Prefer sequoia-sq for the option of OpenPGP implementation

config/powershell/Profile.ps1

@@ -21,7 +21,7 @@ function la {
 # https://github.com/microsoft/winget-cli/issues/2498#issuecomment-1553863082
 $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
 # Specify `bash -i` to run the bash as interactive mode
-[Environment]::SetEnvironmentVariable("RCLONE_PASSWORD_COMMAND", 'wsl.exe --exec bash -ic "pass show rclone"')
+[Environment]::SetEnvironmentVariable("RCLONE_PASSWORD_COMMAND", 'wsl.exe --exec bash -ic "gopass show rclone"')
 Invoke-Expression (&starship init powershell)
 Invoke-Expression (& { (zoxide init powershell | Out-String) })
 

flake.nix

@@ -123,6 +123,7 @@
               "la"
               "lat"
               "zed"
+              "gpg-alias-with-sq"
               "ghqf"
               "git-delete-merged-branches"
               "git-log-fzf"

home-manager/common.nix

@@ -12,7 +12,7 @@
     ./bash.nix
     ./zsh.nix
     ./fish.nix
-    ./gpg.nix
+    ./pgp.nix
     ./ssh.nix
     ./git.nix
     ./editors.nix
@@ -65,8 +65,8 @@
 
       STACK_XDG = "https://github.com/commercialhaskell/stack/blob/72f0a1273dd1121740501a159988fc23df2fb362/doc/stack_root.md?plain=1#L7-L11";
 
-      # Don't add needless quotation in the arguments. For example `pass show 'rclone'` does not work. It should be `pass show rclone`.
-      RCLONE_PASSWORD_COMMAND = "${lib.getExe pkgs.pass} show rclone";
+      # Don't add needless quotation in the arguments. For example `gopass show 'rclone'` does not work. It should be `gopass show rclone`.
+      RCLONE_PASSWORD_COMMAND = "${lib.getExe pkgs.gopass} show rclone";
     };
 
     sessionPath = [

home-manager/git.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   homemade-pkgs,
+  edge-pkgs,
   lib,
   ...
 }:
@@ -57,9 +58,11 @@
       };
 
       gpg = {
-        # I prefer GPG sign rather than SSH key to consider revocation and expiration usecase.
+        # I prefer PGP sign rather than SSH key to consider revocation and expiration usecase.
         # See https://github.com/kachick/dotfiles/issues/289 for detail.
         format = "openpgp";
+
+        program = "${pkgs.lib.getBin edge-pkgs.sequoia-chameleon-gnupg}/bin/gpg-sq"; # GH-830
       };
 
       commit = {

home-manager/packages.nix

@@ -44,10 +44,11 @@
     gh
     ghq
 
-    # GPG
-    gnupg
+    edge-pkgs.sequoia-sq # Alt `gpg` - nixos-24.05 does not backport recent versions and the older requires to rebuild. https://github.com/NixOS/nixpkgs/pull/331099
+    edge-pkgs.sequoia-chameleon-gnupg
 
-    pass
+    gopass # Alt `pass` for password-store. Other candidates: prs
+    # Do not use ripasso-cursive for now. It only provides TUI, not a replacement of CLI. And currently unstable on my NixOS.
 
     # Do not specify vim and the plugins at here, it made collisions from home-manager vim module.
     # See following issues
@@ -178,4 +179,5 @@
   archive-home-files
   gredit
   preview
+  gpg-alias-with-sq
 ])

home-manager/gpg.nix → home-manager/pgp.nix

@@ -1,6 +1,25 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  edge-pkgs,
+  ...
+}:
 
-# ## FAQ - GPG
+# # FAQ
+#
+# ## sequoia-sq and gpg
+#
+# See GH-830
+#
+# If you faced to decrypt error with gpg-sq, check it with `sq decrypt`. It displays error details.
+# For example, `1: AEAD Encrypted Data Packet v1 is not considered secure`
+# This is caused by encrypted non configured gpg for the AEAD. Disable it with showpref/setpref if you still use gpg.
+#
+# ## sequoia-sq
+#
+# TODO: <UPDATE ME>
+#
+# ## GPG
 #
 # - How to list keys?
 #   - 1. `gpg --list-secret-keys --keyid-format=long` # The `sec` first section displays same text as `pub` by `gpg --list-keys --keyid-format=long`
@@ -23,6 +42,9 @@ let
   day = 60 * 60 * 24;
 in
 {
+  # Don't set $SEQUOIA_HOME, it unified config and data, cache to one directory as same as gpg era.
+  # Use default $HOME instead, it respects XDG Base Directory Specification
+
   # https://github.com/nix-community/home-manager/blob/release-24.05/modules/services/gpg-agent.nix
   services.gpg-agent = {
     enable = pkgs.stdenv.isLinux;
@@ -41,16 +63,22 @@ in
     enableSshSupport = false;
   };
 
-  # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/gpg.nix
+  home.sessionVariables = {
+    GOPASS_GPG_BINARY = "${pkgs.lib.getBin edge-pkgs.sequoia-chameleon-gnupg}/bin/gpg-sq";
+  };
 
+  # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/gpg.nix
   programs.gpg = {
     enable = true;
+    package = edge-pkgs.sequoia-chameleon-gnupg; # TODO: Consider to set pkgs.emptyDirectory
 
     # Preferring XDG_DATA_HOME rather than XDG_CONFIG_HOME from following examples
     #   - https://wiki.archlinux.org/title/XDG_Base_Directory
     #   - https://github.com/nix-community/home-manager/blob/5171f5ef654425e09d9c2100f856d887da595437/modules/programs/gpg.nix#L192
     homedir = "${config.xdg.dataHome}/gnupg";
 
+    # Used for `gpg.conf`. I don't know how to specify `gpgconf` with this.
+    # TODO: Set gpg binary as sequoia-chameleon-gnupg. AFAIK I don't actually need it for now, because I'm not using dependent tools. However it is ideal config.
     # - How to read `--list-keys` - https://unix.stackexchange.com/questions/613839/help-understanding-gpg-list-keys-output
     # - Ed448 in GitHub is not yet supported - https://github.com/orgs/community/discussions/45937
     settings = {
@@ -64,5 +92,6 @@ in
   # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/password-store.nix
   programs.password-store = {
     enable = true;
+    package = pkgs.gopass;
   };
 }

home-manager/ssh.nix

@@ -24,9 +24,9 @@ in
     SSH_ASKPASS = pkgs.lib.getExe (
       pkgs.writeShellApplication {
         name = "ssh-ask-pass";
-        text = "pass show ssh-pass";
+        text = "gopass show ssh-pass";
         meta.description = "GH-714. Required to be wrapped with one command because of SSH_ASKPASS does not accept arguments.";
-        runtimeInputs = with pkgs; [ pass ];
+        runtimeInputs = with pkgs; [ gopass ];
       }
     );
   };

pkgs/default.nix

@@ -20,6 +20,8 @@
 
   zed = import ./zed { inherit pkgs edge-pkgs; };
 
+  gpg-alias-with-sq = import ./gpg-alias-with-sq { inherit pkgs edge-pkgs; };
+
   walk = import ./walk { inherit pkgs; };
 
   ir = pkgs.callPackage ./ir { };

pkgs/gpg-alias-with-sq/default.nix

@@ -0,0 +1,7 @@
+{ pkgs, edge-pkgs, ... }:
+pkgs.writeShellApplication rec {
+  name = "gpg"; # This will be the alias.
+  text = builtins.readFile ./${name}.bash;
+  runtimeInputs = [ edge-pkgs.sequoia-chameleon-gnupg ];
+  meta.description = "See GH-830";
+}

pkgs/gpg-alias-with-sq/gpg.bash

@@ -0,0 +1 @@
+gpg-sq "$@"