guix_mirror_bot pushed a commit to branch master
in repository guix.
commit d5a73f4734f21ac15b9ade3ec71162f00ae746c4
Author: Nox <[email protected]>
AuthorDate: Wed Jul 1 14:23:41 2026 +0200
home: services: Add GnuPG home directory configuration.
* gnu/home/services/gnupg.scm (home-gpg-agent-configuration)
[home]: New field.
(home-gpg-agent-files): Use it.
(gpg-agent-activation): Use it (edited into a procedure).
(home-gpg-agent-service-type): Use it.
(sanitize-home): New procedure.
* doc/guix.texi: Update it.
Signed-off-by: Ludovic Courtès <[email protected]>
Merges: #9655
---
doc/guix.texi | 8 ++++++--
gnu/home/services/gnupg.scm | 32 ++++++++++++++++++++------------
2 files changed, 26 insertions(+), 14 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index 19be19c6d2..b30237e21c 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -54909,6 +54909,10 @@ Pinentry program to use. Pinentry is a small user
interface that
passphrase or @acronym{PIN,personal identification number}
(@pxref{Top,,, pinentry,Using the PIN-Entry}).
+@item @code{home} (default: @code{"~/.gnupg"}) (type: string)
+The GnuPG home directory, relative to @var{$HOME}. Defaults to
+@file{~/.gnupg}.
+
@item @code{ssh-support?} (default: @code{#f}) (type: boolean)
Whether to enable @acronym{SSH,secure shell} support. When true,
@command{gpg-agent} acts as a drop-in replacement for OpenSSH's
@@ -54929,9 +54933,9 @@ Time a cache entry for SSH keys is valid, in seconds.
Maximum time a cache entry for SSH keys is valid, in seconds.
@item @code{extra-content} (default: @code{""}) (type:
raw-configuration-string)
-Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}.
+Raw content to add to the end of @file{gpg-agent.conf}.
-@item @code{shepherd-requirement} (default: @code{'()}) (type: list-of-symbols)
+@item @code{shepherd-requirement} (default: @code{()}) (type: list-of-symbols)
List of services that should be started before this service.
@end table
diff --git a/gnu/home/services/gnupg.scm b/gnu/home/services/gnupg.scm
index bbc8349226..38fa58e2fa 100644
--- a/gnu/home/services/gnupg.scm
+++ b/gnu/home/services/gnupg.scm
@@ -30,6 +30,7 @@
home-gpg-agent-configuration?
home-gpg-agent-configuration-gnupg
home-gpg-agent-configuration-pinentry-program
+ home-gpg-agent-configuration-home
home-gpg-agent-configuration-ssh-support?
home-gpg-agent-configuration-default-cache-ttl
home-gpg-agent-configuration-max-cache-ttl
@@ -60,6 +61,9 @@
@command{gpg-agent} delegates to anytime it needs user input for a passphrase
or @acronym{PIN, personal identification number} (@pxref{Top,,, pinentry,
Using the PIN-Entry}).")
+ (home
+ (string ".gnupg")
+ "The GnuPG home directory, relative to @var{$HOME}. Defaults to
@file{.gnupg}.")
(ssh-support?
(boolean #f)
"Whether to enable @acronym{SSH, secure shell} support. When true,
@@ -81,7 +85,7 @@ entry will be expired even if it has been accessed recently.")
"Maximum time a cache entry for SSH keys is valid, in seconds.")
(extra-content
(raw-configuration-string "")
- "Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}.")
+ "Raw content to add to the end of @file{gpg-agent.conf}.")
(shepherd-requirement
(list-of-symbols '())
"List of services that should be started before this service."))
@@ -147,25 +151,29 @@ agent, with support for handling OpenSSH material."))))
'())))
(define (home-gpg-agent-files config)
- `((".gnupg/gpg-agent.conf" ,(home-gpg-agent-configuration-file config))))
+ `((,(in-vicinity
+ (home-gpg-agent-configuration-home config) "gpg-agent.conf")
+ ,(home-gpg-agent-configuration-file config))))
(define (home-gpg-agent-environment-variables config)
"Return GnuPG environment variables needed for @var{config}."
- (if (home-gpg-agent-configuration-ssh-support? config)
- `(("SSH_AUTH_SOCK"
- . "$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh"))
- '()))
+ (let ((home (getenv "HOME"))
+ (gnupghome (home-gpg-agent-configuration-home config)))
+ `(,@(if (home-gpg-agent-configuration-ssh-support? config)
+ '(("SSH_AUTH_SOCK" . "$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh"))
+ '())
+ ("GNUPGHOME" . ,(in-vicinity home gnupghome)))))
-(define gpg-agent-activation
+(define (gpg-agent-activation config)
(with-imported-modules (source-module-closure
'((gnu build activation)))
#~(begin
(use-modules (gnu build activation))
- ;; Make sure ~/.gnupg is #o700.
- (let* ((home (getenv "HOME"))
- (dot-ssh (string-append home "/.gnupg")))
- (mkdir-p/perms dot-ssh (getpw (getuid)) #o700)))))
+ ;; Make sure GnuPG home is #o700.
+ (let ((home (getenv "HOME"))
+ (gnupghome #$(home-gpg-agent-configuration-home config)))
+ (mkdir-p/perms (in-vicinity home gnupghome) (getpw (getuid))
#o700)))))
(define home-gpg-agent-service-type
(service-type
@@ -176,7 +184,7 @@ agent, with support for handling OpenSSH material."))))
(service-extension home-shepherd-service-type
home-gpg-agent-shepherd-services)
(service-extension home-activation-service-type
- (const gpg-agent-activation))
+ gpg-agent-activation)
(service-extension home-environment-variables-service-type
home-gpg-agent-environment-variables)))
(default-value (home-gpg-agent-configuration))
