From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp10.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms9.migadu.com with LMTPS id yEEFHhlfKWSfHgAASxT56A (envelope-from ) for ; Sun, 02 Apr 2023 12:55:21 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp10.migadu.com with LMTPS id WKEMHRlfKWS6nQAAG6o9tA (envelope-from ) for ; Sun, 02 Apr 2023 12:55:21 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 08C589FB3 for ; Sun, 2 Apr 2023 12:55:20 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pivMa-0000al-Bh; Sun, 02 Apr 2023 06:55:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pivMV-0000aO-DS for guix-patches@gnu.org; Sun, 02 Apr 2023 06:55:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1pivMU-0001j8-Qj for guix-patches@gnu.org; Sun, 02 Apr 2023 06:55:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1pivMU-0002Eb-71; Sun, 02 Apr 2023 06:55:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#62612] [PATCH] home: Add gpg-agent service. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: paren@disroot.org, andrew@trop.in, guix-patches@gnu.org Resent-Date: Sun, 02 Apr 2023 10:55:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 62612 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 62612@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= , , Andrew Tropin X-Debbugs-Original-To: guix-patches@gnu.org X-Debbugs-Original-Xcc: , Andrew Tropin Received: via spool by submit@debbugs.gnu.org id=B.16804328728398 (code B ref -1); Sun, 02 Apr 2023 10:55:02 +0000 Received: (at submit) by debbugs.gnu.org; 2 Apr 2023 10:54:32 +0000 Received: from localhost ([127.0.0.1]:39269 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pivLz-0002BJ-I0 for submit@debbugs.gnu.org; Sun, 02 Apr 2023 06:54:32 -0400 Received: from lists.gnu.org ([209.51.188.17]:49490) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pivLw-0002Au-6j for submit@debbugs.gnu.org; Sun, 02 Apr 2023 06:54:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pivLv-0000Yj-NI for guix-patches@gnu.org; Sun, 02 Apr 2023 06:54:27 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pivLu-0001hd-Fq; Sun, 02 Apr 2023 06:54:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=ORBucfeCzX0ZXd2rJcCoqjODNPnY7E6VFwQhI5VCYVI=; b=OfpsjYRCIFF4Ld ooOwKxPz6PivSO7e22BeFzPiiT82avwuyuNlx1D4y6w8sB/R4qNw180ywBW49MAiqIGZBT62kHNQ1 DMNsaLeO+fgel5baOrEww7zjIrkdmQTjAiHuDyQR8rFq1oGRq4a27KUFO9/Uf78U5kpu3aoEx5rqh iDAepXcIj3+2o3VB9xTnQ3iwxwTPrqdorAaJU/Vw0XpjNcZqPWC9pwbmV+BT/RRDWKPycavz+DnUG UTRFRQK7HrN1Sm24l/lqZqIfC9kqWDeSyg6y6hlJ8pxNZHYhAQIb9sfy2S9Qk5yDwMdR2fsF00sUB in8RcQmtRuQx0voRWbcg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1pivLt-000782-Uo; Sun, 02 Apr 2023 06:54:26 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 2 Apr 2023 12:54:16 +0200 Message-Id: <20230402105416.20689-1-ludo@gnu.org> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: guix-patches-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN ARC-Seal: i=1; s=key1; d=yhetil.org; t=1680432921; a=rsa-sha256; cv=none; b=N4QvwFs14k/04QcRlsXRCI63dW2v8Lz5HY9vY1Hx2tK2d6Yf3tMsrC4BevwG3fkkqtIuQi AIIxM2YxnoFKn02dO7dFLEko0HHOXsp8zhNzkQRf8eYJk5NTpWZYNoKd9nZVpgHsb3Atri 1t5hJpkXMj69eMmejUVNnfYUqXXU0QI1ooGFZsxH0sdeugyBcvlRDFF9MJf6Wwyt/y9d5j PVNxH/+3sh8CORk8S/ZOnf+TXiW+vdS9jS+izlvvQkHpkmQ0ih0KxBjxZr1mR2KcIhiXqk Tu6Y+CMaJWBWvHoyCR5vzBhDVWJBmg0D29oPtQUGvqO8LloThf/ulrdyJn2TBA== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gnu.org header.s=fencepost-gnu-org header.b=OfpsjYRC; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1680432921; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=ORBucfeCzX0ZXd2rJcCoqjODNPnY7E6VFwQhI5VCYVI=; b=Tn2FMToZIPZz38/osYsldNsyypc67IXgLw6ev7l4T1MU71SZZPPQtk0u/VKF3qeJ5iBEmx g5ZKFdza3v7rUTDWXzN2le895uukh55TJHaAtaty3zXTfq4KhVuNsOK4triU5TvAF/85We bmC7hrV0jXyLcpyA0zzSdo8auUGZMdwUaZh4dgtEIpv4osKzLUjXzTJIDRMgfLTNTkft9p SNVFoW+fgQDW2BL9YNP6KRxg6Rsj9OML0eeZHh0/OOj+qH9AXWi/oWJNgq4d6Jz2+ZloYI JW1/qHY5KvRgiiMvofUEng/Dh7Sewn9Ks/LyEmPofaPgAC4oPjSbYrQrj3igbg== Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gnu.org header.s=fencepost-gnu-org header.b=OfpsjYRC; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" X-Migadu-Scanner: scn0.migadu.com X-Migadu-Spam-Score: -2.13 X-Spam-Score: -2.13 X-Migadu-Queue-Id: 08C589FB3 X-TUID: 3CfzgYvvcGW9 * gnu/home/services/gnupg.scm: New file. * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * doc/guix.texi (GNU Privacy Guard): New node. (Secure Shell): Link to it. --- doc/guix.texi | 93 +++++++++++++++++++++- gnu/home/services/gnupg.scm | 150 ++++++++++++++++++++++++++++++++++++ gnu/local.mk | 1 + 3 files changed, 240 insertions(+), 4 deletions(-) create mode 100644 gnu/home/services/gnupg.scm Hello! This patch adds a service for ‘gpg-agent’, allowing you to use it both for OpenPGP keys (its main job) and for OpenSSH keys, with Pinentry integration. Comments welcome! Ludo’. diff --git a/doc/guix.texi b/doc/guix.texi index a58ea8f9ec..29e8d27029 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -41787,11 +41787,12 @@ services)}. * Power Management: Power Management Home Services. Services for battery power. * Shepherd: Shepherd Home Service. Managing User's Daemons. * SSH: Secure Shell. Setting up the secure shell client. +* GPG: GNU Privacy Guard. Setting up GPG and related tools. * Desktop: Desktop Home Services. Services for graphical environments. * Guix: Guix Home Services. Services for Guix. * Fonts: Fonts Home Services. Services for managing User's fonts. * Sound: Sound Home Services. Dealing with audio. -* Messaging: Messaging Home Services. Services for managing messaging. +* Messaging: Messaging Home Services. Services for managing messaging. * Media: Media Home Services. Services for managing media. @end menu @c In addition to that Home Services can provide @@ -42557,15 +42558,18 @@ The @uref{https://www.openssh.com, OpenSSH package} includes a daemon, the @command{ssh-agent} command, that manages keys to connect to remote machines using the @acronym{SSH, secure shell} protocol. With the @code{(gnu home services ssh-agent)} service, you can configure the -OpenSSH ssh-agent to run upon login. +OpenSSH ssh-agent to run upon login. @xref{GNU Privacy Guard, +@code{home-gpg-agent-service-type}}, for an alternative to OpenSSH's +@command{ssh-agent}. + Here is an example of a service and its configuration that you could add to the @code{services} field of your @code{home-environment}: @lisp (service home-ssh-agent-service-type - (home-ssh-agent-configuration - (extra-options '("-t" "1h30m")))) + (home-ssh-agent-configuration + (extra-options '("-t" "1h30m")))) @end lisp @defvar home-ssh-agent-service-type @@ -42590,6 +42594,87 @@ Extra options will be passed to @command{ssh-agent}, please run @end table @end deftp +@node GNU Privacy Guard +@subsection GNU Privacy Guard + +@cindex GNU Privacy Guard, Home service +@cindex GPG, Home service +The @code{(gnu home services gnupg)} modules provides services that help +you set up the GNU Privacy Guard, also known as GnuPG or GPG, in your +home environment. + +@cindex gpg-agent, Home service +@cindex SSH agent, with gpg-agent +The @code{gpg-agent} service configures and sets up GPG's agent, the +program that is responsible for managing OpenPGP private keys and, +optionally, OpenSSH (secure shell) private keys (@pxref{Invoking +GPG-AGENT,,, gnupg, Using the GNU Privacy Guard}). + +As an example, here is how you would configure @code{gpg-agent} with SSH +support such that it uses the Emacs-based Pinentry interface when +prompting for a passphrase: + +@lisp +(service home-gpg-agent-service-type + (home-gpg-agent-configuration + (pinentry-program + (file-append pinentry-emacs "/bin/pinentry-emacs")) + (ssh-support? #t))) +@end lisp + +The service reference is given below. + +@defvar home-gpg-agent-service-type +This is the service type for @command{gpg-agent} (@pxref{Invoking +GPG-AGENT,,, gnupg, Using the GNU Privacy Guard}). Its value must be a +@code{home-gpg-agent-configuration}, as shown below. +@end defvar + +@c %start of fragment + +@deftp {Data Type} home-gpg-agent-configuration +Available @code{home-gpg-agent-configuration} fields are: + +@table @asis +@item @code{gnupg} (default: @code{gnupg}) (type: file-like) +The GnuPG package to use. + +@item @code{pinentry-program} (type: file-like) +Pinentry program to use. Pinentry is a small user interface that +@command{gpg-agent} delegates to anytime it needs user input for a +passphrase or @acronym{PIN,personal identification number} +(@pxref{Top,,, pinentry,Using the PIN-Entry}). + +@item @code{ssh-support?} (default: @code{#f}) (type: boolean) +Whether to enable @acronym{SSH,secure shell} support. When true, +@command{gpg-agent} acts as a drop-in replacement for OpenSSH's +@command{ssh-agent} program, taking care of OpenSSH secret keys and +directing passphrase requests to the chosen Pinentry program. + +@item @code{default-cache-ttl} (default: @code{600}) (type: integer) +Time a cache entry is valid, in seconds. + +@item @code{max-cache-ttl} (default: @code{7200}) (type: integer) +Maximum time a cache entry is valid, in seconds. After this time a +cache entry will be expired even if it has been accessed recently. + +@item @code{default-cache-ttl-ssh} (default: @code{1800}) (type: integer) +Time a cache entry for SSH keys is valid, in seconds. + +@item @code{max-cache-ttl-ssh} (default: @code{7200}) (type: integer) +Maximum time a cache entry for SSH keys is valid, in seconds. + +@item @code{extra-content} (default: @code{""}) (type: raw-configuration-string) +Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}. + +@end table + +@end deftp + + +@c %end of fragment + + @node Desktop Home Services @subsection Desktop Home Services diff --git a/gnu/home/services/gnupg.scm b/gnu/home/services/gnupg.scm new file mode 100644 index 0000000000..7e9e02a3cc --- /dev/null +++ b/gnu/home/services/gnupg.scm @@ -0,0 +1,150 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2023 Ludovic Courtès +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (gnu home services gnupg) + #:use-module (guix gexp) + #:use-module ((guix records) #:select (match-record)) + #:use-module (gnu services) + #:use-module (gnu services configuration) + #:use-module (gnu home services) + #:use-module (gnu home services shepherd) + #:autoload (gnu packages gnupg) (gnupg pinentry) + #:export (home-gpg-agent-configuration + home-gpg-agent-configuration? + home-gpg-agent-configuration-gnupg + home-gpg-agent-configuration-pinentry-program + home-gpg-agent-configuration-ssh-support? + home-gpg-agent-configuration-default-cache-ttl + home-gpg-agent-configuration-max-cache-ttl + home-gpg-agent-configuration-max-cache-ttl-ssh + home-gpg-agent-configuration-extra-content + + home-gpg-agent-service-type)) + +(define raw-configuration-string? string?) + +;; Configuration of 'gpg-agent'. +(define-configuration/no-serialization home-gpg-agent-configuration + (gnupg + (file-like gnupg) + "The GnuPG package to use.") + (pinentry-program + (file-like (file-append pinentry "/bin/pinentry-curses")) + "Pinentry program to use. Pinentry is a small user interface that +@command{gpg-agent} delegates to anytime it needs user input for a passphrase +or @acronym{PIN, personal identification number} (@pxref{Top,,, pinentry, +Using the PIN-Entry}).") + (ssh-support? + (boolean #f) + "Whether to enable @acronym{SSH, secure shell} support. When true, +@command{gpg-agent} acts as a drop-in replacement for OpenSSH's +@command{ssh-agent} program, taking care of OpenSSH secret keys and directing +passphrase requests to the chosen Pinentry program.") + (default-cache-ttl + (integer 600) + "Time a cache entry is valid, in seconds.") + (max-cache-ttl + (integer 7200) + "Maximum time a cache entry is valid, in seconds. After this time a cache +entry will be expired even if it has been accessed recently.") + (default-cache-ttl-ssh + (integer 1800) + "Time a cache entry for SSH keys is valid, in seconds.") + (max-cache-ttl-ssh + (integer 7200) + "Maximum time a cache entry for SSH keys is valid, in seconds.") + (extra-content + (raw-configuration-string "") + "Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}.")) + +(define (home-gpg-agent-configuration-file config) + "Return the @file{gpg-agent.conf} file for @var{config}." + (match-record config + (pinentry-program default-cache-ttl max-cache-ttl + default-cache-ttl-ssh max-cache-ttl-ssh + extra-content) + (mixed-text-file "gpg-agent.conf" + "pinentry-program " pinentry-program "\n" + "default-cache-ttl " + (number->string default-cache-ttl) "\n" + "max-cache-ttl " + (number->string max-cache-ttl) "\n" + "default-cache-ttl-ssh " + (number->string default-cache-ttl-ssh) "\n" + "max-cache-ttl-ssh " + (number->string max-cache-ttl-ssh) "\n" + extra-content))) + +(define (home-gpg-agent-shepherd-services config) + "Return the possibly-empty list of Shepherd services for @var{config}." + (match-record config + (gnupg ssh-support?) + ;; 'gpg-agent' is started on demand by GnuPG's programs, but it has to be + ;; started explicitly when OpenSSH support is enabled (info "(gnupg) Agent + ;; Options"). + (if ssh-support? + (let ((endpoint (lambda (name socket) + #~(endpoint + (make-socket-address + AF_UNIX + (string-append %user-runtime-dir + "/gnupg/" #$socket)) + #:name #$name + #:socket-directory-permissions #o700)))) + (list (shepherd-service + (provision '(gpg-agent ssh-agent)) + (modules '((shepherd support))) ;for '%user-runtime-dir' + (start #~(make-systemd-constructor + (list #$(file-append gnupg "/bin/gpg-agent") + "--supervised" "--enable-ssh-support") + (list #$(endpoint "ssh" "S.gpg-agent.ssh") + #$(endpoint "browser" "S.gpg-agent.browser") + #$(endpoint "extra" "S.gpg-agent.extra") + ;; #$(endpoint "scdaemon" "S.scdaemon") + #$(endpoint "std" "S.gpg-agent")))) + (stop #~(make-systemd-destructor)) + (documentation "Start 'gpg-agent', the GnuPG passphrase +agent, with support for handling OpenSSH material.")))) + '()))) + +(define (home-gpg-agent-files config) + `((".gnupg/gpg-agent.conf" ,(home-gpg-agent-configuration-file config)))) + +(define (home-gpg-agent-environment-variables config) + "Return GnuPG environment variables needed for @var{config}." + (if (home-gpg-agent-configuration-ssh-support? config) + `(("SSH_AUTH_SOCK" + . "$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh")) + '())) + +(define home-gpg-agent-service-type + (service-type + (name 'home-gpg-agent) + (extensions + (list (service-extension home-files-service-type + home-gpg-agent-files) + (service-extension home-shepherd-service-type + home-gpg-agent-shepherd-services) + (service-extension home-environment-variables-service-type + home-gpg-agent-environment-variables))) + (default-value (home-gpg-agent-configuration)) + (description + "Configure GnuPG's agent, @command{gpg-agent}, which is responsible for +managing OpenPGP and optionally SSH private keys. When SSH support is +enabled, @command{gpg-agent} acts as a drop-in replacement for OpenSSH's +@command{ssh-agent}."))) diff --git a/gnu/local.mk b/gnu/local.mk index 3a93ab50dd..77243b7c2f 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -91,6 +91,7 @@ GNU_SYSTEM_MODULES = \ %D%/home/services/desktop.scm \ %D%/home/services/symlink-manager.scm \ %D%/home/services/fontutils.scm \ + %D%/home/services/gnupg.scm \ %D%/home/services/guix.scm \ %D%/home/services/media.scm \ %D%/home/services/messaging.scm \ base-commit: e7558d16479158f893bca7c295986c08c151caa9 -- 2.39.2