commit e4029c34fcf274d22fc42e6933c0cc0029888bee · pyrox.dev/nixpkgs

nixos/modules/module-list.nix

···

       811
        
         ./services/security/torsocks.nix

     

       812
        
         ./services/security/usbguard.nix

     

       813
        
         ./services/security/vault.nix

     

       0
        
       
     

       814
        
         ./services/system/cloud-init.nix

     

       815
        
         ./services/system/dbus.nix

     

       816
        
         ./services/system/earlyoom.nix

···

       811
        
         ./services/security/torsocks.nix

     

       812
        
         ./services/security/usbguard.nix

     

       813
        
         ./services/security/vault.nix

     

       814
       +
         ./services/security/yubikey-agent.nix

     

       815
        
         ./services/system/cloud-init.nix

     

       816
        
         ./services/system/dbus.nix

     

       817
        
         ./services/system/earlyoom.nix

+1 -2

nixos/modules/programs/gnupg.nix

···

       70
        
           agent.pinentryFlavor = mkOption {

     

       71
        
             type = types.nullOr (types.enum pkgs.pinentry.flavors);

     

       72
        
             example = "gnome3";

     

       0
        
       
     

       73
        
             description = ''

     

       74
        
               Which pinentry interface to use. If not null, the path to the

     

       75
        
               pinentry binary will be passed to gpg-agent via commandline and

     
···

       91
        
         };

     

       92
        
       

     

       93
        
         config = mkIf cfg.agent.enable {

     

       94
       -
           programs.gnupg.agent.pinentryFlavor = mkDefault defaultPinentryFlavor;

     

       95
       -
       

     

       96
        
           # This overrides the systemd user unit shipped with the gnupg package

     

       97
        
           systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {

     

       98
        
             serviceConfig.ExecStart = [ "" ''

···

       70
        
           agent.pinentryFlavor = mkOption {

     

       71
        
             type = types.nullOr (types.enum pkgs.pinentry.flavors);

     

       72
        
             example = "gnome3";

     

       73
       +
             default = defaultPinentryFlavor;

     

       74
        
             description = ''

     

       75
        
               Which pinentry interface to use. If not null, the path to the

     

       76
        
               pinentry binary will be passed to gpg-agent via commandline and

     
···

       92
        
         };

     

       93
        
       

     

       94
        
         config = mkIf cfg.agent.enable {

     

       0
        
       
     

       0
        
       
     

       95
        
           # This overrides the systemd user unit shipped with the gnupg package

     

       96
        
           systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {

     

       97
        
             serviceConfig.ExecStart = [ "" ''

+61

nixos/modules/services/security/yubikey-agent.nix

···

       1
       +
       # Global configuration for yubikey-agent.

     

       2
       +
       

     

       3
       +
       { config, lib, pkgs, ... }:

     

       4
       +
       

     

       5
       +
       with lib;

     

       6
       +
       

     

       7
       +
       let

     

       8
       +
         cfg = config.services.yubikey-agent;

     

       9
       +
       

     

       10
       +
         # reuse the pinentryFlavor option from the gnupg module

     

       11
       +
         pinentryFlavor = config.programs.gnupg.agent.pinentryFlavor;

     

       12
       +
       in

     

       13
       +
       {

     

       14
       +
         ###### interface

     

       15
       +
       

     

       16
       +
         meta.maintainers = with maintainers; [ philandstuff rawkode ];

     

       17
       +
       

     

       18
       +
         options = {

     

       19
       +
       

     

       20
       +
           services.yubikey-agent = {

     

       21
       +
             enable = mkOption {

     

       22
       +
               type = types.bool;

     

       23
       +
               default = false;

     

       24
       +
               description = ''

     

       25
       +
                 Whether to start yubikey-agent when you log in.  Also sets

     

       26
       +
                 SSH_AUTH_SOCK to point at yubikey-agent.

     

       27
       +
       

     

       28
       +
                 Note that yubikey-agent will use whatever pinentry is

     

       29
       +
                 specified in programs.gnupg.agent.pinentryFlavor.

     

       30
       +
               '';

     

       31
       +
             };

     

       32
       +
       

     

       33
       +
             package = mkOption {

     

       34
       +
               type = types.package;

     

       35
       +
               default = pkgs.yubikey-agent;

     

       36
       +
               defaultText = "pkgs.yubikey-agent";

     

       37
       +
               description = ''

     

       38
       +
                 The package used for the yubikey-agent daemon.

     

       39
       +
               '';

     

       40
       +
             };

     

       41
       +
           };

     

       42
       +
         };

     

       43
       +
       

     

       44
       +
         config = {

     

       45
       +
           environment.systemPackages = [ cfg.package ];

     

       46
       +
           systemd.packages = [ cfg.package ];

     

       47
       +
       

     

       48
       +
           # This overrides the systemd user unit shipped with the

     

       49
       +
           # yubikey-agent package

     

       50
       +
           systemd.user.services.yubikey-agent = mkIf (pinentryFlavor != null) {

     

       51
       +
             path = [ pkgs.pinentry.${pinentryFlavor} ];

     

       52
       +
           };

     

       53
       +
       

     

       54
       +
           environment.extraInit = optionalString cfg.enable

     

       55
       +
             ''

     

       56
       +
               if [ -z "$SSH_AUTH_SOCK" -a -n "$XDG_RUNTIME_DIR" ]; then

     

       57
       +
                 export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/yubikey-agent/yubikey-agent.sock"

     

       58
       +
               fi

     

       59
       +
             '';

     

       60
       +
         };

     

       61
       +
       }

+54

pkgs/tools/security/yubikey-agent/default.nix

···

       1
       +
       { stdenv, lib, fetchFromGitHub, buildGoModule, libnotify, makeWrapper, pcsclite, pinentry_mac, pkgconfig, darwin }:

     

       2
       +
       

     

       3
       +
       buildGoModule rec {

     

       4
       +
         pname = "yubikey-agent";

     

       5
       +
         version = "0.1.3";

     

       6
       +
       

     

       7
       +
         src = fetchFromGitHub {

     

       8
       +
           owner = "FiloSottile";

     

       9
       +
           repo = pname;

     

       10
       +
           rev = "v${version}";

     

       11
       +
           sha256 = "07gix5wrakn4z846zhvl66lzwx58djrfnn6m8v7vc69l9jr3kihr";

     

       12
       +
         };

     

       13
       +
       

     

       14
       +
         buildInputs =

     

       15
       +
           lib.optional stdenv.isLinux (lib.getDev pcsclite)

     

       16
       +
           ++ lib.optional stdenv.isDarwin (darwin.apple_sdk.frameworks.PCSC);

     

       17
       +
       

     

       18
       +
         nativeBuildInputs = [ makeWrapper pkgconfig ];

     

       19
       +
       

     

       20
       +
         # pull in go-piv/piv-go#75

     

       21
       +
         # once go-piv/piv-go#75 is merged and released, we should

     

       22
       +
         # use the released version (and push upstream to do the same)

     

       23
       +
         patches = [ ./use-piv-go-75.patch ];

     

       24
       +
         postPatch = lib.optionalString stdenv.isLinux ''

     

       25
       +
           substituteInPlace main.go --replace 'notify-send' ${libnotify}/bin/notify-send

     

       26
       +
         '';

     

       27
       +
       

     

       28
       +
         vendorSha256 = "1x7934p6522i0yyv08xzb4134d0kr5x6igsrp26vh79d8fndbywr";

     

       29
       +
       

     

       30
       +
         subPackages = [ "." ];

     

       31
       +
       

     

       32
       +
         # On macOS, there isn't a choice of pinentry program, so let's

     

       33
       +
         # ensure the nixpkgs-provided one is available

     

       34
       +
         postInstall = lib.optionalString stdenv.isDarwin ''

     

       35
       +
           wrapProgram $out/bin/yubikey-agent --suffix PATH : $(dirname ${pinentry_mac}/${pinentry_mac.binaryPath})

     

       36
       +
         ''

     

       37
       +
         # Note: in the next release, upstream provides

     

       38
       +
         # contrib/systemd/user/yubikey-agent.service, which we should use

     

       39
       +
         # instead

     

       40
       +
         # See https://github.com/FiloSottile/yubikey-agent/pull/43

     

       41
       +
         + lib.optionalString stdenv.isLinux ''

     

       42
       +
           mkdir -p $out/lib/systemd/user

     

       43
       +
           substitute ${./yubikey-agent.service} $out/lib/systemd/user/yubikey-agent.service \

     

       44
       +
             --replace 'ExecStart=yubikey-agent' "ExecStart=$out/bin/yubikey-agent"

     

       45
       +
         '';

     

       46
       +
       

     

       47
       +
         meta = with lib; {

     

       48
       +
           description = "A seamless ssh-agent for YubiKeys";

     

       49
       +
           license = licenses.bsd3;

     

       50
       +
           homepage = "https://filippo.io/yubikey-agent";

     

       51
       +
           maintainers = with lib.maintainers; [ philandstuff rawkode ];

     

       52
       +
           platforms = platforms.darwin ++ platforms.linux;

     

       53
       +
         };

     

       54
       +
       }

+24

pkgs/tools/security/yubikey-agent/use-piv-go-75.patch

···

       1
       +
       From 56a465d463273b2a2a24cf668c4c33938b198b16 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Philip Potter <philip.g.potter@gmail.com>

     

       3
       +
       Date: Sun, 12 Jul 2020 16:54:57 +0100

     

       4
       +
       Subject: [PATCH] Pull in go-piv/piv-go#75

     

       5
       +
       

     

       6
       +
       ---

     

       7
       +
        go.mod | 1 +

     

       8
       +
        1 file changed, 1 insertion(+)

     

       9
       +
       

     

       10
       +
       diff --git a/go.mod b/go.mod

     

       11
       +
       index d4d13c8..e24d53d 100644

     

       12
       +
       --- a/go.mod

     

       13
       +
       +++ b/go.mod

     

       14
       +
       @@ -2,6 +2,7 @@ module filippo.io/yubikey-agent

     

       15
       +
        

     

       16
       +
        go 1.14

     

       17
       +
        

     

       18
       +
       +replace github.com/go-piv/piv-go => github.com/rawkode/piv-go v1.5.1-0.20200711221619-a4158f9b8204

     

       19
       +
        require (

     

       20
       +
        	github.com/go-piv/piv-go v1.5.1-0.20200523071327-a3e5767e8b72

     

       21
       +
        	github.com/gopasspw/gopass v1.9.1

     

       22
       +
       -- 

     

       23
       +
       2.27.0

     

       24
       +

+35

pkgs/tools/security/yubikey-agent/yubikey-agent.service

···

       1
       +
       [Unit]

     

       2
       +
       Description=Seamless ssh-agent for YubiKeys

     

       3
       +
       Documentation=https://filippo.io/yubikey-agent

     

       4
       +
       

     

       5
       +
       [Service]

     

       6
       +
       ExecStart=yubikey-agent -l %t/yubikey-agent/yubikey-agent.sock

     

       7
       +
       ExecReload=/bin/kill -HUP $MAINPID

     

       8
       +
       ProtectSystem=strict

     

       9
       +
       ProtectKernelLogs=yes

     

       10
       +
       ProtectKernelModules=yes

     

       11
       +
       ProtectKernelTunables=yes

     

       12
       +
       ProtectControlGroups=yes

     

       13
       +
       ProtectClock=yes

     

       14
       +
       ProtectHostname=yes

     

       15
       +
       PrivateTmp=yes

     

       16
       +
       PrivateDevices=yes

     

       17
       +
       PrivateUsers=yes

     

       18
       +
       IPAddressDeny=any

     

       19
       +
       RestrictAddressFamilies=AF_UNIX

     

       20
       +
       RestrictNamespaces=yes

     

       21
       +
       RestrictRealtime=yes

     

       22
       +
       RestrictSUIDSGID=yes

     

       23
       +
       LockPersonality=yes

     

       24
       +
       CapabilityBoundingSet=

     

       25
       +
       SystemCallFilter=@system-service

     

       26
       +
       SystemCallFilter=~@privileged @resources

     

       27
       +
       SystemCallErrorNumber=EPERM

     

       28
       +
       SystemCallArchitectures=native

     

       29
       +
       NoNewPrivileges=yes

     

       30
       +
       KeyringMode=private

     

       31
       +
       UMask=0177

     

       32
       +
       RuntimeDirectory=yubikey-agent

     

       33
       +
       

     

       34
       +
       [Install]

     

       35
       +
       WantedBy=default.target

pkgs/top-level/all-packages.nix

···

       15435
        
       

     

       15436
        
         yubikey-personalization-gui = libsForQt5.callPackage ../tools/misc/yubikey-personalization-gui { };

     

       15437
        
       

     

       0
        
       
     

       0
        
       
     

       15438
        
         zchunk = callPackage ../development/libraries/zchunk { };

     

       15439
        
       

     

       15440
        
         zeitgeist = callPackage ../development/libraries/zeitgeist { };

···

       15435
        
       

     

       15436
        
         yubikey-personalization-gui = libsForQt5.callPackage ../tools/misc/yubikey-personalization-gui { };

     

       15437
        
       

     

       15438
       +
         yubikey-agent = callPackage ../tools/security/yubikey-agent { };

     

       15439
       +
       

     

       15440
        
         zchunk = callPackage ../development/libraries/zchunk { };

     

       15441
        
       

     

       15442
        
         zeitgeist = callPackage ../development/libraries/zeitgeist { };