fix(security/ssh): fixed the loading ssh key from gopass

Now on every home-manager switch we run a script that loads the key form
gopass to gpg-agent, then the gpg-agent is responsible for storing it.
Anytime gopass changes the ssh key we must run home-manager switch to
load the ssh key into gpg agent.

1 files changed, 0 insertions, 71 deletions

diff --git a/modules/security/gopass/gopass-ssh-load.sh b/modules/security/gopass/gopass-ssh-load.sh
deleted file mode 100644
index 8c1b11f..0000000
--- a/modules/security/gopass/gopass-ssh-load.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-
-# gopass-ssh-load
-#
-# Load SSH keys into the SSH agent from the gopass password store.
-#
-# This script reads private keys and (optionally) their passphrases from gopass
-# entries under the `ssh/` directory and adds them to the SSH agent served by
-# gpg-agent. It is meant to be run manually whenever a key is imported into or
-# rotated within the gopass store, so the SSH agent picks up the change.
-#
-# Behaviour:
-#   * It first verifies that a usable SSH agent socket exists and bails out if
-#     not.
-#   * It exits early (without doing anything) when the agent already has at
-#     least one Ed25519/RSA/ECDSA identity loaded, to avoid useless work and
-#     unnecessary gpg passphrase prompts.
-#   * For each key listed in GOPASS_SSH_KEYS it writes the corresponding
-#     `ssh/<key>` entry to a temporary file, strips the passphrase using the
-#     `ssh/<key>/passphrase` entry, and registers the key with `ssh-add`.
-#
-# Temporary key files are written with mode 600 and removed afterwards.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-export GNUPGHOME="@@GNUPGHOME@@"
-export GOPASS_SSH_KEYS="@@GOPASS_SSH_KEYS@@"
-
-info()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
-warn()  { printf '\033[1;33m==> warning:\033[0m %s\n' "$*" >&2; }
-error() { printf '\033[1;31m==> error:\033[0m %s\n' "$*" >&2; }
-die()   { error "$*"; exit 1; }
-
-SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
-export SSH_AUTH_SOCK
-if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
-  die "SSH_AUTH_SOCK is not set or valid."
-fi
-
-if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
-  exit 0
-fi
-
-# GOPASS_SSH_KEYS holds a space-separated list of gopass entry names under ssh
-if [ -z "${GOPASS_SSH_KEYS:-}" ]; then
-  die "GOPASS_SSH_KEYS is not set. Example: GOPASS_SSH_KEYS=\"github gitlab\""
-fi
-
-# shellcheck disable=SC2086
-read -r -a keys <<< "$GOPASS_SSH_KEYS"
-
-for key in "${keys[@]}"; do
-  if gopass cat "ssh/$key" > /dev/null 2>&1; then
-    tmpdir=$(mktemp -d)
-    keyfile="$tmpdir/key"
-    gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
-    chmod 600 "$keyfile"
-
-    passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null || true)
-    if [ -n "$passphrase" ]; then
-      ssh-keygen -p -P "$passphrase" -N "" -f "$keyfile" 2>/dev/null
-    fi
-
-    ssh-add "$keyfile" 2>/dev/null
-    rm -rf "$tmpdir"
-  else
-    warn "no gopass entry ssh/$key"
-  fi
-done