Skip to content

Commit ebcd80e

Browse files
provokateurinprovokateurin
committed
chipass: init at 2026.09.0
1 parent 65c869b commit ebcd80e

5 files changed

Lines changed: 280 additions & 0 deletions

File tree

‎nixos/tests/all-tests.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -422,6 +422,7 @@ in
422422
cgit = runTest ./cgit.nix;
423423
charliecloud = runTest ./charliecloud.nix;
424424
chhoto-url = runTest ./chhoto-url.nix;
425+
chipass = runTest ./chipass.nix;
425426
chromadb = runTest ./chromadb.nix;
426427
chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
427428
chrony = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony.nix;

‎nixos/tests/chipass.nix‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{ pkgs, ... }:
2+
3+
{
4+
name = "chipass";
5+
meta = with pkgs.lib.maintainers; {
6+
maintainers = [ provokateurin ];
7+
timeout = 1800;
8+
};
9+
10+
nodes.machine =
11+
{ ... }:
12+
13+
{
14+
imports = [
15+
./common/user-account.nix
16+
./common/x11.nix
17+
];
18+
19+
services.xserver.enable = true;
20+
programs.dconf.enable = true;
21+
22+
# for better OCR
23+
environment.etc."icewm/prefoverride".text = ''
24+
ColorActiveTitleBar = "rgb:FF/FF/FF"
25+
'';
26+
27+
# Regression test for https://github.com/NixOS/nixpkgs/issues/163482
28+
qt = {
29+
enable = true;
30+
platformTheme = "gnome";
31+
style = "adwaita-dark";
32+
};
33+
34+
test-support.displayManager.auto.user = "alice";
35+
environment.systemPackages = with pkgs; [
36+
chipass
37+
xdotool
38+
];
39+
};
40+
41+
enableOCR = true;
42+
43+
testScript =
44+
{ nodes, ... }:
45+
let
46+
aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
47+
in
48+
''
49+
with subtest("Ensure X starts"):
50+
start_all()
51+
machine.wait_for_x()
52+
53+
with subtest("Can create database and entry with CLI"):
54+
${aliceDo "ChiPass-cli db-create --set-key-file foo.keyfile foo.kdbx"}
55+
${aliceDo "ChiPass-cli add --no-password -k foo.keyfile foo.kdbx bar"}
56+
57+
with subtest("Ensure ChiPass starts"):
58+
# start ChiPass window
59+
${aliceDo "ChiPass >&2 &"}
60+
61+
machine.wait_for_text("ChiPass ${pkgs.chipass.version}")
62+
machine.screenshot("ChiPass")
63+
64+
with subtest("Can open existing database"):
65+
machine.send_key("ctrl-o")
66+
machine.sleep(5)
67+
# Regression #163482: chipass did not crash
68+
machine.succeed("ps -e | grep ChiPass")
69+
machine.wait_for_text("Open database")
70+
machine.send_key("ret")
71+
72+
# Wait for the enter password screen to appear.
73+
machine.wait_for_text("/home/alice/foo.kdbx")
74+
75+
# Click on "I have key file" button to open keyfile dialog
76+
machine.send_key("tab")
77+
machine.send_key("tab")
78+
machine.send_key("tab")
79+
machine.send_key("ret")
80+
81+
# Select keyfile
82+
machine.wait_for_text("Select key file")
83+
machine.send_chars("/home/alice/foo.keyfile")
84+
machine.send_key("ret")
85+
86+
# Open database
87+
machine.wait_for_text("foo.kdbx \\[Locked] - ChiPass")
88+
machine.send_key("ret")
89+
90+
# Database is unlocked (doesn't have "[Locked]" in the title anymore)
91+
machine.wait_for_text("foo.kdbx - ChiPass")
92+
'';
93+
}

‎pkgs/by-name/ch/chipass/chromium-native-messaging-host.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"name": "org.keepassxc.keepassxc_browser",
3+
"description": "ChiPass integration with native messaging support",
4+
"path": "@out@/bin/ChiPass-proxy",
5+
"type": "stdio",
6+
"allowed_origins": [
7+
"chrome-extension://iopaggbpplllidnfmcghoonnokmjoicf/",
8+
"chrome-extension://oboonakemofpalcgghocfoadofidjkkk/",
9+
"chrome-extension://pdffhmdngciaglkoonimfcmckehcpafo/"
10+
]
11+
}

‎pkgs/by-name/ch/chipass/firefox-native-messaging-host.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"name": "org.keepassxc.keepassxc_browser",
3+
"description": "ChiPass integration with native messaging support",
4+
"path": "@out@/bin/ChiPass-proxy",
5+
"type": "stdio",
6+
"allowed_extensions": [
7+
"keepassxc-browser@keepassxc.org"
8+
]
9+
}

‎pkgs/by-name/ch/chipass/package.nix‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
{
2+
lib,
3+
stdenv,
4+
fetchFromCodeberg,
5+
6+
asciidoctor,
7+
botan3,
8+
cmake,
9+
libargon2,
10+
libusb1,
11+
libxtst,
12+
minizip,
13+
nix-update-script,
14+
pcsclite,
15+
pkg-config,
16+
qrencode,
17+
qt6Packages,
18+
readline,
19+
wrapGAppsHook3,
20+
zlib,
21+
zxcvbn-c,
22+
23+
withChiPassBrowser ? true,
24+
withChiPassBrowserPasskeys ? true,
25+
withChiPassFDOSecrets ? true,
26+
withChiPassKeeShare ? true,
27+
withChiPassNetworking ? true,
28+
withChiPassSSHAgent ? true,
29+
withChiPassX11 ? true,
30+
withChiPassYubiKey ? true,
31+
32+
nixosTests,
33+
}:
34+
35+
stdenv.mkDerivation (finalAttrs: {
36+
pname = "chipass";
37+
version = "2026.09.0";
38+
39+
src = fetchFromCodeberg {
40+
owner = "ChiPass";
41+
repo = "ChiPass";
42+
tag = "v${finalAttrs.version}";
43+
hash = "sha256-6nA7NziEgiQolhx5cGdyZZTJ5JcKWz9WQOiJ3JiZ6UQ=";
44+
};
45+
46+
env = lib.optionalAttrs stdenv.cc.isClang {
47+
NIX_CFLAGS_COMPILE = toString [
48+
"-Wno-old-style-cast"
49+
"-Wno-error"
50+
"-D__BIG_ENDIAN__=${if stdenv.hostPlatform.isBigEndian then "1" else "0"}"
51+
];
52+
};
53+
54+
# Upstream develops against a build of PCSC from Xcode.
55+
# The types are incompatible with nixpkgs pcsclite.
56+
# https://github.com/NixOS/nixpkgs/issues/520227
57+
postPatch = ''
58+
substituteInPlace src/keys/drivers/YubiKeyInterfacePCSC.cpp \
59+
--replace-fail "typedef uint32_t RETVAL;" "typedef int32_t RETVAL;"
60+
'';
61+
62+
cmakeFlags = [
63+
(lib.cmakeFeature "CHIPASS_BUILD_TYPE" "Release")
64+
(lib.cmakeBool "CHIPASS_WITH_GUI_TESTS" true)
65+
(lib.cmakeBool "CHIPASS_WITH_UPDATE_CHECK" false)
66+
(lib.cmakeOptionType "list" "CHIPASS_DESKTOP_TYPES" (
67+
lib.concatStringsSep ";" ([ "Wayland" ] ++ lib.optional withChiPassX11 "X11")
68+
))
69+
(lib.cmakeBool "CHIPASS_WITH_BROWSER" withChiPassBrowser)
70+
(lib.cmakeBool "CHIPASS_WITH_BROWSER_PASSKEYS" withChiPassBrowserPasskeys)
71+
(lib.cmakeBool "CHIPASS_WITH_KEESHARE" withChiPassKeeShare)
72+
(lib.cmakeBool "CHIPASS_WITH_NETWORKING" withChiPassNetworking)
73+
(lib.cmakeBool "CHIPASS_WITH_SSHAGENT" withChiPassSSHAgent)
74+
(lib.cmakeBool "CHIPASS_WITH_FDOSECRETS" withChiPassFDOSecrets)
75+
(lib.cmakeBool "CHIPASS_WITH_YUBIKEY" withChiPassYubiKey)
76+
];
77+
78+
doCheck = true;
79+
checkPhase =
80+
let
81+
disabledTests = lib.concatStringsSep "|" [
82+
# flaky
83+
"cli"
84+
"gui"
85+
"guipixmaps"
86+
"guibrowser"
87+
"guifdosecrets"
88+
];
89+
in
90+
''
91+
runHook preCheck
92+
93+
export LC_ALL="en_US.UTF-8"
94+
export QT_QPA_PLATFORM=offscreen
95+
export QT_PLUGIN_PATH="${qt6Packages.qtbase}/bin/${qt6Packages.qtbase.qtPluginPrefix}"
96+
97+
make test ARGS+="-E '${disabledTests}' --output-on-failure"
98+
99+
runHook postCheck
100+
'';
101+
102+
nativeBuildInputs = [
103+
asciidoctor
104+
cmake
105+
pkg-config
106+
qt6Packages.qttools
107+
qt6Packages.wrapQtAppsHook
108+
wrapGAppsHook3
109+
];
110+
111+
dontWrapGApps = true;
112+
preFixup = ''
113+
qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
114+
'';
115+
116+
postInstall = (
117+
# See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/src/browser/NativeMessageInstaller.cpp#L317
118+
# See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/utils/keepassxc-snap-helper.sh#L48-L58
119+
lib.optionalString withChiPassBrowser ''
120+
mkdir -p "$out/lib/mozilla/native-messaging-hosts"
121+
substituteAll "${./firefox-native-messaging-host.json}" "$out/lib/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"
122+
123+
mkdir -p "$out/etc/chromium/native-messaging-hosts"
124+
substituteAll "${./chromium-native-messaging-host.json}" "$out/etc/chromium/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"
125+
''
126+
);
127+
128+
buildInputs = [
129+
botan3
130+
libargon2
131+
libusb1
132+
libxtst
133+
minizip
134+
pcsclite
135+
qrencode
136+
qt6Packages.appstream-qt
137+
qt6Packages.qt5compat
138+
qt6Packages.qtbase
139+
qt6Packages.qtsvg
140+
readline
141+
zlib
142+
zxcvbn-c
143+
];
144+
145+
passthru = {
146+
tests = {
147+
inherit (nixosTests) chipass;
148+
};
149+
updateScript = nix-update-script { };
150+
};
151+
152+
meta = {
153+
description = "A cross-platform password manager for people with extremely high demands on secure personal data management";
154+
longDescription = ''
155+
ChiPass is a modern, secure, and open-source password manager that stores and manages your most sensitive information. You can run ChiPass on Windows, macOS, and Linux systems. ChiPass is for people with extremely high demands of secure personal data management. It saves many different types of information, such as usernames, passwords, URLs, attachments, and notes in an offline, encrypted file that can be stored in any location, including private and public cloud solutions. For easy identification and management, user-defined titles and icons can be specified for entries. In addition, entries are sorted into customizable groups. An integrated search function allows you to use advanced patterns to easily find any entry in your database. A customizable, fast, and easy-to-use password generator utility allows you to create passwords with any combination of characters or easy to remember passphrases.
156+
'';
157+
homepage = "https://chipass.org";
158+
changelog = "https://codeberg.org/ChiPass/ChiPass/src/tag/v${finalAttrs.version}/CHANGELOG.md";
159+
license = lib.licenses.gpl2Plus;
160+
mainProgram = "chipass";
161+
maintainers = with lib.maintainers; [
162+
provokateurin
163+
];
164+
platforms = lib.platforms.linux;
165+
};
166+
})

0 commit comments

Comments
 (0)