https://github.com/olebedev/pinentry-mac-keychain
A pinentry program for macOs that stores entered PINs in the macOS KeyChain. Convenient when use with smart cards, like Yubikey
https://github.com/olebedev/pinentry-mac-keychain
gpg keychain pinentry yubikey
Last synced: 11 months ago
JSON representation
A pinentry program for macOs that stores entered PINs in the macOS KeyChain. Convenient when use with smart cards, like Yubikey
- Host: GitHub
- URL: https://github.com/olebedev/pinentry-mac-keychain
- Owner: olebedev
- Created: 2023-01-29T20:09:04.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2023-02-10T09:33:17.000Z (over 3 years ago)
- Last Synced: 2024-10-28T01:25:57.935Z (over 1 year ago)
- Topics: gpg, keychain, pinentry, yubikey
- Language: Go
- Homepage:
- Size: 9.77 KB
- Stars: 3
- Watchers: 3
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# pinentry-mac-keychain
Custom GPG pinentry program for macOS that fetching the password from the macOS keychain. _WARNING: Use it on your own risk._
### How does it work
The `pinentry-mac-keychain` acts like a proxy between the `gpg-agent` and the original `pinentry-mac`
executable in order to hijack requests for PIN and pull the PIN from the users keychain instead of
poping up the `pinentry-mac` UI each time. This is useful if you can be sure no one will attempt
to use your macOs machine to perform malicuous actions while you away but your Smart Card, like Yubikey,
is plugged in. Otherwise it will be a significant security risk.
The program proxies only the requests that can be recongnised as the requirests for the PIN, coming from the GnuPG toolset (see the RegExp that detects that in [`./utils.go#L13`](./utils.go#L13)) and doesn't proxies any other requirests, like `MESSAGE` and `CONFIRM`.
### Install
Installation is being performed via Nix package manager. So you'd need to have it installed first.
Once Nix is installed with Flakes support, you can install `pinentry-mac-keychain` via:
```
$ nix profile install github:olebedev/pinentry-mac-keychain
```
Otherwise, if your Nix installation doesn't support Flakes you can install it via:
```
$ nix-env -i -f https://github.com/olebedev/pinentry-mac-keychain/archive/main.tar.gz
```
After that, make sure you added the following line
```
pinentry-program /Users//.nix-profile/bin/pinentry-mac-keychain
```
to your `~/.gnupg/gpg-agent.conf` file and restarted GPG agent via:
```
$ gpgconf --kill all
```
### Build from source
```
$ go install .
```
### Debug
It can be built so it writes down logs into a file:
```
$ go install -ldflags "-X main.logfile=$HOME/pinentry.log"
```
### TODO:
- [ ] setup github actions