1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
import ./make-test-python.nix ({ pkgs, lib, ...}:
{
name = "gnupg";
meta = with lib.maintainers; {
maintainers = [ rnhmjoj ];
};
# server for testing SSH
nodes.server = { ... }: {
imports = [ ../modules/profiles/minimal.nix ];
users.users.alice.isNormalUser = true;
services.openssh.enable = true;
};
# machine for testing GnuPG
nodes.machine = { pkgs, ... }: {
imports = [ ../modules/profiles/minimal.nix ];
users.users.alice.isNormalUser = true;
services.getty.autologinUser = "alice";
environment.shellInit = ''
# preset a key passphrase in gpg-agent
preset_key() {
# find all keys
case "$1" in
ssh) grips=$(awk '/^[0-9A-F]/{print $1}' "''${GNUPGHOME:-$HOME/.gnupg}/sshcontrol") ;;
pgp) grips=$(gpg --with-keygrip --list-secret-keys | awk '/Keygrip/{print $3}') ;;
esac
# try to preset the passphrase for each key found
for grip in $grips; do
"$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase" -c -P "$2" "$grip"
done
}
'';
programs.gnupg.agent.enable = true;
programs.gnupg.agent.enableSSHSupport = true;
};
testScript =
''
import shlex
def as_alice(command: str) -> str:
"""
Wraps a command to run it as Alice in a login shell
"""
quoted = shlex.quote(command)
return "su --login alice --command " + quoted
start_all()
with subtest("Wait for the autologin"):
machine.wait_until_tty_matches("1", "alice@machine")
with subtest("Can generate a PGP key"):
# Note: this needs a tty because of pinentry
machine.send_chars("gpg --gen-key\n")
machine.wait_until_tty_matches("1", "Real name:")
machine.send_chars("Alice\n")
machine.wait_until_tty_matches("1", "Email address:")
machine.send_chars("alice@machine\n")
machine.wait_until_tty_matches("1", "Change")
machine.send_chars("O\n")
machine.wait_until_tty_matches("1", "Please enter")
machine.send_chars("pgp_p4ssphrase\n")
machine.wait_until_tty_matches("1", "Please re-enter")
machine.send_chars("pgp_p4ssphrase\n")
machine.wait_until_tty_matches("1", "public and secret key created")
with subtest("Confirm the key is in the keyring"):
machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
with subtest("Can generate and add an SSH key"):
machine.succeed(as_alice("ssh-keygen -t ed25519 -f alice -N ssh_p4ssphrase"))
# Note: apparently this must be run before using the OpenSSH agent
# socket for the first time in a tty. It's not needed for `ssh`
# because there's a hook that calls it automatically (only in NixOS).
machine.send_chars("gpg-connect-agent updatestartuptty /bye\n")
# Note: again, this needs a tty because of pinentry
machine.send_chars("ssh-add alice\n")
machine.wait_until_tty_matches("1", "Enter passphrase")
machine.send_chars("ssh_p4ssphrase\n")
machine.wait_until_tty_matches("1", "Please enter")
machine.send_chars("ssh_agent_p4ssphrase\n")
machine.wait_until_tty_matches("1", "Please re-enter")
machine.send_chars("ssh_agent_p4ssphrase\n")
with subtest("Confirm the SSH key has been registered"):
machine.wait_until_succeeds(as_alice("ssh-add -l | grep -q alice@machine"))
with subtest("Can preset the key passphrases in the agent"):
machine.succeed(as_alice("echo allow-preset-passphrase > .gnupg/gpg-agent.conf"))
machine.succeed(as_alice("pkill gpg-agent"))
machine.succeed(as_alice("preset_key pgp pgp_p4ssphrase"))
machine.succeed(as_alice("preset_key ssh ssh_agent_p4ssphrase"))
with subtest("Can encrypt and decrypt a message"):
machine.succeed(as_alice("echo Hello | gpg -e -r alice | gpg -d | grep -q Hello"))
with subtest("Can log into the server"):
# Install Alice's public key
public_key = machine.succeed(as_alice("cat alice.pub"))
server.succeed("mkdir /etc/ssh/authorized_keys.d")
server.succeed(f"printf '{public_key}' > /etc/ssh/authorized_keys.d/alice")
server.wait_for_open_port(22)
machine.succeed(as_alice("ssh -i alice -o StrictHostKeyChecking=no server exit"))
'';
})
|