This repository has no description
tools.pass: decrypt with phonetpm when its daemon runs
author
lassulus
committer
lassulus
date
(Oct 13, 2026, 7:27 PM CEST)
commit
eb1f4244
eb1f4244acbcadec3bfd91aa6576ae37bb179ee0
parent
ddf73d21
ddf73d2159ee26cbc0e1e59be5d7dbb6b3d2b20f
+18
-4
+16
-4
tools/age-detect/age-detect
+16
-4
tools/age-detect/age-detect
···
31
31
fi
32
32
fi
33
33
34
-
# Check for gpg-agent with an encryption subkey (third priority).
34
+
# Check for a running phonetpm daemon (third priority - phone over iroh,
35
+
# every decryption asks for a fingerprint on the phone).
36
+
# Requires: control socket of configs/phonetpm.nix and phonetpm.identity.
37
+
local phone_identity="${AGE_DETECT_KEYS_DIR:-}/age/phonetpm.identity"
38
+
if [[ -S "${XDG_RUNTIME_DIR:-}/phonetpm/control.sock" ]] && [[ -f "$phone_identity" ]]; then
39
+
cp "$phone_identity" "$temp_identities"
40
+
echo "IDENTITY_FILE=$temp_identities"
41
+
echo "DETECTED_KEY=phonetpm"
42
+
echo "KEY_TYPE=phone"
43
+
return
44
+
fi
45
+
46
+
# Check for gpg-agent with an encryption subkey (fourth priority).
35
47
# Frictionless after the first decrypt because gpg-agent caches the
36
48
# passphrase / smartcard PIN, so we prefer it over yubikey/solo2.
37
49
if command -v gpg-connect-agent >/dev/null 2>&1 \
···
45
57
return
46
58
fi
47
59
48
-
# Check for YubiKeys (fourth priority)
60
+
# Check for YubiKeys (fifth priority)
49
61
if command -v ykman >/dev/null 2>&1; then
50
62
local yubikey_serial
51
63
yubikey_serial=$(ykman info 2>/dev/null | grep "Serial number:" | cut -d: -f2 | tr -d ' ' || true)
···
98
110
echo "Detects the first available age-compatible security key and outputs:"
99
111
echo " IDENTITY_FILE=<path> - Path to temporary identity file for age (empty for Solo2)"
100
112
echo " DETECTED_KEY=<name> - Name of the detected key (e.g., yubi1, solo2, se)"
101
-
echo " KEY_TYPE=<type> - Type of key (yubikey, solo2, se)"
113
+
echo " KEY_TYPE=<type> - Type of key (yubikey, solo2, se, tpm, phone, gpg)"
102
114
echo ""
103
-
echo "Priority order: se > tpm > gpg > yubikey > solo2"
115
+
echo "Priority order: se > tpm > phone > gpg > yubikey > solo2"
104
116
;;
105
117
*)
106
118
echo "Unknown command: $1" >&2
+2
tools/pass/flake-module.nix
+2
tools/pass/flake-module.nix
···
17
17
self.packages.${system}.age-plugin-gpg
18
18
self.packages.${system}.pass-otp
19
19
self.packages.${system}.age-detect
20
+
# age-plugin-phone: encrypts to the phonetpm recipient, decrypts via the daemon
21
+
self.packages.${system}.phonetpm
20
22
]
21
23
++ (pkgs.lib.optionals pkgs.stdenv.isLinux [
22
24
self.packages.${system}.pinentry-rofi-age