v0.0.35 - Update README with qrexec bridge docs, update start_nsigner.sh to support qrexec mode and extra args

packaging/qubes/policy.d/40-nsigner.policy

@@ -1,5 +1,10 @@
 # Qubes OS qrexec policy for nsigner
 # Syntax: service +argument source target action
-# Allow specific qubes to reach the signer qube with user confirmation
+#
+# The ai qube is allowed without a dom0 popup (memory isolation is the
+# real security boundary — the signer's own approval prompt in the
+# nostr_signer terminal is the operation-level gate).
+qubes.NsignerRpc * ai @tag:nsigner-signer allow target=nostr_signer
+# Any other qube must get a dom0 confirmation popup.
 qubes.NsignerRpc * @anyvm @tag:nsigner-signer ask default_target=nostr_signer
 qubes.NsignerRpc * @anyvm @anyvm deny

packaging/qubes/setup_dom0.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+#
+# setup_dom0.sh — install qrexec policy and tag the signer qube in dom0.
+#
+# Run this in dom0. It creates /etc/qubes/policy.d/40-nsigner.policy
+# and tags the nostr_signer qube with 'nsigner-signer'.
+#
+# Usage:
+#   bash setup_dom0.sh [signer_qube_name]
+#
+# Default signer qube name is "nostr_signer".
+
+set -euo pipefail
+
+SIGNER_QUBE="${1:-nostr_signer}"
+
+echo "=== n_signer dom0 setup ==="
+echo "Signer qube: ${SIGNER_QUBE}"
+echo
+
+# Create policy directory if it doesn't exist
+sudo mkdir -p /etc/qubes/policy.d
+
+# Write the qrexec policy
+# The 'ai' qube is allowed without a dom0 popup (memory isolation is the
+# real security boundary; the signer's own approval prompt is the gate).
+# Any other qube gets a dom0 confirmation popup.
+echo "Installing qrexec policy to /etc/qubes/policy.d/40-nsigner.policy..."
+echo "# Qubes OS qrexec policy for nsigner" | sudo tee /etc/qubes/policy.d/40-nsigner.policy > /dev/null
+echo "qubes.NsignerRpc * ai @tag:nsigner-signer allow target=${SIGNER_QUBE}" | sudo tee -a /etc/qubes/policy.d/40-nsigner.policy > /dev/null
+echo "qubes.NsignerRpc * @anyvm @tag:nsigner-signer ask default_target=${SIGNER_QUBE}" | sudo tee -a /etc/qubes/policy.d/40-nsigner.policy > /dev/null
+echo "qubes.NsignerRpc * @anyvm @anyvm deny" | sudo tee -a /etc/qubes/policy.d/40-nsigner.policy > /dev/null
+
+echo "Policy installed. Contents:"
+cat /etc/qubes/policy.d/40-nsigner.policy
+echo
+
+# Tag the signer qube
+echo "Tagging ${SIGNER_QUBE} with 'nsigner-signer'..."
+qvm-tags "${SIGNER_QUBE}" add nsigner-signer
+echo "Tag added."
+echo
+
+# Verify
+echo "=== Verification ==="
+echo "Policy file:"
+ls -l /etc/qubes/policy.d/40-nsigner.policy
+echo
+echo "Tags on ${SIGNER_QUBE}:"
+qvm-tags "${SIGNER_QUBE}" list 2>/dev/null | grep nsigner || echo "(tag not found — check qube name)"
+echo
+echo "=== dom0 setup complete ==="
+echo
+echo "Next steps:"
+echo "  1. In ${SIGNER_QUBE}: run setup_signer_qube.sh"
+echo "  2. In ${SIGNER_QUBE}: start the persistent signer:"
+echo "     ~/.local/bin/nsigner --listen unix --socket-name nsigner --bridge-source-trusted"
+echo "  3. In caller qube: node examples/n_signer_qube_example_qrexec.js ${SIGNER_QUBE}"

packaging/qubes/setup_signer_qube.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+#
+# setup_signer_qube.sh — install nsigner v0.0.34+ and the qrexec bridge service
+# in the nostr_signer qube.
+#
+# Run this in the nostr_signer qube (as the regular user, not root).
+# It will:
+#   1. Run install_nsigner.sh to download the latest nsigner release (v0.0.34+)
+#   2. Install the qubes.NsignerRpc qrexec service (bridge mode)
+#   3. Print instructions for starting the persistent signer
+#
+# Usage:
+#   bash setup_signer_qube.sh
+
+set -euo pipefail
+
+NSIGNER_BIN="${HOME}/.local/bin/nsigner"
+SERVICE_DST="/etc/qubes-rpc/qubes.NsignerRpc"
+
+echo "=== n_signer qube setup ==="
+echo
+
+# Step 1: Update nsigner binary
+if [ -f "${HOME}/install_nsigner.sh" ]; then
+    echo "Step 1: Running install_nsigner.sh to update nsigner..."
+    bash "${HOME}/install_nsigner.sh"
+else
+    echo "Step 1: install_nsigner.sh not found in ${HOME}."
+    echo "  Make sure install_nsigner.sh is in your home directory first."
+    exit 1
+fi
+echo
+
+# Verify the bridge subcommand exists
+echo "Verifying bridge subcommand..."
+if ! "${NSIGNER_BIN}" bridge --help > /dev/null 2>&1; then
+    echo "ERROR: nsigner does not have the 'bridge' subcommand."
+    echo "  The installed version may be too old. Expected v0.0.34 or later."
+    "${NSIGNER_BIN}" --version
+    exit 1
+fi
+echo "OK: bridge subcommand available."
+"${NSIGNER_BIN}" --version
+echo
+
+# Step 2: Install the qrexec service
+echo "Step 2: Installing qrexec service to ${SERVICE_DST}..."
+echo '#!/bin/sh' | sudo tee "${SERVICE_DST}" > /dev/null
+echo '# qubes.NsignerRpc — stateless bridge to persistent nsigner unix socket' | sudo tee -a "${SERVICE_DST}" > /dev/null
+echo '# No mnemonic, no secrets. Relays QREXEC_REMOTE_DOMAIN as source-qube preamble.' | sudo tee -a "${SERVICE_DST}" > /dev/null
+echo "exec ${NSIGNER_BIN} bridge --to nsigner" | sudo tee -a "${SERVICE_DST}" > /dev/null
+sudo chmod 0755 "${SERVICE_DST}"
+
+echo "Service installed. Contents:"
+cat "${SERVICE_DST}"
+echo
+
+echo "=== Signer qube setup complete ==="
+echo
+echo "To start the persistent signer (mnemonic entered at terminal, in mlock'd RAM):"
+echo
+echo "  ${NSIGNER_BIN} --listen unix --socket-name nsigner --bridge-source-trusted"
+echo
+echo "The signer will prompt you for the mnemonic. It stays running with the"
+echo "mnemonic in RAM only — nothing on disk. Leave it running in a terminal."
+echo
+echo "Then from a caller qube (e.g. 'ai'):"
+echo "  node examples/n_signer_qube_example_qrexec.js nostr_signer"