goldwarden: init at 0.2.7

[arthsmn]

Description of changes

Homepage: https://github.com/quexten/goldwarden
Closes: #278180

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[arthsmn]

@quexten I looked at the aur package and it only seems to install a binary and a polkit rule, that's what is being done here. Are there any other steps needed in the package?

[quexten]

If selinux is present (does nix have it?), the polkit rule's permissions need to be adjusted as well. Other than that no, it's just installing the binary.

Do beware that you do need at least dbus, and a pinentry client (https://pkg.go.dev/github.com/twpayne/go-pinentry#section-readme) are required to use the package. I'm not sure if these are present on a default nixos installation.

[quexten]

Oh, since I do see darwin listed above, I will note that while packages are built for darwin in the project's GitHub CI at the moment, they are very much untested and some features are missing. I'm not sure they should be released for darwin just yet until more testing has been done there. quexten/goldwarden#4

[arthsmn]

Oh, since I do see darwin listed above, I will note that while packages are built for darwin in the project's GitHub CI at the moment, they are very much untested and some features are missing. I'm not sure they should be released for darwin just yet until more testing has been done there. quexten/goldwarden#4

Understood, I'll mark it as linux-only and link the issue.

[arthsmn]

If selinux is present (does nix have it?), the polkit rule's permissions need to be adjusted as well. Other than that no, it's just installing the binary.

Do beware that you do need at least dbus, and a pinentry client (https://pkg.go.dev/github.com/twpayne/go-pinentry#section-readme) are required to use the package. I'm not sure if these are present on a default nixos installation.

No, we currently don't support SELinux.

I added the packages to the binary's path, so they'll always be there.

[symphorien]

I think the required system services should be directly be installed in the package or setup by a NixOS module. The imperative setup commands don't fit NixOS very well.

[arthsmn]

I think the required system services should be directly be installed in the package or setup by a NixOS module. The imperative setup commands don't fit NixOS very well.

I couldn't find the required file, so I think it is generated at runtime. @quexten what do you think? Do you have plans to have a preset file so we can copy from? Do you want to have a hardcoded file or let upstream handle the service? Keep in mind that it would be desirable to have a service in NixOS in case your app gets options to be enabled etc.

[quexten]

For the other packaging formats I have the upstream issue quexten/goldwarden#12, which I have not been able to deal with just yet. For now, the service file is a hard-coded string https://github.com/quexten/goldwarden/blob/e15cee5aa92749b395960498dd069b8794025e68/cmd/setup_linux.go#L69-L77, but if it helps you, I can make this a dedicated file upstream that you can just use. This is installed as a user-service.

[arthsmn]

For the other packaging formats I have the upstream issue quexten/goldwarden#12, which I have not been able to deal with just yet. For now, the service file is a hard-coded string https://github.com/quexten/goldwarden/blob/e15cee5aa92749b395960498dd069b8794025e68/cmd/setup_linux.go#L69-L77, but if it helps you, I can make this a dedicated file upstream that you can just use. This is installed as a user-service.

This would be awesome! Thanks!

[nomeata]

I gave this a try, but it would never show a pinentry for me, even after I added pinentry-gtk2 to the system packages. (Maybe I should have restarted or at least re-logged-in?)

But somehow the journal log says

Mär 25 21:21:11 riviera .goldwarden-wrapped[2553526]: [INF] [21:21] [Goldwarden > Pinentry] >>> Asking for pin |Unlock Goldwarden|Enter the vault PIN|

without any indication that it couldn’t fin a pinenry or so?

Maybe the package should have a suitable pinentry as a runtime dependency so that it will work for everyone? Not sure.

[quexten]

Probably a good idea. Upstream has a GTK based custom pinentry fallback for the UI, which is currently only available as a Flatpak, but @SuperSandro2000 is looking into packaging the full UI version without flatpak for nix which would also have this fallback: #293117

[nomeata]

Yeah, just found that PR and saw it installs config.programs.gnupg.agent.pinentryPackage. I guess I will wait for that PR.