
if [[ -n "''${IDENTITY_FILE:-}" ]]; then
83
+
export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
84
+
trap 'rm -f "$IDENTITY_FILE"' EXIT
85
+
fi
86
+
87
+
# Try to decrypt and cache the bulk key using the detected identity
88
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]]; then
89
+
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
90
+
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
91
+
maybe_set_tpm_pin "bulk-operations/age-key"
92
+
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
93
+
fi
94
+
# Switch to bulk key for subsequent operations if available
95
+
if [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
96
+
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
97
+
fi
98
+
fi
99
+
}
100
+
101
+
if [[ "$needs_decrypt" == true ]]; then
102
+
setup_identities
103
+
fi
104
+
105
+
${
106
+
if pkgs.stdenv.isLinux then
107
+
''
99
108
decrypt_target=""
100
109
if [[ "''${1:-}" == "show" ]]; then
101
110
decrypt_target="''${2:-}"
···
120
129
fi
121
130
''
122
131
else
123
-
''
124
-
# No TPM on Darwin, define no-op
125
-
maybe_set_tpm_pin() { :; }
126
-
''
132
+
""
127
133
}
128
134
129
135
# Handle OTP commands by delegating to pass-otp