This repository has no description
tools.pass: use age-detect to detect correct keys
author
lassulus
date
(Aug 27, 2025, 3:50 PM CEST)
commit
4e8412bd
4e8412bdcf2562eb153dac15a4da2348085de8d8
parent
5fd6cf85
5fd6cf85b158e26dd031d0056bc941606ea62a05
+20
-14
+20
-14
tools/pass/flake-module.nix
+20
-14
tools/pass/flake-module.nix
···
13
13
pkgs.age-plugin-fido2-hmac
14
14
pkgs.age-plugin-yubikey
15
15
self.packages.${system}.pass-otp
16
+
self.packages.${system}.age-detect
16
17
];
17
18
aliases = [ "pass" ];
18
19
wrapper =
···
23
24
...
24
25
}:
25
26
''
27
+
set -x
26
28
${envString}
27
29
${preHook}
28
30
···
31
33
if [[ ! -f "$PASS_BULK_KEY_FILE" ]] || [[ ! -s "$PASS_BULK_KEY_FILE" ]]; then
32
34
mkdir -p "$(dirname "$PASS_BULK_KEY_FILE")"
33
35
${exePath} show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true
36
+
fi
37
+
fi
38
+
39
+
# Set up identities for age decryption
40
+
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
41
+
# Use bulk key if available
42
+
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
43
+
else
44
+
# Detect available age keys
45
+
eval "$(age-detect)"
46
+
47
+
# Set up identity file if detected
48
+
if [[ -n "''${IDENTITY_FILE:-}" ]]; then
49
+
export PASSAGE_IDENTITIES_FILE="$IDENTITY_FILE"
50
+
trap 'rm -f "$IDENTITY_FILE"' EXIT
34
51
fi
35
52
fi
36
53
···
56
73
exit 1
57
74
fi
58
75
59
-
# Use bulk key for decryption if available
60
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
61
-
PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE" ${exePath} show "$pass_name" | pass-otp $clip_arg
62
-
else
63
-
${exePath} show "$pass_name" | pass-otp $clip_arg
64
-
fi
65
-
# Handle show commands with bulk key optimization
66
-
elif [[ "''${1:-}" == "show" ]]; then
67
-
if [[ -n "''${PASS_BULK_KEY_FILE:-}" ]] && [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then
68
-
PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE" ${exePath} "$@"
69
-
else
70
-
${exePath} "$@"
71
-
fi
76
+
# Show pass and pipe to OTP (identities already set up by age-detect)
77
+
${exePath} show "$pass_name" | pass-otp $clip_arg
72
78
else
73
-
# Pass all other commands directly to passage
79
+
# Pass all other commands directly to passage (identities already set up)
74
80
${exePath} "$@"
75
81
fi
76
82
'';