gnupg: Support declarative GPG keysfiles by MilesBreslin · Pull Request #810 · nix-community/home-manager

MilesBreslin · 2019-08-20T08:37:44Z

Adds a new option programs.gpg.keyfiles to be an array of paths to gpg key exports.

Is implemented as an activation script that runs gpg --import $key for each key.

rycee

Thanks for the contribution! I've added a few comments.

veehaitch

I'd like to revive this PR :) happy to lend a hand.

veehaitch · 2021-01-09T10:56:35Z

+      importGgpKeys = dag.entryAfter ["linkGeneration"] (
+        let
+          importKey = keyfile: ''
+            ${pkgs.gnupg}/bin/gpg --import ${lib.escapeShellArg (builtins.toString (pkgs.copyPathToStore keyfile))}


Instead of adding the given keys to any preexisting state of GnuPG, we could also create the file pubring.kbx in its entirety and symlink it similar to .gnupg/gpg.conf.

I really like this idea, but I'm unsure how to implement it

How does this work though, does this then prevent me from ever importing gpg keys without adding them to my h-m configuration first? I'd prefer to just have them imported on top, like I think is happening now.

@colemickens That's correct. I think, however, that such an approach is well aligned with the goal of achieving a declarative, reproducible configuration. Moreover, home-manager works like this in other places as well, for example programs.git.

@MilesBreslin We could create a derivation which sets export GNUPGHOME=$TMPDIR, imports all configured keys and then produces pubring.kbx as an output.

Hm. To me, Git's configuration is completely static, whereas I regularly have to import gpg keys on the fly to work with sops or just do general things; so I view them differently (however, I am of course a fan of having everything managed, so I get this desire).

If GPG had a way to read from multiple pubrings, I'd be a lot more excited about pre-forming and symlinking the primary one.

Can we support both, maybe?

veehaitch · 2021-01-09T11:04:07Z

      '';
    };
+
+    keyfiles = mkOption {


It would be great to have an option to also give the ownertrust of a key. This information is stored in the file .gnupg/trustdb.gpg. Unfortuantely, it is regularly written to by GnuPG even on operations which one would regard as read-only. Therefore, symlinking into the Nix store (as I'd suggest for the public keys, see below) would likely cause unexpected issues. It could be a middle ground to copy the trustdb.gpg file instead of symlinking it.

MilesBreslin

I've added mutable and immutable support for both key files and trust. Since the trustdb needs to be writable, it gets copied on each activation.

MilesBreslin · 2021-02-26T00:30:45Z

+
+              # Copy immutable trust
+              (optionalString (trust != null && !cfg.mutableTrust) ''
+                install -m 0700 ${keyringFiles}/trustdb.gpg "$HOME/.gnupg/trustdb.gpg"


Is there a better way to do this?

stale · 2021-05-27T01:42:10Z

Thank you for your contribution! I marked this pull request as stale due to inactivity. If this remains inactive for another 7 days, I will close this PR. Please read the relevant sections below before commenting.

If you are the original author of the PR

GitHub sometimes doesn't notify people who commented / reviewed a PR previously, when you (force) push commits. If you have addressed the reviews you can officially ask for a review from those who commented to you or anyone else.
If it is unfinished but you plan to finish it, please mark it as a draft.
If you don't expect to work on it any time soon, please consider closing it with a short comment encouraging someone else to pick up your work.
To get things rolling again, rebase the PR against the target branch and address valid comments.

If you are not the original author of the issue

If you want to pick up the work on this PR, please create a new PR and indicate that it supercedes and closes this PR.

colemickens · 2021-06-03T03:37:46Z

:( I'd still like to see this.

MilesBreslin · 2021-06-04T07:52:12Z

Is there something I can do to push this along? I've been running with my own version of this for a while now, but I'd still like to get it upstream.

rycee · 2021-10-31T22:53:45Z

I finally had a bit of time to look at this more carefully. Rebased and made a few cleanups and such. The most noticeable one is renaming programs.gpg.keyfiles to programs.gpg.publicKeys, which seems to me a more descriptive name.

Please have a look at the last few commits and see if I made any mistakes.

MilesBreslin · 2021-11-04T02:15:16Z

These changes look good at a glance. It's been a while since I've looked at this, but it looks like everything is there and should be functional. I'll give it a go this weekend.

Thanks for helping organize this. This looks better!

MilesBreslin · 2021-11-18T04:53:32Z

Tested on my configuration. It seems to be working with no issues now. I use mutableTrust = false and mutableKeys = false. There was an issue with the trust not getting set, but I've added commits to both fix that and test for that.

MilesBreslin · 2021-11-19T03:02:43Z

Existing file '/home/user/.gnupg/pubring.kbx.old' would be clobbered by backing up '/home/user/.gnupg/pubring.kbx'
Please move the above files and try again or use -b <ext> to move automatically.

Looks like this needs to be more forceful.

MilesBreslin · 2021-11-21T23:25:28Z

Looking into this further, this is just a migration issue on my end. This is working as intended.

rycee · 2021-11-25T23:44:55Z

@MilesBreslin Nice, so this is OK to merge? If so, then I can squash and merge as soon as possible.

MilesBreslin · 2021-11-26T00:28:14Z

@rycee Yes, this should be good to merge.

PR nix-community#810

rycee · 2021-11-26T08:26:50Z

Great, merged to master now. Good job!

ebbertd · 2021-11-28T11:51:13Z

Thank you for making this possible. This works great.

PR nix-community#810

PR nix-community#810 (cherry picked from commit ea1794a)

PR #810 (cherry picked from commit ea1794a)

rycee reviewed Aug 20, 2019

View reviewed changes

Comment thread modules/programs/gpg.nix Outdated

Comment thread modules/programs/gpg.nix Outdated

Comment thread modules/programs/gpg.nix Outdated

Comment thread modules/programs/gpg.nix Outdated

MilesBreslin force-pushed the gpg_keys branch 7 times, most recently from 642e750 to 1413ee2 Compare August 20, 2019 19:18

veehaitch reviewed Jan 9, 2021

View reviewed changes

MilesBreslin force-pushed the gpg_keys branch from cd5b8dd to b7a1ece Compare February 25, 2021 22:27

MilesBreslin commented Feb 26, 2021

View reviewed changes

sumnerevans mentioned this pull request Apr 29, 2021

format: remove exception for a few more modules #1969

Closed

7 tasks

stale bot added the status: stale label May 27, 2021

stale bot closed this Jun 3, 2021

rycee added pinned Prevent marking as stale and removed status: stale labels Jun 4, 2021

rycee reopened this Jun 4, 2021

rycee force-pushed the gpg_keys branch from 363d563 to b109500 Compare October 31, 2021 22:08

rycee force-pushed the gpg_keys branch from 5d9bc86 to 8ece45d Compare November 1, 2021 00:04

rycee force-pushed the gpg_keys branch from 9aa71f9 to db34371 Compare November 25, 2021 23:42

gpg: support declarative trust and public keys

ea1794a

PR nix-community#810

rycee force-pushed the gpg_keys branch from 008d774 to ea1794a Compare November 26, 2021 08:05

rycee merged commit ea1794a into nix-community:master Nov 26, 2021

peterhoeg pushed a commit to peterhoeg/home-manager that referenced this pull request Dec 6, 2021

gpg: support declarative trust and public keys

ed56a5c

PR nix-community#810

kalbasit pushed a commit to kalbasit/home-manager that referenced this pull request Dec 18, 2021

gpg: support declarative trust and public keys

c06fc70

PR nix-community#810 (cherry picked from commit ea1794a)

kalbasit pushed a commit to kalbasit/home-manager that referenced this pull request Dec 18, 2021

gpg: support declarative trust and public keys

a0ceacf

PR nix-community#810 (cherry picked from commit ea1794a)

rycee pushed a commit that referenced this pull request Dec 19, 2021

gpg: support declarative trust and public keys

e0bfb57

PR #810 (cherry picked from commit ea1794a)

Uh oh!

Conversation

MilesBreslin commented Aug 20, 2019

Uh oh!

rycee left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

veehaitch left a comment

Choose a reason for hiding this comment

Uh oh!

veehaitch Jan 9, 2021

Choose a reason for hiding this comment

Uh oh!

MilesBreslin Jan 12, 2021

Choose a reason for hiding this comment

Uh oh!

colemickens Jan 15, 2021

Choose a reason for hiding this comment

Uh oh!

veehaitch Jan 15, 2021

Choose a reason for hiding this comment

Uh oh!

colemickens Jan 15, 2021

Choose a reason for hiding this comment

Uh oh!

veehaitch Jan 9, 2021

Choose a reason for hiding this comment

Uh oh!

MilesBreslin left a comment

Choose a reason for hiding this comment

Uh oh!

MilesBreslin Feb 26, 2021

Choose a reason for hiding this comment

Uh oh!

stale bot commented May 27, 2021

Uh oh!

colemickens commented Jun 3, 2021

Uh oh!

MilesBreslin commented Jun 4, 2021

Uh oh!

rycee commented Oct 31, 2021

Uh oh!

MilesBreslin commented Nov 4, 2021

Uh oh!

MilesBreslin commented Nov 18, 2021

Uh oh!

MilesBreslin commented Nov 19, 2021

Uh oh!

MilesBreslin commented Nov 21, 2021

Uh oh!

rycee commented Nov 25, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MilesBreslin commented Nov 26, 2021

Uh oh!

rycee commented Nov 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ebbertd commented Nov 28, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rycee commented Nov 25, 2021 •

edited

Loading

rycee commented Nov 26, 2021 •

edited

Loading