diff --git a/config/powershell/Profile.ps1 b/config/powershell/Profile.ps1 index ccb4f4ac..b0ae7bf2 100644 --- a/config/powershell/Profile.ps1 +++ b/config/powershell/Profile.ps1 @@ -21,7 +21,7 @@ function la { # https://github.com/microsoft/winget-cli/issues/2498#issuecomment-1553863082 $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User") # Specify `bash -i` to run the bash as interactive mode -[Environment]::SetEnvironmentVariable("RCLONE_PASSWORD_COMMAND", 'wsl.exe --exec bash -ic "pass show rclone"') +[Environment]::SetEnvironmentVariable("RCLONE_PASSWORD_COMMAND", 'wsl.exe --exec bash -ic "gopass show rclone"') Invoke-Expression (&starship init powershell) Invoke-Expression (& { (zoxide init powershell | Out-String) }) diff --git a/home-manager/common.nix b/home-manager/common.nix index b96f8af4..b8fbddd0 100644 --- a/home-manager/common.nix +++ b/home-manager/common.nix @@ -12,7 +12,7 @@ ./bash.nix ./zsh.nix ./fish.nix - ./gpg.nix + ./pgp.nix ./ssh.nix ./git.nix ./editors.nix @@ -65,8 +65,8 @@ STACK_XDG = "https://github.com/commercialhaskell/stack/blob/72f0a1273dd1121740501a159988fc23df2fb362/doc/stack_root.md?plain=1#L7-L11"; - # Don't add needless quotation in the arguments. For example `pass show 'rclone'` does not work. It should be `pass show rclone`. - RCLONE_PASSWORD_COMMAND = "${lib.getExe pkgs.pass} show rclone"; + # Don't add needless quotation in the arguments. For example `gopass show 'rclone'` does not work. It should be `gopass show rclone`. + RCLONE_PASSWORD_COMMAND = "${lib.getExe pkgs.gopass} show rclone"; }; sessionPath = [ diff --git a/home-manager/git.nix b/home-manager/git.nix index dde31d5c..da1fdaa9 100644 --- a/home-manager/git.nix +++ b/home-manager/git.nix @@ -1,6 +1,7 @@ { pkgs, homemade-pkgs, + edge-pkgs, lib, ... }: @@ -57,9 +58,11 @@ }; gpg = { - # I prefer GPG sign rather than SSH key to consider revocation and expiration usecase. + # I prefer PGP sign rather than SSH key to consider revocation and expiration usecase. # See https://github.com/kachick/dotfiles/issues/289 for detail. format = "openpgp"; + + program = "${pkgs.lib.getBin edge-pkgs.sequoia-chameleon-gnupg}/bin/gpg-sq"; # GH-830 }; commit = { diff --git a/home-manager/packages.nix b/home-manager/packages.nix index 2800f167..3ba98533 100644 --- a/home-manager/packages.nix +++ b/home-manager/packages.nix @@ -44,10 +44,13 @@ gh ghq - # GPG - gnupg + edge-pkgs.sequoia-sq # Alt `gpg` - nixos-24.05 does not backport recent versions and the older requires to rebuild. https://github.com/NixOS/nixpkgs/pull/331099 + edge-pkgs.sequoia-chameleon-gnupg + gnupg # Also keep original GPG for now. sequoia-chameleon-gnupg does not support some crucial toolset. etc: `gpg --edit-key`, `gpgconf` - pass + # Alt `pass` for password-store. Candidates: gopass, prs + gopass # They will respect pass comaptibility: https://github.com/gopasspw/gopass/issues/1365#issuecomment-719655627 + # Do not use ripasso-cursive for now. It only provides TUI, not a replacement of CLI. And currently unstable on my NixOS. # Do not specify vim and the plugins at here, it made collisions from home-manager vim module. # See following issues diff --git a/home-manager/gpg.nix b/home-manager/pgp.nix similarity index 61% rename from home-manager/gpg.nix rename to home-manager/pgp.nix index acb608b7..65a7ab16 100644 --- a/home-manager/gpg.nix +++ b/home-manager/pgp.nix @@ -1,6 +1,25 @@ -{ config, pkgs, ... }: +{ + config, + pkgs, + edge-pkgs, + ... +}: -# ## FAQ - GPG +# # FAQ +# +# ## sequoia-sq and gpg +# +# See GH-830 +# +# If you faced to decrypt error with gpg-sq, check it with `sq decrypt`. It displays error details. +# For example, `1: AEAD Encrypted Data Packet v1 is not considered secure` +# This is caused by encrypted non configured gpg for the AEAD. Disable it with showpref/setpref if you still use gpg. +# +# ## sequoia-sq +# +# TODO: +# +# ## GPG # # - How to list keys? # - 1. `gpg --list-secret-keys --keyid-format=long` # The `sec` first section displays same text as `pub` by `gpg --list-keys --keyid-format=long` @@ -23,6 +42,9 @@ let day = 60 * 60 * 24; in { + # Don't set $SEQUOIA_HOME, it unified config and data, cache to one directory as same as gpg era. + # Use default $HOME instead, it respects XDG Base Directory Specification + # https://github.com/nix-community/home-manager/blob/release-24.05/modules/services/gpg-agent.nix services.gpg-agent = { enable = pkgs.stdenv.isLinux; @@ -41,16 +63,23 @@ in enableSshSupport = false; }; - # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/gpg.nix + home.sessionVariables = { + GOPASS_GPG_BINARY = "${pkgs.lib.getBin edge-pkgs.sequoia-chameleon-gnupg}/bin/gpg-sq"; + }; + # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/gpg.nix programs.gpg = { enable = true; + # package = edge-pkgs.sequoia-chameleon-gnupg; # Also will be respected in gpg-agent: https://github.com/nix-community/home-manager/blob/5171f5ef654425e09d9c2100f856d887da595437/modules/services/gpg-agent.nix#L8C3-L8C9 + # However I prefer original gnupg for now, sequoia-chameleon-gnupg does not support crucial features for GPG toolset (etc. `gpg --edit-key`, `gpgconf`) # Preferring XDG_DATA_HOME rather than XDG_CONFIG_HOME from following examples # - https://wiki.archlinux.org/title/XDG_Base_Directory # - https://github.com/nix-community/home-manager/blob/5171f5ef654425e09d9c2100f856d887da595437/modules/programs/gpg.nix#L192 homedir = "${config.xdg.dataHome}/gnupg"; + # Used for `gpg.conf`. I don't know how to specify `gpgconf` with this. + # TODO: Set gpg binary as sequoia-chameleon-gnupg. AFAIK I don't actually need it for now, because I'm not using dependent tools. However it is ideal config. # - How to read `--list-keys` - https://unix.stackexchange.com/questions/613839/help-understanding-gpg-list-keys-output # - Ed448 in GitHub is not yet supported - https://github.com/orgs/community/discussions/45937 settings = { @@ -64,5 +93,6 @@ in # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/password-store.nix programs.password-store = { enable = true; + package = pkgs.gopass; # Setting package is not a aliasing command, however I would try this for now. https://github.com/gopasspw/gopass/blob/70c56f9102999661b54e28c28fa2d63fa5fc813b/docs/setup.md?plain=1#L292-L298 }; } diff --git a/home-manager/ssh.nix b/home-manager/ssh.nix index 6206243c..fc2be679 100644 --- a/home-manager/ssh.nix +++ b/home-manager/ssh.nix @@ -24,9 +24,9 @@ in SSH_ASKPASS = pkgs.lib.getExe ( pkgs.writeShellApplication { name = "ssh-ask-pass"; - text = "pass show ssh-pass"; + text = "gopass show ssh-pass"; meta.description = "GH-714. Required to be wrapped with one command because of SSH_ASKPASS does not accept arguments."; - runtimeInputs = with pkgs; [ pass ]; + runtimeInputs = with pkgs; [ gopass ]; } ); };