[PATCH v2] services: greetd: Add pam-gnupg support.

> I retry to implement the pam-gnupg module for the greetd system service. It is A PAM module that hands over your login password to gpg-agent. I added de documentation and the insert-before procedure (maybe it needs a better name), to ensure that the pam-gnupg module will be loaded at the end.

>

> * doc/guix.texi: documentation about #:gnupg? option on (greetd-configuration).

> * gnu/services.scm (insert-before): new procedure.

> * gnu/services/base.scm (greetd-configuration): new option #:gnupg?.

> * gnu/services/pam-mount.scm: ensure that pam mount module goes before pam gnupg module.

> * gnu/system/pam.scm (pam-gnupg-module?): new procedure and ensure that pam gnupg module is at the end of (unix-pam-service).

> +@item @code{gnupg?} (default: @code{#f})

> +If enabled, @code{pam-gnupg} will attempt to automatically unlock the

> +user's GPG keys with the login password via @code{gpg-agent}. The

> +keygrips of all keys to be unlocked should be written to

> +@file{~/.pam-gnupg}, and can be queried with @code{gpg -K

> +--with-keygrip}. Presetting passphrases must be enabled by adding

> +@code{allow-preset-passphrase} in @file{~/.gnupg/gpg-agent.conf}.

> +(define (insert-before pred lst1 lst2)

> + "Return a list appending LST2 just before the first element on LST1 that

> + satisfy the predicate PRED."

> + (cond

> + ((null? lst1) lst2)

> + ((pred (car lst1)) (append lst2 lst1))

> + (else (cons (car lst1) (insert-before pred (cdr lst1) lst2)))))

> (pam-service

> (inherit pam)

> - (auth (append (pam-service-auth pam)

> - (list optional-pam-mount)))

> - (session (append (pam-service-session pam)

> - (list optional-pam-mount))))

> + (auth (insert-before pam-gnupg-module?

> + (pam-service-auth pam)

> + (list optional-pam-mount)))

> + (session (insert-before pam-gnupg-module?

> + (pam-service-session pam)

> + (list optional-pam-mount))))

> +(define (pam-gnupg-module? name)

> + "Return `#t' if NAME is the path to the pam-gnupg module, `#f' otherwise."

> + (equal? (pam-entry-module name)

> + (file-append pam-gnupg "/lib/security/pam_gnupg.so")))

> My main concern is that the new 'pam-gnupg-module?' procedure could be wrong,

> but I did not find any other solution.

> I also think that using 'insert-before' in gnu/services/pam-mount.scm could be

> a problem. If other PAM modules needs to be on certain positions, it could be

> an “if mess” or maybe not, I do not know much about PAM modules.

> +@file{~/.pam-gnupg} (see

> +@url{https://github.com/cruegge/pam-gnupg#setup-guide, pam-gnupg setup

> +guide}), and can be queried with @code{gpg -K --with-keygrip}

> +(@pxref{Commands to select the type of operation,,,gnupg}). Presetting

> +passphrases must be enabled by adding @code{allow-preset-passphrase} in

> +@file{~/.gnupg/gpg-agent.conf} (@pxref{Put a passphrase into the

> +cache,,,gnupg}).

> (if (member (pam-service-name pam)

> '("login" "greetd" "su" "slim" "gdm-password" "sddm"))

> (pam-service

> + ;; pam-mount module must be before pam-gnupg, because the later

> + ;; needs to be at the end (See pam-gnupg README.md)

> (inherit pam)

> +(define (pam-gnupg-module? name)

> + "Return `#t' if NAME is the path to the pam-gnupg module, `#f' otherwise."

> + (let ((module (pam-entry-module name)))

> + (and (file-append? module)

> + (equal? (first (file-append-suffix module))

> + "/lib/security/pam_gnupg.so"))))

> - #:use-module (rnrs io ports) ;need 'port-position' etc.

> + #:use-module (rnrs io ports) ;need 'port-position' etc.

> #:use-module ((rnrs bytevectors) #:select (bytevector-u8-set!))

> #:use-module (guix memoization)

> #:use-module ((guix build utils)

> #:select (dump-port mkdir-p delete-file-recursively

> - call-with-temporary-output-file %xz-parallel-args))

> + call-with-temporary-output-file %xz-parallel-args))

> #:use-module ((guix build syscalls) #:select (mkdtemp! fdatasync))

> #:use-module ((guix combinators) #:select (fold2))

> - #:use-module (guix diagnostics) ;<location>, &error-location, etc.

> + #:use-module (guix diagnostics) ;<location>, &error-location, etc.

> #:use-module (ice-9 format)

> #:use-module ((ice-9 iconv) #:prefix iconv:)

> #:use-module (ice-9 match)

> @@ -57,7 +58,7 @@ (define-module (guix utils)

> #:use-module (ice-9 vlist)

> #:autoload (zlib) (make-zlib-input-port make-zlib-output-port)

> #:use-module (system foreign)

> - #:re-export (<location> ;for backwards compatibility

> + #:re-export (<location> ;for backwards compatibility