daniil-berg/nixos-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(desktop): don't prompt on ssh presence/confirm askpass calls

Browse Source 
Forced askpass routes the "Confirm user presence" touch notifications
(SSH_ASKPASS_PROMPT=none) through the helper too, which blindly asked for a
PIN — three dialogs per push. Only prompt for the real passphrase; let the
informational calls succeed silently (the FIDO touch is hardware-enforced).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Daniel Fainberg
2026-07-07 08:54:48 +02:00
parent 2cba23b804
commit d43381727d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/home.nix
+6
View File
@@ -13,7 +13,13 @@ let
# SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN # SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN
# prompts reuse the same Qt dialog as commit signing, adding no extra GUI # prompts reuse the same Qt dialog as commit signing, adding no extra GUI
# toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB). # toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB).
# ssh signals the prompt kind via $SSH_ASKPASS_PROMPT (OpenSSH ≥ 8.4):
# empty real passphrase/PIN entry — collect input, echo to stdout
# confirm/none informational, e.g. "Confirm user presence" (touch request)
# A FIDO touch can't be faked by software, so those messages need no dialog:
# succeed silently instead of popping a spurious PIN box (the token blinks).
sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" '' sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" ''
[ -n "''${SSH_ASKPASS_PROMPT:-}" ] && exit 0
desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g') desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g')
printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \ printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \
| ${pkgs.pinentry-qt}/bin/pinentry-qt \ | ${pkgs.pinentry-qt}/bin/pinentry-qt \