pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-07-17 06:25:16 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

gnupg: add package option to allow custom gnupg versions

Browse source 
Add sops.gnupg.package option to NixOS, home-manager, and nix-darwin
modules, allowing users to specify a custom gnupg package instead of
the default pkgs.gnupg.

This enables use of bleeding-edge GPG versions with post-quantum
encryption algorithms like Kyber, addressing "store now, decrypt
later" threat models.
This commit is contained in:
Fabrizio Romano Genovese 2025-12-16 14:40:39 +01:00 • committed by Jörg Thalheim
parent 57e2d9ef84
commit 39c667d73c
3 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
modules/home-manager/sops.nix
View file

@ -269,6 +269,15 @@ in
}; };
gnupg = { gnupg = {
package = lib.mkOption {
type = lib.types.package;
default = pkgs.gnupg;
defaultText = lib.literalExpression "pkgs.gnupg";
description = ''
The gnupg package to use for sops operations.
'';
};
home = lib.mkOption { home = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = null; default = null;
@ -341,7 +350,7 @@ in
sops.environment = { sops.environment = {
SOPS_GPG_EXEC = lib.mkMerge [ SOPS_GPG_EXEC = lib.mkMerge [
(lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) ( (lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) (
lib.mkDefault "${pkgs.gnupg}/bin/gpg" lib.mkDefault "${cfg.gnupg.package}/bin/gpg"
)) ))
(lib.mkIf cfg.gnupg.qubes-split-gpg.enable ( (lib.mkIf cfg.gnupg.qubes-split-gpg.enable (
lib.mkDefault config.home.sessionVariables.SOPS_GPG_EXEC lib.mkDefault config.home.sessionVariables.SOPS_GPG_EXEC

11
modules/nix-darwin/default.nix
View file

@ -320,6 +320,15 @@ in
''; '';
}; };
package = lib.mkOption {
type = lib.types.package;
default = pkgs.gnupg;
defaultText = lib.literalExpression "pkgs.gnupg";
description = ''
The gnupg package to use for sops operations.
'';
};
sshKeyPaths = lib.mkOption { sshKeyPaths = lib.mkOption {
type = lib.types.listOf lib.types.path; type = lib.types.listOf lib.types.path;
default = defaultImportKeys "rsa"; default = defaultImportKeys "rsa";
@ -384,7 +393,7 @@ in
{ {
sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) ( sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) (
lib.mkDefault "${pkgs.gnupg}/bin/gpg" lib.mkDefault "${cfg.gnupg.package}/bin/gpg"
); );
} }
]; ];

12
modules/sops/default.nix
View file

@ -381,6 +381,16 @@ in
This option must be explicitly unset if <literal>config.sops.gnupg.home</literal> is set. This option must be explicitly unset if <literal>config.sops.gnupg.home</literal> is set.
''; '';
}; };
package = lib.mkOption {
type = lib.types.package;
default = pkgs.gnupg;
defaultText = lib.literalExpression "pkgs.gnupg";
description = ''
The gnupg package to use for sops operations.
'';
};
}; };
}; };
imports = [ imports = [
@ -442,7 +452,7 @@ in
); );
sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) ( sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) (
lib.mkDefault "${pkgs.gnupg}/bin/gpg" lib.mkDefault "${cfg.gnupg.package}/bin/gpg"
); );
# When using sysusers we no longer are started as an activation script because those are started in initrd while sysusers is started later. # When using sysusers we no longer are started as an activation script because those are started in initrd while sysusers is started later.