[bug#63955] [PATCH 4/5] services: greetd: Add pam-gnupg support.

[wurt]

From: Carlos Durán Domínguez <wurt@wurtshell.com>

---
 doc/guix.texi         |  9 ++++++++
 gnu/services/base.scm | 48 +++++++++++++++++++++++++------------------
 2 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 01f4e0105f..fe3ae7f2df 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -116,6 +116,7 @@ Copyright @copyright{} 2022 Antero Mejr@*
 Copyright @copyright{} 2023 Karl Hallsby@*
 Copyright @copyright{} 2023 Nathaniel Nicandro@*
 Copyright @copyright{} 2023 Tanguy Le Carrour@*
+Copyright @copyright{} 2023 Carlos Durán Domínguez@*
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -19373,6 +19374,14 @@ A file-like object containing the ``message of the 
day''.
 Allow empty passwords by default so that first-time users can log in when
 the 'root' account has just been created.
 
+@item @code{gnupg?} (default: @code{#f})
+If enabled, @code{pam-gnupg} will attempt to automatically unlock the
+user's GPG keys with the login password via @code{gpg-agent}.  The
+keygrips of all keys to be unlocked should be written to
+@file{~/.pam-gnupg}, and can be queried with @code{gpg -K
+--with-keygrip}.  Presetting passphrases must be enabled by adding
+@code{allow-preset-passphrase} in @file{~/.gnupg/gpg-agent.conf}.
+
 @item @code{terminals} (default: @code{'()})
 List of @code{greetd-terminal-configuration} per terminal for which
 @code{greetd} should be started.
diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index c5b06b57e8..4e93ee4991 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -21,6 +21,7 @@
 ;;; Copyright © 2022 Justin Veilleux <terramorpha@cock.li>
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
+;;; Copyright © 2023 Carlos Durán Domínguez <wurt@wurtshell.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -38,6 +39,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu services base)
+  #:use-module (guix utils)
   #:use-module (guix store)
   #:use-module (guix deprecation)
   #:autoload   (guix diagnostics) (warning formatted-message &fix-hint)
@@ -3221,6 +3223,7 @@ (define-record-type* <greetd-configuration>
   greetd-configuration?
   (motd greetd-motd (default %default-motd))
   (allow-empty-passwords? greetd-allow-empty-passwords? (default #t))
+  (gnupg? greetd-gnupg? (default #f))
   (terminals greetd-terminals (default '()))
   (greeter-supplementary-groups greetd-greeter-supplementary-groups (default 
'())))
 
@@ -3259,26 +3262,31 @@ (define optional-pam-mount
      (control "optional")
      (module #~(string-append #$greetd-pam-mount "/lib/security/pam_mount.so"))
      (arguments '("disable_interactive"))))
-
-  (list
-   (unix-pam-service "greetd"
-                     #:login-uid? #t
-                     #:allow-empty-passwords?
-                     (greetd-allow-empty-passwords? config)
-                     #:motd
-                     (greetd-motd config))
-   (pam-extension
-    (transformer
-     (lambda (pam)
-       (if (member (pam-service-name pam)
-                   '("login" "greetd" "su" "slim" "gdm-password"))
-           (pam-service
-            (inherit pam)
-            (auth (append (pam-service-auth pam)
-                          (list optional-pam-mount)))
-            (session (append (pam-service-session pam)
-                             (list optional-pam-mount))))
-           pam))))))
+  (define (optional-pam-mount-transformer pam)
+    (if (member (pam-service-name pam)
+                '("login" "greetd" "su" "slim" "gdm-password"))
+        (pam-service
+         (inherit pam)
+         ;; SLiM could have pam-gnupg module, and pam-mount must be before it.
+         (auth (insert-before pam-gnupg-module?
+                              (pam-service-auth pam)
+                              (list optional-pam-mount)))
+         (session (insert-before pam-gnupg-module?
+                                 (pam-service-session pam)
+                                 (list optional-pam-mount))))
+        pam))
+
+  (list (unix-pam-service "greetd"
+                          #:login-uid? #t
+                          #:allow-empty-passwords?
+                          (greetd-allow-empty-passwords? config)
+                          #:gnupg?
+                          (greetd-gnupg? config)
+                          #:motd
+                          (greetd-motd config))
+        (pam-extension
+         (transformer
+          optional-pam-mount-transformer))))
 
 (define (greetd-shepherd-services config)
   (map
-- 
2.40.1