Merge pull request #146 from n8henrie/issue_143

Skip missing or unreadable keys
ryantm · Feb 11, 2023 · 6053c55 · 6053c55
2 parents b7ffcfe + 37c7297
commit 6053c55
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/modules/age.nix b/modules/age.nix
@@ -54,8 +54,6 @@ with lib; let
  chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
  '';
 
- identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
-
  setTruePath = secretType: ''
  ${
  if secretType.symlink
@@ -72,13 +70,23 @@ with lib; let
  ${setTruePath secretType}
  echo "decrypting '${secretType.file}' to '$_truePath'..."
  TMP_FILE="$_truePath.tmp"
+
+ IDENTITIES=()
+ for identity in ${toString cfg.identityPaths}; do
+ test -r "$identity" || continue
+ IDENTITIES+=(-i)
+ IDENTITIES+=("$identity")
+ done
+
+ test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
+
  mkdir -p "$(dirname "$_truePath")"
  [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
  (
  umask u=r,g=,o=
  test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
  test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
- LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}"
+ LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
  )
  chmod ${secretType.mode} "$TMP_FILE"
  mv -f "$TMP_FILE" "$_truePath"

diff --git a/test/integration.nix b/test/integration.nix
@@ -13,6 +13,7 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
  nodes.system1 = {
  config,
  lib,
+ options,
  ...
  }: {
  imports = [
@@ -26,6 +27,8 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
  file = ../example/passwordfile-user1.age;
  };
 
+ age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
+
  users = {
  mutableUsers = false;
 

diff --git a/test/integration_darwin.nix b/test/integration_darwin.nix
@@ -1,6 +1,7 @@
 {
  config,
  pkgs,
+ options,
  ...
 }: let
  secret = "hello";
@@ -18,6 +19,8 @@ in {
 
  services.nix-daemon.enable = true;
 
+ age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
+
  age.secrets.secret1.file = ../example/secret1.age;
 
  environment.systemPackages = [testScript];