yubikey-agent: init at 0.1.3

This adds yubikey-agent as a package and a nixos module.

On macOS, we use `wrapProgram` to set pinentry_mac as default in PATH;
on Linux we rely on the user to set their preferred pinentry in PATH.
In particular, we use a systemd override to prefix PATH to select a
chosen pinentry program if specified.

On Linux, we need libnotify to provide the notify-send utility for
desktop notifications (such as "Waiting for Yubikey touch...").

This might work on other flavors of unix, but I haven't tested.

We reuse the programs.gnupg.agent.pinentryFlavor option for
yubikey-agent, but in doing so I hit a problem: pinentryFlavour's
default value is specified in a mkDefault, but only conditionally.  We
ought to be able to pick up the pinentryFlavour whether or not gpg-agent
is running.  As a result, this commit moves the default value to the
definition of programs.gnupg.agent.enable.

3 files changed, 113 insertions, 0 deletions

diff --git a/pkgs/tools/security/yubikey-agent/default.nix b/pkgs/tools/security/yubikey-agent/default.nix
new file mode 100644
index 0000000000000..c3b2329d472dc
--- /dev/null
+++ b/pkgs/tools/security/yubikey-agent/default.nix
@@ -0,0 +1,54 @@
+{ stdenv, lib, fetchFromGitHub, buildGoModule, libnotify, makeWrapper, pcsclite, pinentry_mac, pkgconfig, darwin }:
+
+buildGoModule rec {
+  pname = "yubikey-agent";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "FiloSottile";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "07gix5wrakn4z846zhvl66lzwx58djrfnn6m8v7vc69l9jr3kihr";
+  };
+
+  buildInputs =
+    lib.optional stdenv.isLinux (lib.getDev pcsclite)
+    ++ lib.optional stdenv.isDarwin (darwin.apple_sdk.frameworks.PCSC);
+
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
+
+  # pull in go-piv/piv-go#75
+  # once go-piv/piv-go#75 is merged and released, we should
+  # use the released version (and push upstream to do the same)
+  patches = [ ./use-piv-go-75.patch ];
+  postPatch = lib.optionalString stdenv.isLinux ''
+    substituteInPlace main.go --replace 'notify-send' ${libnotify}/bin/notify-send
+  '';
+
+  vendorSha256 = "1x7934p6522i0yyv08xzb4134d0kr5x6igsrp26vh79d8fndbywr";
+
+  subPackages = [ "." ];
+
+  # On macOS, there isn't a choice of pinentry program, so let's
+  # ensure the nixpkgs-provided one is available
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    wrapProgram $out/bin/yubikey-agent --suffix PATH : $(dirname ${pinentry_mac}/${pinentry_mac.binaryPath})
+  ''
+  # Note: in the next release, upstream provides
+  # contrib/systemd/user/yubikey-agent.service, which we should use
+  # instead
+  # See https://github.com/FiloSottile/yubikey-agent/pull/43
+  + lib.optionalString stdenv.isLinux ''
+    mkdir -p $out/lib/systemd/user
+    substitute ${./yubikey-agent.service} $out/lib/systemd/user/yubikey-agent.service \
+      --replace 'ExecStart=yubikey-agent' "ExecStart=$out/bin/yubikey-agent"
+  '';
+
+  meta = with lib; {
+    description = "A seamless ssh-agent for YubiKeys";
+    license = licenses.bsd3;
+    homepage = "https://filippo.io/yubikey-agent";
+    maintainers = with lib.maintainers; [ philandstuff rawkode ];
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/yubikey-agent/use-piv-go-75.patch b/pkgs/tools/security/yubikey-agent/use-piv-go-75.patch
new file mode 100644
index 0000000000000..cd7337292229b
--- /dev/null
+++ b/pkgs/tools/security/yubikey-agent/use-piv-go-75.patch
@@ -0,0 +1,24 @@
+From 56a465d463273b2a2a24cf668c4c33938b198b16 Mon Sep 17 00:00:00 2001
+From: Philip Potter <philip.g.potter@gmail.com>
+Date: Sun, 12 Jul 2020 16:54:57 +0100
+Subject: [PATCH] Pull in go-piv/piv-go#75
+
+---
+ go.mod | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/go.mod b/go.mod
+index d4d13c8..e24d53d 100644
+--- a/go.mod
++++ b/go.mod
+@@ -2,6 +2,7 @@ module filippo.io/yubikey-agent
+ 
+ go 1.14
+ 
++replace github.com/go-piv/piv-go => github.com/rawkode/piv-go v1.5.1-0.20200711221619-a4158f9b8204
+ require (
+ 	github.com/go-piv/piv-go v1.5.1-0.20200523071327-a3e5767e8b72
+ 	github.com/gopasspw/gopass v1.9.1
+-- 
+2.27.0
+
diff --git a/pkgs/tools/security/yubikey-agent/yubikey-agent.service b/pkgs/tools/security/yubikey-agent/yubikey-agent.service
new file mode 100644
index 0000000000000..7a91f902544ec
--- /dev/null
+++ b/pkgs/tools/security/yubikey-agent/yubikey-agent.service
@@ -0,0 +1,35 @@
+[Unit]
+Description=Seamless ssh-agent for YubiKeys
+Documentation=https://filippo.io/yubikey-agent
+
+[Service]
+ExecStart=yubikey-agent -l %t/yubikey-agent/yubikey-agent.sock
+ExecReload=/bin/kill -HUP $MAINPID
+ProtectSystem=strict
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateUsers=yes
+IPAddressDeny=any
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+CapabilityBoundingSet=
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+SystemCallErrorNumber=EPERM
+SystemCallArchitectures=native
+NoNewPrivileges=yes
+KeyringMode=private
+UMask=0177
+RuntimeDirectory=yubikey-agent
+
+[Install]
+WantedBy=default.target