about summary refs log tree commit diff
path: root/ops/modules
diff options
context:
space:
mode:
authorFlorian Klink <flokli@flokli.de>2022-05-07T19·02+0200
committerflokli <flokli@flokli.de>2022-05-07T21·29+0000
commit84c62eb68b16af02a84f310e7b3bc05e6794aaf7 (patch)
tree70f8393b0f719dbfcf01b34154e113ecc8624ebb /ops/modules
parent9e68eecb37bbec0f4acdac02479a7e88be05c88d (diff)
feat(ops/modules/open_eid.nix): use p11-kit-proxy r/4016
… instead of onepin-opensc-pkcs11.

This acts as a glue to multiple PKCS#11 modules, and reads configuration
files from /etc/pkcs11/modules.

p11-kit is also used to propagate the system trust store to NSS:
https://p11-glue.github.io/p11-glue/sharing-trust-policy.html

See-Also: https://p11-glue.github.io/p11-glue/p11-kit.html
Change-Id: I135c3a80a4eea0bd06f6b00089dc197c82476746
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5533
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
Diffstat (limited to 'ops/modules')
-rw-r--r--ops/modules/open_eid.nix18
1 files changed, 11 insertions, 7 deletions
diff --git a/ops/modules/open_eid.nix b/ops/modules/open_eid.nix
index e3e686f3f62d..b073790d5c12 100644
--- a/ops/modules/open_eid.nix
+++ b/ops/modules/open_eid.nix
@@ -2,25 +2,29 @@
 { pkgs, ... }:
 
 let
-  # Wrapper script to add EID support to browsers. Each user needs to
-  # run this themselves, it does not work on a system level due to a
-  # bug in Chromium:
+  # Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
+  # security devices.
+  # Each user needs to run this themselves, it does not work on a system level
+  # due to a bug in Chromium:
   #
   # https://bugs.chromium.org/p/chromium/issues/detail?id=16387
   #
-  # This is based on the upstream setup script for Debian-derivatives:
-  # https://github.com/open-eid/linux-installer/blob/master/esteid-update-nssdb
   setup-browser-eid = pkgs.writeShellScriptBin "setup-browser-eid" ''
     NSSDB="''${HOME}/.pki/nssdb"
     mkdir -p ''${NSSDB}
 
-    ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add opensc-pkcs11 \
-      -libfile ${pkgs.opensc}/lib/onepin-opensc-pkcs11.so -mechanisms FRIENDLY
+    ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
+      -libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
   '';
 in
 {
   services.pcscd.enable = true;
 
+  # Tell p11-kit to load onepin-opensc-pkcs11.so
+  environment.etc."pkcs11/modules/onepin-opensc-pkcs11".text = ''
+    module: ${pkgs.opensc}/lib/onepin-opensc-pkcs11.so
+  '';
+
   environment.systemPackages = with pkgs; [
     qdigidoc
     setup-browser-eid