This repository has no description
tools.pinentry-rofi: add PIN caching and fix pango escaping
- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)
author
lassulus
date
(Jan 31, 2026, 7:33 PM CET)
commit
86718d78
86718d78266f787723dca33f931fc70a095aaaf8
parent
17fb1d6a
17fb1d6a6247fac4a8f60d0d23f79cfdd7be29cb
+66
-1
+2
tools/pinentry-rofi/flake-module.nix
+2
tools/pinentry-rofi/flake-module.nix
+64
-1
tools/pinentry-rofi/pinentry-rofi.sh
+64
-1
tools/pinentry-rofi/pinentry-rofi.sh
···
1
1
#!/usr/bin/env bash
2
2
# pinentry-rofi: A rofi-based pinentry for SSH TPM authentication
3
3
# Reads SSH_CLIENT_PID to extract SSH command context
4
+
# Caches PIN in kernel keyring for 5 minutes (sliding window)
4
5
set -efu
6
+
7
+
CACHE_KEY="pinentry-rofi-pin"
8
+
CACHE_TIMEOUT=300 # 5 minutes
9
+
10
+
# Get cached PIN from kernel keyring
11
+
get_cached_pin() {
12
+
local key_id
13
+
key_id=$(keyctl search @u user "$CACHE_KEY" 2>/dev/null) || return 1
14
+
keyctl pipe "$key_id" 2>/dev/null
15
+
}
16
+
17
+
# Store PIN in kernel keyring with timeout
18
+
cache_pin() {
19
+
local pin="$1"
20
+
# Remove old key if exists
21
+
keyctl purge user "$CACHE_KEY" >/dev/null 2>&1 || true
22
+
# Add new key with timeout
23
+
local key_id
24
+
key_id=$(keyctl add user "$CACHE_KEY" "$pin" @u)
25
+
keyctl timeout "$key_id" "$CACHE_TIMEOUT"
26
+
}
27
+
28
+
# Extend cache timeout (sliding window)
29
+
extend_cache() {
30
+
local key_id
31
+
key_id=$(keyctl search @u user "$CACHE_KEY" 2>/dev/null) || return 1
32
+
keyctl timeout "$key_id" "$CACHE_TIMEOUT"
33
+
}
34
+
35
+
# Clear cached PIN
36
+
clear_cache() {
37
+
keyctl purge user "$CACHE_KEY" >/dev/null 2>&1 || true
38
+
}
5
39
6
40
# Extract SSH args from client PID
7
41
# Groups flags with their arguments on the same line
···
42
76
[[ -n "$line" ]] && echo "$line"
43
77
}
44
78
79
+
# Escape string for pango markup
80
+
escape_pango() {
81
+
sed 's/&/\&/g; s/</\</g; s/>/\>/g'
82
+
}
83
+
45
84
# Get SSH args
46
85
ssh_args=""
47
-
if ssh_args=$(get_ssh_args 2>/dev/null); then
86
+
if ssh_args=$(get_ssh_args 2>/dev/null | escape_pango); then
48
87
: # got args
49
88
fi
50
89
···
64
103
theme_args=(-theme "$theme")
65
104
fi
66
105
106
+
# Check for cached PIN
107
+
cached_pin=""
108
+
if cached_pin=$(get_cached_pin 2>/dev/null) && [[ -n "$cached_pin" ]]; then
109
+
# Show menu with cache options
110
+
choice=$(printf "Use cached PIN\nClear cache" | rofi -dmenu \
111
+
-p "PIN cached" \
112
+
-no-fixed-num-lines \
113
+
"${mesg_args[@]}" \
114
+
"${theme_args[@]}" \
115
+
2>/dev/null) || exit 1
116
+
117
+
if [[ "$choice" == "Use cached PIN" ]]; then
118
+
extend_cache
119
+
echo "$cached_pin"
120
+
exit 0
121
+
elif [[ "$choice" == "Clear cache" ]]; then
122
+
clear_cache
123
+
fi
124
+
# Fall through to PIN prompt if cache cleared
125
+
fi
126
+
67
127
# Use rofi in password mode
68
128
result=$(rofi -dmenu \
69
129
-password \
···
73
133
"${mesg_args[@]}" \
74
134
"${theme_args[@]}" \
75
135
< /dev/null 2>/dev/null) || exit 1
136
+
137
+
# Cache the PIN
138
+
cache_pin "$result"
76
139
77
140
echo "$result"