v0.0.34 - Add qrexec bridge subcommand and --bridge-source-trusted flag for persistent-signer qrexec transport

packaging/qubes/policy.d/40-nsigner.policy

@@ -1,5 +1,5 @@
 # Qubes OS qrexec policy for nsigner
 # Syntax: service +argument source target action
 # Allow specific qubes to reach the signer qube with user confirmation
-qubes.NsignerRpc * @anyvm @tag:nsigner-signer ask default_target=nsigner-vault
+qubes.NsignerRpc * @anyvm @tag:nsigner-signer ask default_target=nostr_signer
 qubes.NsignerRpc * @anyvm @anyvm deny

packaging/qubes/rpc/qubes.NsignerRpc

@@ -1,2 +1,20 @@
 #!/bin/sh
-exec /usr/local/bin/nsigner --listen qrexec
+# qubes.NsignerRpc — qrexec service entrypoint for n_signer.
+#
+# This is a STATELESS BRIDGE: it relays one framed JSON-RPC request from
+# qrexec stdin to a persistent nsigner process listening on an abstract
+# unix socket, and relays the response back to qrexec stdout.
+#
+# The persistent signer (started separately by the human, with the mnemonic
+# in mlock'd RAM) must be running with:
+#   nsigner --listen unix --socket-name nsigner --bridge-source-trusted
+#
+# This bridge holds NO secrets and NO mnemonic. It is a dumb pipe.
+# QREXEC_REMOTE_DOMAIN (set by the qrexec framework) is relayed to the
+# signer as a source-qube preamble so the signer tags the caller as
+# qubes:<source-vm>.
+#
+# The binary is installed by install_qube_fips_nsigner.sh to
+# /home/user/.local/bin/nsigner
+
+exec /home/user/.local/bin/nsigner bridge --to nsigner