Skip to content

Commit

Permalink
pinentry: remove multiple outputs package
Browse files Browse the repository at this point in the history
  • Loading branch information
fpletz committed Jan 15, 2024
1 parent 54b151c commit 9fd9087
Show file tree
Hide file tree
Showing 14 changed files with 184 additions and 150 deletions.
2 changes: 1 addition & 1 deletion nixos/modules/config/no-x-libs.nix
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ with lib;
networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
pango = super.pango.override { x11Support = false; };
pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
pinentry-curses = super.pinentry-curses.override { withLibsecret = false; };
pipewire = super.pipewire.override { x11Support = false; };
pythonPackagesExtensions = super.pythonPackagesExtensions ++ [
(python-final: python-prev: {
Expand Down
56 changes: 20 additions & 36 deletions nixos/modules/programs/gnupg.nix
Original file line number Diff line number Diff line change
@@ -1,32 +1,19 @@
{ config, lib, pkgs, ... }:

with lib;

let
inherit (lib) mkRemovedOptionModule mkOption mkPackageOption types mkIf optionalString;

cfg = config.programs.gnupg;

agentSettingsFormat = pkgs.formats.keyValue {
mkKeyValue = lib.generators.mkKeyValueDefault { } " ";
};

xserverCfg = config.services.xserver;

defaultPinentryFlavor =
if xserverCfg.desktopManager.lxqt.enable
|| xserverCfg.desktopManager.plasma5.enable
|| xserverCfg.desktopManager.deepin.enable then
"qt"
else if xserverCfg.desktopManager.xfce.enable then
"gtk2"
else if xserverCfg.enable || config.programs.sway.enable then
"gnome3"
else
"curses";

in

{
imports = [
(mkRemovedOptionModule [ "programs" "gnupg" "agent" "pinentryFlavor" ] "Use programs.gnupg.agent.pinentryPackage instead")
];

options.programs.gnupg = {
package = mkPackageOption pkgs "gnupg" { };
Expand Down Expand Up @@ -65,17 +52,17 @@ in
'';
};

agent.pinentryFlavor = mkOption {
type = types.nullOr (types.enum pkgs.pinentry.flavors);
example = "gnome3";
default = defaultPinentryFlavor;
defaultText = literalMD ''matching the configured desktop environment'';
agent.pinentryPackage = mkOption {
type = types.nullOr types.package;
example = lib.literalMD "pkgs.pinentry-gnome3";
default = pkgs.pinentry-curses;
defaultText = lib.literalMD "matching the configured desktop environment or `pkgs.pinentry-curses`";
description = lib.mdDoc ''
Which pinentry interface to use. If not null, the path to the
pinentry binary will be set in /etc/gnupg/gpg-agent.conf.
If not set at all, it'll pick an appropriate flavor depending on the
system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
Which pinentry package to use. The path to the mainProgram as defined in
the package's meta attriutes will be set in /etc/gnupg/gpg-agent.conf.
If not set by the user, it'll pick an appropriate flavor depending on the
system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce,
gnome3 on all other systems with X enabled, curses otherwise).
'';
};

Expand All @@ -101,9 +88,8 @@ in
};

config = mkIf cfg.agent.enable {
programs.gnupg.agent.settings = {
pinentry-program = lib.mkIf (cfg.agent.pinentryFlavor != null)
"${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry";
programs.gnupg.agent.settings = mkIf (cfg.agent.pinentryPackage != null) {
pinentry-program = lib.getExe cfg.agent.pinentryPackage;
};

environment.etc."gnupg/gpg-agent.conf".source =
Expand Down Expand Up @@ -206,9 +192,9 @@ in
wantedBy = [ "sockets.target" ];
};

services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
services.dbus.packages = mkIf (lib.elem "gnome3" cfg.agent.pinentryPackage.flavors) [ pkgs.gcr ];

environment.systemPackages = with pkgs; [ cfg.package ];
environment.systemPackages = [ cfg.package ];

environment.interactiveShellInit = ''
# Bind gpg-agent to this TTY if gpg commands are used.
Expand All @@ -229,12 +215,10 @@ in
'';

assertions = [
{ assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
{
assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
}
];
};

# uses attributes of the linked package
meta.buildDocsInSandbox = false;
}
5 changes: 5 additions & 0 deletions nixos/modules/programs/wayland/sway.nix
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,7 @@ in {
'';
}
];

environment = {
systemPackages = optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
# Needed for the default wallpaper:
Expand All @@ -166,8 +167,12 @@ in {
"sway/config".source = mkOptionDefault "${cfg.package}/etc/sway/config";
};
};

programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;

# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
xdg.portal.config.sway.default = mkDefault [ "wlr" "gtk" ];

# To make a Sway session available if a display manager like SDDM is enabled:
services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ]; }
(import ./wayland-session.nix { inherit lib pkgs; })
Expand Down
12 changes: 2 additions & 10 deletions nixos/modules/services/security/yubikey-agent.nix
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,6 @@ with lib;

let
cfg = config.services.yubikey-agent;

# reuse the pinentryFlavor option from the gnupg module
pinentryFlavor = config.programs.gnupg.agent.pinentryFlavor;
in
{
###### interface
Expand Down Expand Up @@ -41,13 +38,8 @@ in
# This overrides the systemd user unit shipped with the
# yubikey-agent package
systemd.user.services.yubikey-agent = mkIf (pinentryFlavor != null) {
path = [ pkgs.pinentry.${pinentryFlavor} ];
wantedBy = [
(if pinentryFlavor == "tty" || pinentryFlavor == "curses" then
"default.target"
else
"graphical-session.target")
];
path = [ config.programs.gnupg.agent.pinentryPackage ];
wantedBy = [ "default.target" ];
};

# Yubikey-agent expects pcsd to be running in order to function.
Expand Down
1 change: 1 addition & 0 deletions nixos/modules/services/x11/desktop-managers/deepin.nix
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ in
services.upower.enable = mkDefault config.powerManagement.enable;
networking.networkmanager.enable = mkDefault true;
programs.dconf.enable = mkDefault true;
programs.gnupg.agent.pinentryPackage = pkgs.pinentry-qt;

fonts.packages = with pkgs; [ noto-fonts ];
xdg.mime.enable = true;
Expand Down
2 changes: 2 additions & 0 deletions nixos/modules/services/x11/desktop-managers/lxqt.nix
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,8 @@ in
# Link some extra directories in /run/current-system/software/share
environment.pathsToLink = [ "/share" ];

programs.gnupg.agent.pinentryPackage = pkgs.pinentry-qt;

# virtual file systems support for PCManFM-QT
services.gvfs.enable = true;

Expand Down
1 change: 1 addition & 0 deletions nixos/modules/services/x11/desktop-managers/plasma5.nix
Original file line number Diff line number Diff line change
Expand Up @@ -331,6 +331,7 @@ in
serif = [ "Noto Serif" ];
};

programs.gnupg.agent.pinentryPackage = pkgs.pinentry-qt;
programs.ssh.askPassword = mkDefault "${pkgs.plasma5Packages.ksshaskpass.out}/bin/ksshaskpass";

# Enable helpful DBus services.
Expand Down
1 change: 1 addition & 0 deletions nixos/modules/services/x11/desktop-managers/xfce.nix
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ in
xfdesktop
] ++ optional cfg.enableScreensaver xfce4-screensaver) excludePackages;

programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gtk2;
programs.xfconf.enable = true;
programs.thunar.enable = true;

Expand Down
2 changes: 2 additions & 0 deletions nixos/modules/services/x11/xserver.nix
Original file line number Diff line number Diff line change
Expand Up @@ -749,6 +749,8 @@ in
boot.kernel.sysctl."fs.inotify.max_user_instances" = mkDefault 524288;
boot.kernel.sysctl."fs.inotify.max_user_watches" = mkDefault 524288;

programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;

systemd.defaultUnit = mkIf cfg.autorun "graphical.target";

systemd.services.display-manager =
Expand Down
1 change: 0 additions & 1 deletion nixos/tests/pass-secret-service.nix
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {

programs.gnupg = {
agent.enable = true;
agent.pinentryFlavor = "tty";
dirmngr.enable = true;
};
};
Expand Down
108 changes: 13 additions & 95 deletions pkgs/tools/security/pinentry/default.nix
Original file line number Diff line number Diff line change
@@ -1,100 +1,18 @@
{ fetchurl, mkDerivation, fetchpatch, stdenv, lib, pkg-config, autoreconfHook, wrapGAppsHook
, libgpg-error, libassuan, qtbase, wrapQtAppsHook
, ncurses, gtk2, gcr
, withLibsecret ? true, libsecret
, enabledFlavors ? [ "curses" "tty" "gtk2" "emacs" ]
++ lib.optionals stdenv.isLinux [ "gnome3" ]
++ lib.optionals (!stdenv.isDarwin) [ "qt" ]
{ callPackage
, withLibsecret ? true
}:

assert lib.isList enabledFlavors && enabledFlavors != [];

let
pinentryMkDerivation =
if (builtins.elem "qt" enabledFlavors)
then mkDerivation
else stdenv.mkDerivation;

enableFeaturePinentry = f:
let
flag = flavorInfo.${f}.flag or null;
in
lib.optionalString (flag != null)
(lib.enableFeature (lib.elem f enabledFlavors) ("pinentry-" + flag));

flavorInfo = {
curses = { bin = "curses"; flag = "curses"; buildInputs = [ ncurses ]; };
tty = { bin = "tty"; flag = "tty"; };
gtk2 = { bin = "gtk-2"; flag = "gtk2"; buildInputs = [ gtk2 ]; };
gnome3 = { bin = "gnome3"; flag = "gnome3"; buildInputs = [ gcr ]; nativeBuildInputs = [ wrapGAppsHook ]; };
qt = { bin = "qt"; flag = "qt"; buildInputs = [ qtbase ]; nativeBuildInputs = [ wrapQtAppsHook ]; };
emacs = { bin = "emacs"; flag = "emacs"; buildInputs = []; };
};

buildPinentry = pinentryExtraPname: buildFlavors:
callPackage ./generic.nix {
inherit pinentryExtraPname buildFlavors withLibsecret;
};
in

pinentryMkDerivation rec {
pname = "pinentry";
version = "1.2.1";

src = fetchurl {
url = "mirror://gnupg/pinentry/${pname}-${version}.tar.bz2";
sha256 = "sha256-RXoYXlqFI4+5RalV3GNSq5YtyLSHILYvyfpIx1QKQGc=";
};

nativeBuildInputs = [ pkg-config autoreconfHook ]
++ lib.concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;

buildInputs = [ libgpg-error libassuan ]
++ lib.optional withLibsecret libsecret
++ lib.concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;

dontWrapGApps = true;
dontWrapQtApps = true;

patches = [
./autoconf-ar.patch
] ++ lib.optionals (lib.elem "gtk2" enabledFlavors) [
(fetchpatch {
url = "https://salsa.debian.org/debian/pinentry/raw/debian/1.1.0-1/debian/patches/0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch";
sha256 = "15r1axby3fdlzz9wg5zx7miv7gqx2jy4immaw4xmmw5skiifnhfd";
})
];

configureFlags = [
"--with-libgpg-error-prefix=${libgpg-error.dev}"
"--with-libassuan-prefix=${libassuan.dev}"
(lib.enableFeature withLibsecret "libsecret")
] ++ (map enableFeaturePinentry (lib.attrNames flavorInfo));

postInstall =
lib.concatStrings (lib.flip map enabledFlavors (f:
let
binary = "pinentry-" + flavorInfo.${f}.bin;
in ''
moveToOutput bin/${binary} ${placeholder f}
ln -sf ${placeholder f}/bin/${binary} ${placeholder f}/bin/pinentry
'' + lib.optionalString (f == "gnome3") ''
wrapGApp ${placeholder f}/bin/${binary}
'' + lib.optionalString (f == "qt") ''
wrapQtApp ${placeholder f}/bin/${binary}
'')) + ''
ln -sf ${placeholder (lib.head enabledFlavors)}/bin/pinentry-${flavorInfo.${lib.head enabledFlavors}.bin} $out/bin/pinentry
'';

outputs = [ "out" ] ++ enabledFlavors;

passthru = { flavors = enabledFlavors; };

meta = with lib; {
homepage = "http://gnupg.org/aegypten2/";
description = "GnuPG’s interface to passphrase input";
license = licenses.gpl2Plus;
platforms = platforms.all;
longDescription = ''
Pinentry provides a console and (optional) GTK and Qt GUIs allowing users
to enter a passphrase when `gpg' or `gpg2' is run and needs it.
'';
maintainers = with maintainers; [ ttuegel fpletz ];
};
{
pinentry-curses = buildPinentry "curses" [ "curses" "tty" ];
pinentry-gtk2 = buildPinentry "gtk2" [ "gtk2" "curses" "tty" ];
pinentry-gnome3 = buildPinentry "gnome3" [ "gnome3" "curses" "tty" ];
pinentry-qt = buildPinentry "qt" [ "qt" "curses" "tty" ];
pinentry-emacs = buildPinentry "emacs" [ "emacs" "curses" "tty" ];
pinentry-all = buildPinentry "all" [ "curses" "tty" "gtk2" "gnome3" "qt" "emacs" ];
}

0 comments on commit 9fd9087

Please sign in to comment.