1
0
Fork 0
mirror of https://github.com/nix-community/home-manager synced 2024-11-01 00:39:45 +01:00
home-manager/modules/programs/gpg.nix

336 lines
10 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.programs.gpg;
mkKeyValue = key: value:
if isString value then "${key} ${value}" else optionalString value key;
cfgText = generators.toKeyValue {
inherit mkKeyValue;
listsAsDuplicateKeys = true;
} cfg.settings;
scdaemonCfgText = generators.toKeyValue {
inherit mkKeyValue;
listsAsDuplicateKeys = true;
} cfg.scdaemonSettings;
primitiveType = types.oneOf [ types.str types.bool ];
publicKeyOpts = { config, ... }: {
options = {
text = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Text of an OpenPGP public key.
'';
};
source = mkOption {
type = types.path;
description = ''
Path of an OpenPGP public key file.
'';
};
trust = mkOption {
type = types.nullOr (types.enum [
"unknown"
1
"never"
2
"marginal"
3
"full"
4
"ultimate"
5
]);
default = null;
apply = v:
if isString v then
{
unknown = 1;
never = 2;
marginal = 3;
full = 4;
ultimate = 5;
}.${v}
else
v;
description = ''
The amount of trust you have in the key ownership and the care the
owner puts into signing other keys. The available levels are
<variablelist>
<varlistentry>
<term><literal>unknown</literal> or <literal>1</literal></term>
<listitem><para>I don't know or won't say.</para></listitem>
</varlistentry>
<varlistentry>
<term><literal>never</literal> or <literal>2</literal></term>
<listitem><para>I do NOT trust.</para></listitem>
</varlistentry>
<varlistentry>
<term><literal>marginal</literal> or <literal>3</literal></term>
<listitem><para>I trust marginally.</para></listitem>
</varlistentry>
<varlistentry>
<term><literal>full</literal> or <literal>4</literal></term>
<listitem><para>I trust fully.</para></listitem>
</varlistentry>
<varlistentry>
<term><literal>ultimate</literal> or <literal>5</literal></term>
<listitem><para>I trust ultimately.</para></listitem>
</varlistentry>
</variablelist>
</para><para>
See <link xlink:href="https://www.gnupg.org/gph/en/manual/x334.html"/>
for more.
'';
};
};
config = {
source =
mkIf (config.text != null) (pkgs.writeText "gpg-pubkey" config.text);
};
};
importTrustBashFunctions = let gpg = "${cfg.package}/bin/gpg";
in ''
function gpgKeyId() {
${gpg} --show-key --with-colons "$1" \
| grep ^pub: \
| cut -d: -f5
}
function importTrust() {
local keyIds trust
IFS='\n' read -ra keyIds <<< "$(gpgKeyId "$1")"
trust="$2"
for id in "''${keyIds[@]}" ; do
{ echo trust; echo "$trust"; (( trust == 5 )) && echo y; echo quit; } \
| ${gpg} --no-tty --command-fd 0 --edit-key "$id"
done
}
'';
keyringFiles = let
gpg = "${cfg.package}/bin/gpg";
importKey = { source, trust, ... }: ''
${gpg} --import ${source}
${optionalString (trust != null)
''importTrust "${source}" ${toString trust}''}
'';
importKeys = concatMapStringsSep "\n" importKey cfg.publicKeys;
in pkgs.runCommand "gpg-pubring" { buildInputs = [ cfg.package ]; } ''
export GNUPGHOME
GNUPGHOME=$(mktemp -d)
${importTrustBashFunctions}
${importKeys}
mkdir $out
cp $GNUPGHOME/pubring.kbx $out/pubring.kbx
if [[ -e $GNUPGHOME/trustdb.gpg ]] ; then
cp $GNUPGHOME/trustdb.gpg $out/trustdb.gpg
fi
'';
in {
options.programs.gpg = {
enable = mkEnableOption "GnuPG";
package = mkOption {
type = types.package;
default = pkgs.gnupg;
defaultText = literalExpression "pkgs.gnupg";
example = literalExpression "pkgs.gnupg23";
description =
"The Gnupg package to use (also used the gpg-agent service).";
};
settings = mkOption {
type =
types.attrsOf (types.either primitiveType (types.listOf types.str));
example = literalExpression ''
{
no-comments = false;
s2k-cipher-algo = "AES128";
}
'';
description = ''
GnuPG configuration options. Available options are described
in
<link xlink:href="https://gnupg.org/documentation/manpage.html">
<citerefentry>
<refentrytitle>gpg</refentrytitle>
<manvolnum>1</manvolnum>
</citerefentry>
</link>.
</para>
<para>
Note that lists are converted to duplicate keys.
'';
};
scdaemonSettings = mkOption {
type =
types.attrsOf (types.either primitiveType (types.listOf types.str));
example = literalExpression ''
{
disable-ccid = true;
}
'';
description = ''
SCdaemon configuration options. Available options are described
in
<link xlink:href="https://www.gnupg.org/documentation/manuals/gnupg/Scdaemon-Options.html">
<citerefentry>
<refentrytitle>scdaemon</refentrytitle>
<manvolnum>1</manvolnum>
</citerefentry>
</link>.
'';
};
homedir = mkOption {
type = types.path;
example = literalExpression ''"''${config.xdg.dataHome}/gnupg"'';
default = "${config.home.homeDirectory}/.gnupg";
defaultText =
literalExpression ''"''${config.home.homeDirectory}/.gnupg"'';
description = "Directory to store keychains and configuration.";
};
mutableKeys = mkOption {
type = types.bool;
default = true;
description = ''
If set to <literal>true</literal>, you may manage your keyring as a user
using the <literal>gpg</literal> command. Upon activation, the keyring
will have managed keys added without overwriting unmanaged keys.
</para><para>
If set to <literal>false</literal>, the path
<filename>$GNUPGHOME/pubring.kbx</filename> will become an immutable
link to the Nix store, denying modifications.
'';
};
mutableTrust = mkOption {
type = types.bool;
default = true;
description = ''
If set to <literal>true</literal>, you may manage trust as a user using
the <command>gpg</command> command. Upon activation, trusted keys have
their trust set without overwriting unmanaged keys.
</para><para>
If set to <literal>false</literal>, the path
<filename>$GNUPGHOME/trustdb.gpg</filename> will be
<emphasis>overwritten</emphasis> on each activation, removing trust for
any unmanaged keys. Be careful to make a backup of your old
<filename>trustdb.gpg</filename> before switching to immutable trust!
'';
};
publicKeys = mkOption {
type = types.listOf (types.submodule publicKeyOpts);
example = literalExpression ''
[ { source = ./pubkeys.txt; } ]
'';
default = [ ];
description = ''
A list of public keys to be imported into GnuPG. Note, these key files
will be copied into the world-readable Nix store.
'';
};
};
config = mkIf cfg.enable {
programs.gpg.settings = {
personal-cipher-preferences = mkDefault "AES256 AES192 AES";
personal-digest-preferences = mkDefault "SHA512 SHA384 SHA256";
personal-compress-preferences = mkDefault "ZLIB BZIP2 ZIP Uncompressed";
default-preference-list = mkDefault
"SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed";
cert-digest-algo = mkDefault "SHA512";
s2k-digest-algo = mkDefault "SHA512";
s2k-cipher-algo = mkDefault "AES256";
charset = mkDefault "utf-8";
fixed-list-mode = mkDefault true;
no-comments = mkDefault true;
no-emit-version = mkDefault true;
keyid-format = mkDefault "0xlong";
list-options = mkDefault "show-uid-validity";
verify-options = mkDefault "show-uid-validity";
with-fingerprint = mkDefault true;
require-cross-certification = mkDefault true;
no-symkey-cache = mkDefault true;
use-agent = mkDefault true;
};
programs.gpg.scdaemonSettings = {
# no defaults for scdaemon
};
home.packages = [ cfg.package ];
home.sessionVariables = { GNUPGHOME = cfg.homedir; };
home.file."${cfg.homedir}/gpg.conf".text = cfgText;
home.file."${cfg.homedir}/scdaemon.conf".text = scdaemonCfgText;
# Link keyring if keys are not mutable
home.file."${cfg.homedir}/pubring.kbx" =
mkIf (!cfg.mutableKeys && cfg.publicKeys != [ ]) {
source = "${keyringFiles}/pubring.kbx";
};
home.activation = {
createGpgHomedir =
hm.dag.entryBetween [ "linkGeneration" ] [ "writeBoundary" ] ''
$DRY_RUN_CMD mkdir -m700 -p $VERBOSE_ARG ${escapeShellArg cfg.homedir}
'';
importGpgKeys = let
gpg = "${cfg.package}/bin/gpg";
importKey = { source, trust, ... }:
# Import mutable keys
optional cfg.mutableKeys
"$DRY_RUN_CMD ${gpg} $QUIET_ARG --import ${source}"
# Import mutable trust
++ optional (trust != null && cfg.mutableTrust)
''$DRY_RUN_CMD importTrust "${source}" ${toString trust}'';
anyTrust = any (k: k.trust != null) cfg.publicKeys;
importKeys = concatStringsSep "\n" (concatMap importKey cfg.publicKeys);
# If any key/trust should be imported then create the block. Otherwise
# leave it empty.
block = concatStringsSep "\n" (optional (importKeys != "") ''
export GNUPGHOME=${escapeShellArg cfg.homedir}
if [[ ! -v VERBOSE ]]; then
QUIET_ARG="--quiet"
else
QUIET_ARG=""
fi
${importTrustBashFunctions}
${importKeys}
unset GNUPGHOME QUIET_ARG keyId importTrust
'' ++ optional (!cfg.mutableTrust && anyTrust) ''
install -m 0700 ${keyringFiles}/trustdb.gpg "${cfg.homedir}/trustdb.gpg"'');
in mkIf (cfg.publicKeys != [ ])
(lib.hm.dag.entryAfter [ "linkGeneration" ] block);
};
};
}