21 lines
852 B
Bash
21 lines
852 B
Bash
#!/bin/sh
|
|
# qubes.NsignerRpc — qrexec service entrypoint for n_signer.
|
|
#
|
|
# This is a STATELESS BRIDGE: it relays one framed JSON-RPC request from
|
|
# qrexec stdin to a persistent nsigner process listening on an abstract
|
|
# unix socket, and relays the response back to qrexec stdout.
|
|
#
|
|
# The persistent signer (started separately by the human, with the mnemonic
|
|
# in mlock'd RAM) must be running with:
|
|
# nsigner --listen unix --socket-name nsigner --bridge-source-trusted
|
|
#
|
|
# This bridge holds NO secrets and NO mnemonic. It is a dumb pipe.
|
|
# QREXEC_REMOTE_DOMAIN (set by the qrexec framework) is relayed to the
|
|
# signer as a source-qube preamble so the signer tags the caller as
|
|
# qubes:<source-vm>.
|
|
#
|
|
# The binary is installed by install_qube_fips_nsigner.sh to
|
|
# /home/user/.local/bin/nsigner
|
|
|
|
exec /home/user/.local/bin/nsigner bridge --to nsigner
|