v0.0.48 - Added OTP one-time pad encryption (otp_encrypt/otp_decrypt verbs), HTTP listener mode (--listen http:HOST:PORT), interactive OTP pad auto-scan on USB drives, raised SERVER_MAX_MSG_SIZE to 16MB, updated README with curl examples and current API documentation

packaging/qubes/allow_nostr_dom0.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Run in dom0 to allow the "nostr" qube to call n_signer without a Qubes popup.
+
+set -euo pipefail
+
+POLICY_FILE="/etc/qubes/policy.d/40-nsigner.policy"
+SIGNER_QUBE="nostr_signer"
+CALLER_QUBE="nostr"
+SIGNER_TAG="nsigner-signer"
+
+echo "Installing n_signer qrexec policy..."
+sudo mkdir -p /etc/qubes/policy.d
+sudo tee "$POLICY_FILE" >/dev/null <<EOF
+# Qubes OS qrexec policy for nsigner
+qubes.NsignerRpc * ai @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
+qubes.NsignerRpc * ${CALLER_QUBE} @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
+qubes.NsignerRpc * @anyvm @tag:${SIGNER_TAG} ask default_target=${SIGNER_QUBE}
+qubes.NsignerRpc * @anyvm @anyvm deny
+EOF
+sudo chmod 0644 "$POLICY_FILE"
+
+echo "Tagging ${SIGNER_QUBE} as ${SIGNER_TAG}..."
+qvm-tags "$SIGNER_QUBE" add "$SIGNER_TAG"
+
+echo
+echo "Installed policy:"
+sudo cat "$POLICY_FILE"
+echo
+echo "Tags on ${SIGNER_QUBE}:"
+qvm-tags "$SIGNER_QUBE" list
+echo
+echo "Done. Calls from ${CALLER_QUBE} to ${SIGNER_QUBE} are now allowed without a Qubes popup."