From patchwork Tue Apr 15 14:13:40 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?S=C3=A9bastien_Farge?= X-Patchwork-Id: 41698 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id CC36327BC4B; Tue, 15 Apr 2025 15:16:48 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_VALIDITY_CERTIFIED,RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE, SPF_HELO_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id EE5E027BC49 for ; Tue, 15 Apr 2025 15:16:46 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1u4h5A-0005Ej-Bs; Tue, 15 Apr 2025 10:16:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u4h50-00053m-ND for guix-patches@gnu.org; Tue, 15 Apr 2025 10:16:06 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1u4h50-0004rl-DS for guix-patches@gnu.org; Tue, 15 Apr 2025 10:16:02 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debbugs.gnu.org; s=debbugs-gnu-org; h=MIME-Version:Date:From:To:Subject; bh=lJuHo05HUPx+F3Vhi5V2ewg4o1dySXPxeHT7NCceOcY=; b=e/N5Wq9T8f7Ext5e6ylM0+MmARjfzrpujIj9Yylmz+wp1HXTYGpQU4A38senXrrydPsfoZ+2pMGihU/gDq36IGllHdcQP7zI7zvJjUE909crtpg2nQgDgezyH6T9Vw4j8LQs6fHHvmlZtLIxxoeCaxB7J34w5AE6Knwqw9YYJhAieZswZv/2x59FcwR5qynfXObfugeiq70yMN8g1b5j+dfLz6RYUBHQ1kPeQaz14cDNAwP4TgOAn6Tq2RNIWR2bmmSpD9aQmn3Pp+5QIlNjhAFcXsiFmfFrRNKTswvrfBrPB9QVgPGY7opUCvSud7RzcD8HgvalC/oozf/JbCKUew==; Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1u4h50-0005jh-0y for guix-patches@gnu.org; Tue, 15 Apr 2025 10:16:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#77826] [PATCH] home: home-gpg-agent-service: add new parameter 'use-keyboxd?'. Resent-From: =?utf-8?q?S=C3=A9bastien?= Farge Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 15 Apr 2025 14:16:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 77826 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 77826@debbugs.gnu.org Cc: =?utf-8?q?S=C3=A9bastien?= Farge X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.174472651721848 (code B ref -1); Tue, 15 Apr 2025 14:16:01 +0000 Received: (at submit) by debbugs.gnu.org; 15 Apr 2025 14:15:17 +0000 Received: from localhost ([127.0.0.1]:52918 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1u4h4G-0005fX-IV for submit@debbugs.gnu.org; Tue, 15 Apr 2025 10:15:17 -0400 Received: from lists.gnu.org ([2001:470:142::17]:55518) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1u4h4D-0005ao-69 for submit@debbugs.gnu.org; Tue, 15 Apr 2025 10:15:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u4h44-0004aA-Pb for guix-patches@gnu.org; Tue, 15 Apr 2025 10:15:05 -0400 Received: from smtp-outgoing-1901.laposte.net ([160.92.124.105]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u4h41-0004UV-AT for guix-patches@gnu.org; Tue, 15 Apr 2025 10:15:04 -0400 X-mail-filterd: {"version":"1.9.1","queueID":"4ZcR4R6tCtz10MQS","contextId": "cc77c4a7-3825-441b-8f1a-834bce888b77"} Received: from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4ZcR4R6tCtz10MQS; Tue, 15 Apr 2025 16:14:47 +0200 (CEST) X-mail-filterd: {"version":"1.9.1","queueID":"4ZcR4R3pnMz10MQQ","contextId": "d5861a15-366d-4b90-ad7b-0c65d89dda42"} X-lpn-mailing: LEGIT X-lpn-spamrating: 40 X-lpn-spamlevel: not-spam Received: from localhost (91-173-200-211.subs.proxad.net [91.173.200.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0120.laposte.net (SMTP Server) with ESMTPSA id 4ZcR4R3pnMz10MQQ; Tue, 15 Apr 2025 16:14:47 +0200 (CEST) Date: Tue, 15 Apr 2025 16:13:40 +0200 Message-ID: <20250415141428.3407-1-sebastien-farge@laposte.net> X-Mailer: git-send-email 2.48.1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=laposte.net; s=lpn-wlmd; t=1744726490; bh=KFGJnLZQ850+53AAqJksma23ghy3e42vaqdSqVWYn+M=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding; b=n7fL0Mp72iydL4r6MzdtW1dCqLLEtL+PXMpt5yoAGyls2u/mbe1Nf6459Hz2IeJCP/DdbR+XeXoUfKexKEe10VurGX0D4QktPBSnRjy2HVGuuTEuoiE3+DcTdS3sNsZ/tZkGa717YdgkuauJHIvQlxyuqIJkBuvpo8CZRRILbHNgG2CMY1eZGxWr2E7sth62gVevF1d514PGlLycUy/0CIpoej/bb/MJ/HpjKTNxxT1eDzZAiF0Gn0HeiZdb52Jmk+O0UYyMZS98KKhxVJYUgRx5/ZJlZO1xM9PnhBDnTbxyHbd36G32nAI94GwMnLDsFmAqtXQYPJDUlT8ExMO54g==; Received-SPF: pass client-ip=160.92.124.105; envelope-from=sebastien-farge@laposte.net; helo=smtp-outgoing-1901.laposte.net X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: =?utf-8?q?S=C3=A9bastien?= Farge X-ACL-Warn: , =?utf-8?q?S=C3=A9bastien_Farge_via_Guix-patches?= X-Patchwork-Original-From: =?utf-8?q?S=C3=A9bastien_Farge_via_Guix-patches?= via From: =?utf-8?q?S=C3=A9bastien_Farge?= Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * gnu/home/services/gnupg.scm: New parameter. * doc/guix.texi (GNU Privacy Guard): New description. * gnu/tests/gnupg.scm: Alice use keyboxd, Bob normal keyring, test if both works Change-Id: I27b4f686086b9740943dbb5347a14ada245cc9fb --- doc/guix.texi | 5 + gnu/home/services/gnupg.scm | 18 ++- gnu/tests/gnupg.scm | 246 ++++++++++++++++++++++++++++++++++++ 3 files changed, 268 insertions(+), 1 deletion(-) create mode 100644 gnu/tests/gnupg.scm diff --git a/doc/guix.texi b/doc/guix.texi index d109877a32..46b2115aad 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -49076,6 +49076,11 @@ Whether to enable @acronym{SSH,secure shell} support. When true, @command{ssh-agent} program, taking care of OpenSSH secret keys and directing passphrase requests to the chosen Pinentry program. +@item @code{use-keyboxd?} (default: @code{#f}) (type: boolean) +Whether to enable keyboxd and its keybox database instead of usual keyring. When true, +@command{gpg-agent} call @command{keyboxd} who take care of keys management process and database. +The @file{~/.gnupg/common.conf} is created with parameter @code{use-keyboxd} for the switch to happen. + @item @code{default-cache-ttl} (default: @code{600}) (type: integer) Time a cache entry is valid, in seconds. diff --git a/gnu/home/services/gnupg.scm b/gnu/home/services/gnupg.scm index 7fc99f793a..f7691f38e0 100644 --- a/gnu/home/services/gnupg.scm +++ b/gnu/home/services/gnupg.scm @@ -31,6 +31,7 @@ (define-module (gnu home services gnupg) home-gpg-agent-configuration-gnupg home-gpg-agent-configuration-pinentry-program home-gpg-agent-configuration-ssh-support? + home-gpg-agent-configuration-use-keyboxd? home-gpg-agent-configuration-default-cache-ttl home-gpg-agent-configuration-max-cache-ttl home-gpg-agent-configuration-max-cache-ttl-ssh @@ -66,6 +67,11 @@ (define-configuration/no-serialization home-gpg-agent-configuration @command{gpg-agent} acts as a drop-in replacement for OpenSSH's @command{ssh-agent} program, taking care of OpenSSH secret keys and directing passphrase requests to the chosen Pinentry program.") + (use-keyboxd? + (boolean #f) + "Whether to enable keyboxd and its keybox database instead of usual keyring. When true, +@command{gpg-agent} call @command{keyboxd} who take care of keys management process and database. +The @file{~/.gnupg/common.conf} is created with parameter @code{use-keyboxd} for the switch to happen.") (default-cache-ttl (integer 600) "Time a cache entry is valid, in seconds.") @@ -101,6 +107,13 @@ (define (home-gpg-agent-configuration-file config) (number->string max-cache-ttl-ssh) "\n" extra-content))) +(define (home-gpg-common-configuration-file config) + "Return the @file{common.conf} file for @var{config}." + (match-record config + (use-keyboxd?) + (mixed-text-file "common.conf" "use-keyboxd\n"))) + + (define (home-gpg-agent-shepherd-services config) "Return the possibly-empty list of Shepherd services for @var{config}." (match-record config @@ -134,7 +147,10 @@ (define (home-gpg-agent-shepherd-services config) '()))) (define (home-gpg-agent-files config) - `((".gnupg/gpg-agent.conf" ,(home-gpg-agent-configuration-file config)))) + (let ((files (cons `(".gnupg/gpg-agent.conf" ,(home-gpg-agent-configuration-file config)) '()))) + (if (home-gpg-agent-configuration-use-keyboxd? config) + (cons `(".gnupg/common.conf" ,(home-gpg-common-configuration-file config)) files) + files))) (define (home-gpg-agent-environment-variables config) "Return GnuPG environment variables needed for @var{config}." diff --git a/gnu/tests/gnupg.scm b/gnu/tests/gnupg.scm new file mode 100644 index 0000000000..6be26b0073 --- /dev/null +++ b/gnu/tests/gnupg.scm @@ -0,0 +1,246 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2016-2022, 2024 Ludovic Courtès +;;; Copyright © 2017, 2018 Clément Lassieur +;;; Copyright © 2017 Marius Bakke +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (gnu tests gnupg) + #:use-module (gnu tests) + #:use-module (gnu system) + #:use-module (gnu system vm) + #:use-module (gnu services) + #:use-module (gnu services guix) + #:use-module (gnu system shadow) + #:use-module (gnu services base) + #:use-module (gnu home) + #:use-module (gnu home services gnupg) + #:use-module (gnu packages linux) + #:use-module (gnu packages gnupg) + #:use-module (gnu packages base) + #:use-module (guix gexp) + #:export (%test-gnupg-keyboxd)) + +(define %keyboxd-home + (home-environment + (packages (list gnupg procps)) + (services + (append (list + (service home-gpg-agent-service-type + (home-gpg-agent-configuration + (default-cache-ttl 820) + (use-keyboxd? #t)))) + %base-home-services)) + )) + +(define %keyring-home + (home-environment + (packages (list gnupg procps)) + (services + (append (list + (service home-gpg-agent-service-type + (home-gpg-agent-configuration + (default-cache-ttl 820)))) + %base-home-services)) + )) + +(define %gnupg-os + (operating-system + (inherit (simple-operating-system (service guix-home-service-type `(("alice" ,%keyboxd-home) + ("bob" ,%keyring-home))))) + + (users (cons* + (user-account + (name "alice") + (comment "Bob's sister") + (password (crypt "alice" "$6$abc")) + (group "users") + (supplementary-groups '("wheel" "audio" "video"))) + (user-account + (name "bob") + (comment "Alice's brother") + (password (crypt "bob" "$6$abc")) + (group "users") + (supplementary-groups '("wheel" "audio" "video"))) + %base-user-accounts)) + )) + +(define* (run-gnupg-keyboxd-test) + "Run an OS using gnupg with and without keyboxd using 'use-keyboxd'? configuration option." + (define os + (marionette-operating-system + %gnupg-os + #:imported-modules '((gnu services herd)))) + + (define vm + (virtual-machine + (operating-system os))) + + (define test + (with-imported-modules '((gnu build marionette) + (guix build syscalls)) + #~(begin + (use-modules (gnu build marionette) + (guix build syscalls) + (srfi srfi-1) + (srfi srfi-64)) + + (define marionette + (make-marionette (list #$vm))) + + (define (file-get-all-strings fname) + (marionette-eval '(use-modules (rnrs io ports)) marionette) + (wait-for-file fname marionette #:read 'get-string-all)) + + (define (vm-type cmd-or-list) + (let ((cmd-list (if (list? cmd-or-list) cmd-or-list (list cmd-or-list)))) + (for-each + (lambda (cmd) (marionette-type cmd marionette) (sleep 1)) + cmd-list))) + + (test-runner-current (system-test-runner #$output)) + (test-begin "gnupg-keyboxd") + + (test-equal "Alice is logged on tty1" + "alice\n" + (begin + (marionette-eval + '(begin + (use-modules (gnu services herd)) + (start-service 'term-tty1)) + marionette) + (vm-type (list + "alice\n" + "alice\n" + "id -un > alice.log\n")) + (file-get-all-strings "/home/alice/alice.log"))) + + (test-assert "Alice .gnupg dir is created" + (marionette-eval + `(file-exists? "/home/alice/.gnupg") + marionette)) + + (test-equal "Alice gpg-agent.conf exists and is a symlink" + 'symlink + (marionette-eval + `(and (file-exists? "/home/alice/.gnupg/gpg-agent.conf") + (stat:type (lstat "/home/alice/.gnupg/gpg-agent.conf"))) + marionette)) + + (test-equal "Alice common.conf exists and is a symlink" + 'symlink + (marionette-eval + `(and (file-exists? "/home/alice/.gnupg/common.conf") + (stat:type (lstat "/home/alice/.gnupg/common.conf"))) + marionette)) + + (test-equal "Alice common.conf has keyboxd option set" + "use-keyboxd\n" + (file-get-all-strings "/home/alice/.gnupg/common.conf")) + + (test-equal "Alice create a key that is saved in keybox format" + '("[keyboxd]" "enjoyguix") + (begin + (vm-type (list "gpg --batch --passphrase '' --quick-gen-key '' ed25519\n" + "gpg --list-keys > keybox\n")) + (let* ((output (file-get-all-strings "/home/alice/keybox")) + (keyboxd-hdr (if (string-contains output "[keyboxd]") "[keyboxd]" "fail")) + (key-id (if (string-contains output "enjoyguix") "enjoyguix" "fail"))) + (list keyboxd-hdr key-id)) + ) + ) + + (test-assert "Alice private keys are registered" + (marionette-eval + `(file-exists? "/home/alice/.gnupg/private-keys-v1.d") + marionette)) + + (test-equal "Alice has keyboxd running at home" + 0 + (marionette-eval + `(system* #$(file-append procps "/bin/pgrep") "keyboxd") + marionette)) + + ;; bob use gpg-agent + (test-equal "Bob is logged now" + "bob\n" + (begin + (vm-type + (list + "exit\n" + "bob\n" + "bob\n" + "id -un > logged-in\n")) + (file-get-all-strings "/home/bob/logged-in"))) + + (test-equal "Bob is at home" + "/home/bob\n" + (begin + (vm-type (list "printenv \"HOME\" > home.bob\n")) + (file-get-all-strings "/home/bob/home.bob") + )) + + (test-assert "Bob .gnupg dir is created" + (marionette-eval + `(file-exists? "/home/bob/.gnupg") + marionette)) + + (test-equal "Bob gpg-agent.conf exists and is a symlink" + 'symlink + (marionette-eval + `(and (file-exists? "/home/bob/.gnupg/gpg-agent.conf") + (stat:type (lstat "/home/bob/.gnupg/gpg-agent.conf"))) + marionette)) + + (test-assert "Bob common.conf doesn't exists" + (marionette-eval + `(not (file-exists? "/home/bob/.gnupg/common.conf")) + marionette)) + + (test-equal "Bob create a key that is saved in a pubring" + '("pubring" "enjoyguix") + (begin + (vm-type (list "gpg --batch --passphrase '' --quick-gen-key '' ed25519\n" + "gpg --list-keys > keybox\n")) + (let* ((output (file-get-all-strings "/home/bob/keybox")) + (agent-hdr (if (string-contains output "/home/bob/.gnupg/pubring.kbx") "pubring" (format #f "fail with ~s" output))) + (key-id (if (string-contains output "enjoyguix") "enjoyguix" (format #f "fail with ~s" output)))) + (list agent-hdr key-id)) + ) + ) + + (test-assert "Bob private keys are registered" + (marionette-eval + `(file-exists? "/home/bob/.gnupg/private-keys-v1.d") + marionette)) + + (test-equal "Bob has gpg-agent running at home" + 0 + (marionette-eval + `(system* #$(file-append procps "/bin/pgrep") "gpg-agent") + marionette)) + + (test-end)))) + + (gexp->derivation "gnupg-keyboxd" test)) + +(define %test-gnupg-keyboxd + (system-test + (name "gnupg-keyboxd") + (description "Test gnupg using keyboxd or keyring.") + (value (run-gnupg-keyboxd-test)))) + +