|
|
|
@ -6,9 +6,7 @@ let |
|
|
|
|
cfg = config.programs.gpg; |
|
|
|
|
|
|
|
|
|
mkKeyValue = key: value: |
|
|
|
|
if isString value |
|
|
|
|
then "${key} ${value}" |
|
|
|
|
else optionalString value key; |
|
|
|
|
if isString value then "${key} ${value}" else optionalString value key; |
|
|
|
|
|
|
|
|
|
cfgText = generators.toKeyValue { |
|
|
|
|
inherit mkKeyValue; |
|
|
|
@ -22,7 +20,7 @@ let |
|
|
|
|
|
|
|
|
|
primitiveType = types.oneOf [ types.str types.bool ]; |
|
|
|
|
|
|
|
|
|
publicKeyOpts = { config, ...}: { |
|
|
|
|
publicKeyOpts = { config, ... }: { |
|
|
|
|
options = { |
|
|
|
|
text = mkOption { |
|
|
|
|
type = types.nullOr types.str; |
|
|
|
@ -40,7 +38,18 @@ let |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
trust = mkOption { |
|
|
|
|
type = types.nullOr (types.enum ["unknown" 1 "never" 2 "marginal" 3 "full" 4 "ultimate" 5]); |
|
|
|
|
type = types.nullOr (types.enum [ |
|
|
|
|
"unknown" |
|
|
|
|
1 |
|
|
|
|
"never" |
|
|
|
|
2 |
|
|
|
|
"marginal" |
|
|
|
|
3 |
|
|
|
|
"full" |
|
|
|
|
4 |
|
|
|
|
"ultimate" |
|
|
|
|
5 |
|
|
|
|
]); |
|
|
|
|
default = null; |
|
|
|
|
apply = v: |
|
|
|
|
if isString v then |
|
|
|
@ -51,7 +60,8 @@ let |
|
|
|
|
full = 4; |
|
|
|
|
ultimate = 5; |
|
|
|
|
}.${v} |
|
|
|
|
else v; |
|
|
|
|
else |
|
|
|
|
v; |
|
|
|
|
description = '' |
|
|
|
|
The amount of trust you have in the key ownership and the care the |
|
|
|
|
owner puts into signing other keys. The available levels are |
|
|
|
@ -85,58 +95,55 @@ let |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
config = { |
|
|
|
|
source = mkIf (config.text != null) |
|
|
|
|
(pkgs.writeText "gpg-pubkey" config.text); |
|
|
|
|
source = |
|
|
|
|
mkIf (config.text != null) (pkgs.writeText "gpg-pubkey" config.text); |
|
|
|
|
}; |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
importTrustBashFunctions = |
|
|
|
|
let gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
in '' |
|
|
|
|
function gpgKeyId() { |
|
|
|
|
${gpg} --show-key --with-colons "$1" \ |
|
|
|
|
| grep ^pub: \ |
|
|
|
|
| cut -d: -f5 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
function importTrust() { |
|
|
|
|
local keyId trust |
|
|
|
|
keyId="$(gpgKeyId "$1")" |
|
|
|
|
trust="$2" |
|
|
|
|
if [[ -n $keyId ]] ; then |
|
|
|
|
{ echo trust; echo "$trust"; (( trust == 5 )) && echo y; echo quit; } \ |
|
|
|
|
| ${gpg} --no-tty --command-fd 0 --edit-key "$keyId" |
|
|
|
|
fi |
|
|
|
|
} |
|
|
|
|
importTrustBashFunctions = let gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
in '' |
|
|
|
|
function gpgKeyId() { |
|
|
|
|
${gpg} --show-key --with-colons "$1" \ |
|
|
|
|
| grep ^pub: \ |
|
|
|
|
| cut -d: -f5 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
function importTrust() { |
|
|
|
|
local keyId trust |
|
|
|
|
keyId="$(gpgKeyId "$1")" |
|
|
|
|
trust="$2" |
|
|
|
|
if [[ -n $keyId ]] ; then |
|
|
|
|
{ echo trust; echo "$trust"; (( trust == 5 )) && echo y; echo quit; } \ |
|
|
|
|
| ${gpg} --no-tty --command-fd 0 --edit-key "$keyId" |
|
|
|
|
fi |
|
|
|
|
} |
|
|
|
|
''; |
|
|
|
|
|
|
|
|
|
keyringFiles = |
|
|
|
|
let |
|
|
|
|
gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
keyringFiles = let |
|
|
|
|
gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
|
|
|
|
|
importKey = { source, trust, ... }: '' |
|
|
|
|
${gpg} --import ${source} |
|
|
|
|
${optionalString (trust != null) '' |
|
|
|
|
importTrust "${source}" ${toString trust}''} |
|
|
|
|
''; |
|
|
|
|
importKey = { source, trust, ... }: '' |
|
|
|
|
${gpg} --import ${source} |
|
|
|
|
${optionalString (trust != null) |
|
|
|
|
''importTrust "${source}" ${toString trust}''} |
|
|
|
|
''; |
|
|
|
|
|
|
|
|
|
importKeys = concatMapStringsSep "\n" importKey cfg.publicKeys; |
|
|
|
|
in pkgs.runCommand "gpg-pubring" { buildInputs = [ cfg.package ]; } '' |
|
|
|
|
export GNUPGHOME |
|
|
|
|
GNUPGHOME=$(mktemp -d) |
|
|
|
|
importKeys = concatMapStringsSep "\n" importKey cfg.publicKeys; |
|
|
|
|
in pkgs.runCommand "gpg-pubring" { buildInputs = [ cfg.package ]; } '' |
|
|
|
|
export GNUPGHOME |
|
|
|
|
GNUPGHOME=$(mktemp -d) |
|
|
|
|
|
|
|
|
|
${importTrustBashFunctions} |
|
|
|
|
${importKeys} |
|
|
|
|
${importTrustBashFunctions} |
|
|
|
|
${importKeys} |
|
|
|
|
|
|
|
|
|
mkdir $out |
|
|
|
|
cp $GNUPGHOME/pubring.kbx $out/pubring.kbx |
|
|
|
|
if [[ -e $GNUPGHOME/trustdb.gpg ]] ; then |
|
|
|
|
cp $GNUPGHOME/trustdb.gpg $out/trustdb.gpg |
|
|
|
|
fi |
|
|
|
|
''; |
|
|
|
|
mkdir $out |
|
|
|
|
cp $GNUPGHOME/pubring.kbx $out/pubring.kbx |
|
|
|
|
if [[ -e $GNUPGHOME/trustdb.gpg ]] ; then |
|
|
|
|
cp $GNUPGHOME/trustdb.gpg $out/trustdb.gpg |
|
|
|
|
fi |
|
|
|
|
''; |
|
|
|
|
|
|
|
|
|
in |
|
|
|
|
{ |
|
|
|
|
in { |
|
|
|
|
options.programs.gpg = { |
|
|
|
|
enable = mkEnableOption "GnuPG"; |
|
|
|
|
|
|
|
|
@ -145,11 +152,13 @@ in |
|
|
|
|
default = pkgs.gnupg; |
|
|
|
|
defaultText = literalExpression "pkgs.gnupg"; |
|
|
|
|
example = literalExpression "pkgs.gnupg23"; |
|
|
|
|
description = "The Gnupg package to use (also used the gpg-agent service)."; |
|
|
|
|
description = |
|
|
|
|
"The Gnupg package to use (also used the gpg-agent service)."; |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
settings = mkOption { |
|
|
|
|
type = types.attrsOf (types.either primitiveType (types.listOf types.str)); |
|
|
|
|
type = |
|
|
|
|
types.attrsOf (types.either primitiveType (types.listOf types.str)); |
|
|
|
|
example = literalExpression '' |
|
|
|
|
{ |
|
|
|
|
no-comments = false; |
|
|
|
@ -167,7 +176,8 @@ in |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
scdaemonSettings = mkOption { |
|
|
|
|
type = types.attrsOf (types.either primitiveType (types.listOf types.str)); |
|
|
|
|
type = |
|
|
|
|
types.attrsOf (types.either primitiveType (types.listOf types.str)); |
|
|
|
|
example = literalExpression '' |
|
|
|
|
{ |
|
|
|
|
disable-ccid = true; |
|
|
|
@ -182,9 +192,10 @@ in |
|
|
|
|
|
|
|
|
|
homedir = mkOption { |
|
|
|
|
type = types.path; |
|
|
|
|
example = literalExpression "\"\${config.xdg.dataHome}/gnupg\""; |
|
|
|
|
example = literalExpression ''"''${config.xdg.dataHome}/gnupg"''; |
|
|
|
|
default = "${config.home.homeDirectory}/.gnupg"; |
|
|
|
|
defaultText = literalExpression "\"\${config.home.homeDirectory}/.gnupg\""; |
|
|
|
|
defaultText = |
|
|
|
|
literalExpression ''"''${config.home.homeDirectory}/.gnupg"''; |
|
|
|
|
description = "Directory to store keychains and configuration."; |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
@ -236,7 +247,8 @@ in |
|
|
|
|
personal-cipher-preferences = mkDefault "AES256 AES192 AES"; |
|
|
|
|
personal-digest-preferences = mkDefault "SHA512 SHA384 SHA256"; |
|
|
|
|
personal-compress-preferences = mkDefault "ZLIB BZIP2 ZIP Uncompressed"; |
|
|
|
|
default-preference-list = mkDefault "SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed"; |
|
|
|
|
default-preference-list = mkDefault |
|
|
|
|
"SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed"; |
|
|
|
|
cert-digest-algo = mkDefault "SHA512"; |
|
|
|
|
s2k-digest-algo = mkDefault "SHA512"; |
|
|
|
|
s2k-cipher-algo = mkDefault "AES256"; |
|
|
|
@ -258,9 +270,7 @@ in |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
home.packages = [ cfg.package ]; |
|
|
|
|
home.sessionVariables = { |
|
|
|
|
GNUPGHOME = cfg.homedir; |
|
|
|
|
}; |
|
|
|
|
home.sessionVariables = { GNUPGHOME = cfg.homedir; }; |
|
|
|
|
|
|
|
|
|
home.file."${cfg.homedir}/gpg.conf".text = cfgText; |
|
|
|
|
|
|
|
|
@ -268,45 +278,42 @@ in |
|
|
|
|
|
|
|
|
|
# Link keyring if keys are not mutable |
|
|
|
|
home.file."${cfg.homedir}/pubring.kbx" = |
|
|
|
|
mkIf (!cfg.mutableKeys && cfg.publicKeys != []) { |
|
|
|
|
mkIf (!cfg.mutableKeys && cfg.publicKeys != [ ]) { |
|
|
|
|
source = "${keyringFiles}/pubring.kbx"; |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|
home.activation = mkIf (cfg.publicKeys != []) { |
|
|
|
|
importGpgKeys = |
|
|
|
|
let |
|
|
|
|
gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
|
|
|
|
|
importKey = { source, trust, ... }: |
|
|
|
|
# Import mutable keys |
|
|
|
|
optional cfg.mutableKeys '' |
|
|
|
|
$DRY_RUN_CMD ${gpg} $QUIET_ARG --import ${source}'' |
|
|
|
|
|
|
|
|
|
# Import mutable trust |
|
|
|
|
++ optional (trust != null && cfg.mutableTrust) '' |
|
|
|
|
$DRY_RUN_CMD importTrust "${source}" ${toString trust}''; |
|
|
|
|
|
|
|
|
|
anyTrust = any (k: k.trust != null) cfg.publicKeys; |
|
|
|
|
|
|
|
|
|
importKeys = concatStringsSep "\n" (concatMap importKey cfg.publicKeys); |
|
|
|
|
|
|
|
|
|
# If any key/trust should be imported then create the block. Otherwise |
|
|
|
|
# leave it empty. |
|
|
|
|
block = concatStringsSep "\n" ( |
|
|
|
|
optional (importKeys != "") '' |
|
|
|
|
export GNUPGHOME=${escapeShellArg cfg.homedir} |
|
|
|
|
if [[ ! -v VERBOSE ]]; then |
|
|
|
|
QUIET_ARG="--quiet" |
|
|
|
|
else |
|
|
|
|
QUIET_ARG="" |
|
|
|
|
fi |
|
|
|
|
${importTrustBashFunctions} |
|
|
|
|
${importKeys} |
|
|
|
|
unset GNUPGHOME QUIET_ARG keyId importTrust |
|
|
|
|
'' ++ optional (!cfg.mutableTrust && anyTrust) '' |
|
|
|
|
install -m 0700 ${keyringFiles}/trustdb.gpg "${cfg.homedir}/trustdb.gpg"'' |
|
|
|
|
); |
|
|
|
|
in lib.hm.dag.entryAfter ["linkGeneration"] block; |
|
|
|
|
home.activation = mkIf (cfg.publicKeys != [ ]) { |
|
|
|
|
importGpgKeys = let |
|
|
|
|
gpg = "${cfg.package}/bin/gpg"; |
|
|
|
|
|
|
|
|
|
importKey = { source, trust, ... }: |
|
|
|
|
# Import mutable keys |
|
|
|
|
optional cfg.mutableKeys |
|
|
|
|
"$DRY_RUN_CMD ${gpg} $QUIET_ARG --import ${source}" |
|
|
|
|
|
|
|
|
|
# Import mutable trust |
|
|
|
|
++ optional (trust != null && cfg.mutableTrust) |
|
|
|
|
''$DRY_RUN_CMD importTrust "${source}" ${toString trust}''; |
|
|
|
|
|
|
|
|
|
anyTrust = any (k: k.trust != null) cfg.publicKeys; |
|
|
|
|
|
|
|
|
|
importKeys = concatStringsSep "\n" (concatMap importKey cfg.publicKeys); |
|
|
|
|
|
|
|
|
|
# If any key/trust should be imported then create the block. Otherwise |
|
|
|
|
# leave it empty. |
|
|
|
|
block = concatStringsSep "\n" (optional (importKeys != "") '' |
|
|
|
|
export GNUPGHOME=${escapeShellArg cfg.homedir} |
|
|
|
|
if [[ ! -v VERBOSE ]]; then |
|
|
|
|
QUIET_ARG="--quiet" |
|
|
|
|
else |
|
|
|
|
QUIET_ARG="" |
|
|
|
|
fi |
|
|
|
|
${importTrustBashFunctions} |
|
|
|
|
${importKeys} |
|
|
|
|
unset GNUPGHOME QUIET_ARG keyId importTrust |
|
|
|
|
'' ++ optional (!cfg.mutableTrust && anyTrust) '' |
|
|
|
|
install -m 0700 ${keyringFiles}/trustdb.gpg "${cfg.homedir}/trustdb.gpg"''); |
|
|
|
|
in lib.hm.dag.entryAfter [ "linkGeneration" ] block; |
|
|
|
|
}; |
|
|
|
|
}; |
|
|
|
|
} |
|
|
|
|