diff mbox series

[bug#62461,v2,1/4] gnu: home-openssh-configuration: Add field add-keys-to-agent.

Message ID 20230420083010.12285-1-ngraves@ngraves.fr
State New
Headers show
Series [bug#62461,v2,1/4] gnu: home-openssh-configuration: Add field add-keys-to-agent. | expand

Commit Message

Nicolas Graves April 20, 2023, 8:30 a.m. UTC 
---
 doc/guix.texi             | 14 +++++++++++++
 gnu/home/services/ssh.scm | 44 +++++++++++++++++++++++++++++++--------
 2 files changed, 49 insertions(+), 9 deletions(-)

Comments

Ludovic Courtès May 14, 2023, 9:11 p.m. UTC | #1 
Hi Nicolas,

Apologies for the late reply.

It seems some of the suggestions I made didn’t make it into v2, namely:

  https://issues.guix.gnu.org/62461#5
  https://issues.guix.gnu.org/62461#6

Could you take a look?

I’m sorry that it too so long; please feel free to ping me on IRC once
you’ve sent a new version.

Thanks,
Ludo’.
diff mbox series

Patch

diff --git a/doc/guix.texi b/doc/guix.texi
index 5973ea86cc..daefe63074 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -42601,6 +42601,20 @@  Concretely, these files are concatenated and made available as
 running on this machine, then it @emph{may} take this file into account:
 this is what @command{sshd} does by default, but be aware that it can
 also be configured to ignore it.
+
+@item @code{add-keys-to-agent} (default: @code{``no''})
+This string specifies whether keys should be automatically added to a
+running ssh-agent.  If this option is set to @code{``yes''} and a key is
+loaded from a file, the key and its passphrase are added to the agent
+with the default lifetime, as if by @code{ssh-add}.  If this option is
+set to @code{``ask''}, @code{ssh} will require confirmation.  If this
+option is set to @code{``confirm''}, each use of the key must be
+confirmed.  If this option is set to @code{``no''}, no keys are added to
+the agent.  Alternately, this option may be specified as a time interval
+to specify the key's lifetime in @code{ssh-agent}, after which it will
+automatically be removed.  The argument must be @code{``no''},
+@code{``yes''}, @code{``confirm''} (optionally followed by a time
+interval), @code{``ask''} or a time interval.
 @end table
 @end deftp
 
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 01917a29cd..4ab2adb292 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -1,6 +1,7 @@ 
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2022 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2023 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,6 +40,7 @@  (define-module (gnu home services ssh)
             home-openssh-configuration-authorized-keys
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
+            home-openssh-configuration-add-keys-to-agent
             home-ssh-agent-configuration
 
             openssh-host
@@ -185,17 +187,41 @@  (define (openssh-host-name-field? field)
 (define-record-type* <home-openssh-configuration>
   home-openssh-configuration make-home-openssh-configuration
   home-openssh-configuration?
-  (authorized-keys home-openssh-configuration-authorized-keys ;list of file-like
-                   (default '()))
-  (known-hosts     home-openssh-configuration-known-hosts ;unspec | list of file-like
-                   (default *unspecified*))
-  (hosts           home-openssh-configuration-hosts   ;list of <openssh-host>
-                   (default '())))
+  (authorized-keys   home-openssh-configuration-authorized-keys ;list of file-like
+                     (default '()))
+  (known-hosts       home-openssh-configuration-known-hosts ;unspec | list of file-like
+                     (default *unspecified*))
+  (hosts             home-openssh-configuration-hosts   ;list of <openssh-host>
+                     (default '()))
+  (add-keys-to-agent home-openssh-configuration-add-keys-to-agent ;string with limited values
+                     (default "no")))
+
+(define (serialize-add-keys-to-agent value)
+  (define (is-valid-time-string? str)
+    (and (> (string-length str) 0)
+         (eq?
+          (cdr (vector-ref
+                (string-match "\
+[0-9]+|([0-9]+[Ww])?([0-9]+[Dd])?([0-9]+[Hh])?([0-9]+[Mm])?([0-9]+[Ss])?" str)
+                1))
+          (string-length str))))
+
+  (string-append "AddKeysToAgent "
+                 (cond ((member value '("yes" "no" "confirm" "ask")) value)
+                       ((is-valid-time-string? value) value)
+                       ((and (string-prefix? "confirm" value)
+                             (is-valid-time-string?
+                              (cdr (string-split value #\ )))) value)
+                       ;; The 'else' branch is unreachable.
+                       (else (raise (condition (&error)))))))
 
 (define (openssh-configuration->string config)
-  (string-join (map serialize-openssh-host
-                    (home-openssh-configuration-hosts config))
-               "\n"))
+  (string-join
+   (cons* (serialize-add-keys-to-agent
+           (home-openssh-configuration-add-keys-to-agent config))
+          (map serialize-openssh-host
+               (home-openssh-configuration-hosts config)))
+   "\n"))
 
 (define* (file-join name files #:optional (delimiter " "))
   "Return a file in the store called @var{name} that is the concatenation