Repository navigation
feat(packages): add GNOME desktop apps for isDesktop #1164
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -434,13 +434,17 @@ inputs.nixpkgs.lib.nixosSystem { | |||||||||||||
| }; | ||||||||||||||
| }; | ||||||||||||||
|
|
||||||||||||||
| # GNOME Keyring - auto-unlocks GPG key on login via PAM | ||||||||||||||
| services.gnome.gnome-keyring.enable = true; | ||||||||||||||
| security.pam.services.greetd.enableGnomeKeyring = true; | ||||||||||||||
|
cubic-dev-ai[bot] marked this conversation as resolved.
Resolved
|
||||||||||||||
|
|
||||||||||||||
| # GPG agent configuration | ||||||||||||||
| services.gpg-agent = { | ||||||||||||||
| enable = true; | ||||||||||||||
| enableSshSupport = false; | ||||||||||||||
| pinentry.package = pkgs.pinentry-gnome3; | ||||||||||||||
| defaultCacheTtl = 2147483647; # max (effectively forever) | ||||||||||||||
| maxCacheTtl = 2147483647; # max (effectively forever) | ||||||||||||||
|
Comment on lines
+531
to
+532
Comment on lines
+530
to
+532
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: For desktop usage, the official GnuPG documentation recommends the default values for gpg-agent: default-cache-ttl of 600 seconds (10 minutes) and max-cache-ttl of 7200 seconds (2 hours). These are explicitly stated as the defaults in the gpg-agent man page and agent options documentation across multiple GnuPG versions, including the current stable series (2.5.x as of 2026). No specific "recommended" values different from defaults are given for desktop usage in official docs; the defaults are considered suitable for general interactive use, balancing convenience and security. Setting default-cache-ttl and max-cache-ttl to 2147483647 (2^31-1 seconds, approximately 68 years) effectively disables passphrase expiration. Security implications include: - Passphrases remain in memory indefinitely (until agent restart or manual eviction), increasing risk if the machine is compromised, stolen, or accessed by an unauthorized local user. - Heightens exposure to memory-dumping attacks (e.g., via tools like gpg_reaper demonstrated in a GnuPG bug report). - Conflicts with security best practices for desktop environments, where session-based caching (e.g., until logout) is preferable. - Even with long TTLs, newer GnuPG versions use timers for eviction (not just on access), but extremely long values still pose risks. To apply: Edit ~/.gnupg/gpg-agent.conf with the options (without leading --), then gpgconf --kill gpg-agent; gpgconf --launch gpg-agent. Citations:
Avoid effectively-forever GPG cache TTLs. Lines 473–474 set passphrase cache retention to ~68 years (2147483647 seconds). Official GnuPG documentation recommends default-cache-ttl of 600 seconds (10 minutes) and max-cache-ttl of 7200 seconds (2 hours). Extended TTLs significantly weaken workstation security if the user session is compromised, as passphrases remain in memory indefinitely and increase exposure to memory-dumping attacks. Keep the GNOME unlock flow but bound gpg-agent TTLs to practical limits. Suggested change services.gpg-agent = {
enable = true;
enableSshSupport = false;
pinentry.package = pkgs.pinentry-gnome3;
- defaultCacheTtl = 2147483647; # max (effectively forever)
- maxCacheTtl = 2147483647; # max (effectively forever)
+ defaultCacheTtl = 28800; # 8h
+ maxCacheTtl = 86400; # 24h cap
};📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||
| }; | ||||||||||||||
|
|
||||||||||||||
| # GPG_TTY is set in fish shell init instead of sessionVariables | ||||||||||||||
|
|
||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change introduces
loupe, and another part of the pull request addseog(on line 137). Both are image viewers, withloupebeing the modern successor toeogin GNOME. To avoid redundancy in installed applications, you might want to consider including only one of them. For a more modern setup, keepingloupeand removingeogwould be a reasonable choice.