Repository navigation
Stale references to nix + other issues #498
Description
Activity
- changed the title
[-]Stale references to nix[/-][+]Stale references to nix + other issues[/+]on May 5, 2025 Noticed the
help wantedtag just light up and wanted to throw an idea out there.I've recently had a lot of success establishing offline keys using Alpine Linux on ARM. Offline package management (apk) ultimately made it very efficient to bootstrap the minimal tooling needed to manage smart cards as well.
Everything fits into a nice 80 MB partition for rapid cloning purposes, and the base system is even ephemeral. Happy to share my notes if this would be of interest. Personally, I could see contributing this as a solution in part (or whole) to #495.
Let me know!
CC: @drduh
(Even more fun would be to come up with a CI build system for building the custom Alpine image that comes pre-shipped with these packages installed :D)
@mattborja that sounds like an excellent idea; I would very much like to try it out. can you please create a new issue to track this under the upcoming spring refresh milestone? it could fit nicely with the simplified guide idea.
@niklash3 thank you for raising the issue. unfortunately I am not a nix user and would appreciate your help addressing the obvious problems.
Reacted by Matt BorjaTransfer subkeys just doesn't work (gpg: KEYTOCARD failed: Invalid time error). What solved was to run the interactive command manually without --pinentry-mode=loopback
+1 for this.
A hint in the guide would be helpful.
@aMOPel looks like it's fixed in GPG 2.5.1. I haven't tested it but the bug report references the same reddit link https://dev.gnupg.org/T7283
Edit: which isn't that practically useful right now because the 2.5 series is for public testing, not a stable release - https://lists.gnu.org/archive/html/info-gnu/2024-09/msg00005.html However, it's good to know the future 2.6 release should fix the issue.
Reacted by aMOPel@aMOPel looks like it's fixed in GPG 2.5.1. I haven't tested it but the bug report references the same reddit link https://dev.gnupg.org/T7283
Edit: which isn't that practically useful right now because the 2.5 series is for public testing, not a stable release - https://lists.gnu.org/archive/html/info-gnu/2024-09/msg00005.html However, it's good to know the future 2.6 release should fix the issue.
The GPG ticket seems to indicate the required fix has been backported to GPG 2.2 and 2.4:
rG95468f531c3b: STABLE-BRANCH-2-2, bugfixes-2.2rG5a1bf7e5524e: STABLE-BRANCH-2-4rG4a4c1efac59f: master
Perhaps the Nix flake can be updated to pull in the required bug-fix when live-CD image is built. I will investigate this to see how this is done.
Hey this line here doesn't work
Line 244 in 6f6706d
We need to make it
install --verbose -m=0700 --directory "$GNUPGHOME"
Here are a couple of issues with the nix component of this guide:
Build an air-gapped NixOS LiveCD imagepart of the guide no longer works after movingflake.nixtonixsubdirectory. Similar issue with the other commands. Adding?dir=nixargument to the flake url should solve the problem.drduhConfigwhich was removed from the flake inputs.And other issues noticed while following it:
sudo mkdir /mnt/encrypted-storagedoes not work on NixOS as/mntis not created by default.gpg-agentneeds to be stopped before usingykman openpgpcommands.gpg: KEYTOCARD failed: Invalid timeerror). What solved was to run the interactive command manually without--pinentry-mode=loopbacksaveafterkeytocardmakes it annoying to transfer the keys to multiple yubikeys, as they are removed from gnupg. I had to delete all secret keys form my gnupg and re-import the backups.It seems to me like the live NixOS image support is slowly being faded out. Is there a particular reason for this?
Anyways, this was a great guide, thank you to all who contributed to it!