diff options
| author | Soispha Peetz <soispha@b-peetz.de> | 2026-11-10 16:45:50 +0100 |
|---|---|---|
| committer | Soispha Peetz <soispha@b-peetz.de> | 2026-11-10 16:50:07 +0100 |
| commit | 7835987c19f46ca91bb5ccab35aafd52124a4679 (patch) | |
| tree | 497d847f5d5cdf5a4e2a0cede78f78a9cf0b61d7 | |
| parent | modules/git: Stop signing commits by default (diff) | |
| download | nixos-config-7835987c19f46ca91bb5ccab35aafd52124a4679.zip | |
modules/gpg: Use a better pinentry program
The curses one shows up on the latest started terminal, and has serious
issues with already started stuff on there (e.g. when trying to run over
a running nvim instance). Additionally it's just insecure, as we are
using in-band messaging, so an malicious application could draw a
similar looking prompt and get me to enter my passphrase in there.
| -rw-r--r-- | modules/by-name/gp/gpg/module.nix | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/modules/by-name/gp/gpg/module.nix b/modules/by-name/gp/gpg/module.nix index 9be4cada..afe3ee1b 100644 --- a/modules/by-name/gp/gpg/module.nix +++ b/modules/by-name/gp/gpg/module.nix @@ -102,8 +102,7 @@ in { maxCacheTtlSsh = 60 * 50; pinentry = { - package = pkgs.pinentry-curses; - # package = pkgs.pinentry-tty; + package = pkgs.pinentry-qt; }; enableSshSupport = true; |