gnu/packages/password-utils.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Steve Sprang <scs@stevesprang.com>
   3 ;;; Copyright © 2015, 2016, 2017, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
   4 ;;; Copyright © 2015 Aljosha Papsch <misc@rpapsch.de>
   5 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   6 ;;; Copyright © 2016 Jessica Tallon <tsyesika@tsyesika.se>
   7 ;;; Copyright © 2016 Andreas Enge <andreas@enge.fr>
   8 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox.org>
   9 ;;; Copyright © 2016, 2019 Alex Griffin <a@ajgrf.com>
  10 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
  11 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
  12 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
  13 ;;; Copyright © 2017 Jelle Licht <jlicht@fsfe.org>
  14 ;;; Copyright © 2017, 2019 Eric Bavier <bavier@member.fsf.org>
  15 ;;; Copyright © 2017 Nicolas Goaziou <mail@nicolasgoaziou.fr>
  16 ;;; Copyright © 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
  17 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  18 ;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
  19 ;;; Copyright © 2018 Konrad Hinsen <konrad.hinsen@fastmail.net>
  20 ;;; Copyright © 2018 Thomas Sigurdsen <tonton@riseup.net>
  21 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
  22 ;;; Copyright © 2018 Pierre Neidhardt <mail@ambrevar.xyz>
  23 ;;; Copyright © 2018 Amirouche Boubekki <amirouche@hypermove.net>
  24 ;;; Copyright © 2018, 2019 Tim Gesthuizen <tim.gesthuizen@yahoo.de>
  25 ;;; Copyright © 2019 Jens Mølgaard <jens@zete.tk>
  26 ;;; Copyright © 2019 Tanguy Le Carrour <tanguy@bioneland.org>
  27 ;;;
  28 ;;; This file is part of GNU Guix.
  29 ;;;
  30 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  31 ;;; under the terms of the GNU General Public License as published by
  32 ;;; the Free Software Foundation; either version 3 of the License, or (at
  33 ;;; your option) any later version.
  34 ;;;
  35 ;;; GNU Guix is distributed in the hope that it will be useful, but
  36 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  37 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  38 ;;; GNU General Public License for more details.
  39 ;;;
  40 ;;; You should have received a copy of the GNU General Public License
  41 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  42
  43 (define-module (gnu packages password-utils)
  44   #:use-module ((guix licenses) #:prefix license:)
  45   #:use-module (guix build-system cmake)
  46   #:use-module (guix build-system gnu)
  47   #:use-module (guix build-system trivial)
  48   #:use-module (guix download)
  49   #:use-module (guix git-download)
  50   #:use-module (guix packages)
  51   #:use-module (gnu packages)
  52   #:use-module (gnu packages admin)
  53   #:use-module (gnu packages aidc)
  54   #:use-module (gnu packages authentication)
  55   #:use-module (gnu packages base)
  56   #:use-module (gnu packages check)
  57   #:use-module (gnu packages compression)
  58   #:use-module (gnu packages crypto)
  59   #:use-module (gnu packages curl)
  60   #:use-module (gnu packages file)
  61   #:use-module (gnu packages freedesktop)
  62   #:use-module (gnu packages gettext)
  63   #:use-module (gnu packages glib)
  64   #:use-module (gnu packages gnupg)
  65   #:use-module (gnu packages gtk)
  66   #:use-module (gnu packages guile)
  67   #:use-module (gnu packages kerberos)
  68   #:use-module (gnu packages libffi)
  69   #:use-module (gnu packages linux)
  70   #:use-module (gnu packages man)
  71   #:use-module (gnu packages multiprecision)
  72   #:use-module (gnu packages ncurses)
  73   #:use-module (gnu packages nss)
  74   #:use-module (gnu packages opencl)
  75   #:use-module (gnu packages perl)
  76   #:use-module (gnu packages pkg-config)
  77   #:use-module (gnu packages python)
  78   #:use-module (gnu packages python-web)
  79   #:use-module (gnu packages python-xyz)
  80   #:use-module (gnu packages readline)
  81   #:use-module (gnu packages ruby)
  82   #:use-module (gnu packages security-token)
  83   #:use-module (gnu packages suckless)
  84   #:use-module (gnu packages tcl)
  85   #:use-module (gnu packages tls)
  86   #:use-module (gnu packages qt)
  87   #:use-module (gnu packages version-control)
  88   #:use-module (gnu packages wxwidgets)
  89   #:use-module (gnu packages xdisorg)
  90   #:use-module (gnu packages xorg)
  91   #:use-module (gnu packages xml)
  92   #:use-module (guix build-system python))
  93
  94 (define-public pwgen
  95   (package
  96     (name "pwgen")
  97     (version "2.08")
  98     (source
  99      (origin
 100        (method url-fetch)
 101        (uri (string-append "mirror://sourceforge/pwgen/pwgen/" version
 102                            "/pwgen-" version ".tar.gz"))
 103        (sha256
 104         (base32 "0yy90pqrr2pszzhb5hxjishq9qc7dqd290amiibqx9fm1b9kvc6s"))))
 105     (build-system gnu-build-system)
 106     (arguments
 107      `(#:tests? #f)) ; no test suite
 108     (home-page "http://pwgen.sourceforge.net/")
 109     (synopsis "Password generator")
 110     (description "Pwgen generates passwords which can be easily memorized by a
 111 human.")
 112     (license license:gpl2)))
 113
 114 (define-public keepassxc
 115   (package
 116     (name "keepassxc")
 117     (version "2.5.1")
 118     (source
 119      (origin
 120        (method url-fetch)
 121        (uri (string-append "https://github.com/keepassxreboot/keepassxc"
 122                            "/releases/download/" version "/keepassxc-"
 123                            version "-src.tar.xz"))
 124        (sha256
 125         (base32
 126          "0c5g5hn2cr2m00xgpxg884ihy8gnn09kc487y1m9jywshn5jaczg"))))
 127     (build-system cmake-build-system)
 128     (arguments
 129      '(#:configure-flags '("-DWITH_XC_ALL=YES"
 130                            "-DWITH_XC_UPDATECHECK=NO")))
 131     (inputs
 132      `(("argon2" ,argon2)
 133        ("libgcrypt" ,libgcrypt)
 134        ("libsodium" ,libsodium)         ; XC_BROWSER
 135        ("libyubikey" ,libyubikey)       ; XC_YUBIKEY
 136        ("libxi" ,libxi)
 137        ("libxtst" ,libxtst)
 138        ("qrencode" ,qrencode)
 139        ("qtbase" ,qtbase)
 140        ("qtsvg" ,qtsvg)
 141        ("qtx11extras" ,qtx11extras)
 142        ("quazip" ,quazip)               ; XC_KEESHARE
 143        ("readline" ,readline)
 144        ("yubikey-personalization" ,yubikey-personalization) ; XC_YUBIKEY
 145        ("zlib" ,zlib)))
 146     (native-inputs
 147      `(("qttools" ,qttools)))
 148     (home-page "https://www.keepassxc.org")
 149     (synopsis "Password manager")
 150     (description "KeePassXC is a password manager or safe which helps you to
 151 manage your passwords in a secure way.  You can put all your passwords in one
 152 database, which is locked with one master key or a key-file which can be stored
 153 on an external storage device.  The databases are encrypted using the
 154 algorithms AES or Twofish.")
 155     ;; While various parts of the software are licensed under different licenses,
 156     ;; the combined work falls under the GPLv3.
 157     (license license:gpl3)))
 158
 159 (define-public keepassx
 160   (package
 161     (name "keepassx")
 162     (version "2.0.3")
 163     (source
 164      (origin
 165        (method url-fetch)
 166        (uri (string-append "https://www.keepassx.org/releases/" version
 167                            "/keepassx-" version ".tar.gz"))
 168        (sha256
 169         (base32
 170          "1ia7cqx9ias38mnffsl7da7g1f66bcbjsi23k49sln0c6spb9zr3"))))
 171     (build-system cmake-build-system)
 172     (inputs
 173      `(("libgcrypt" ,libgcrypt)
 174        ("libxi" ,libxi)
 175        ("libxtst" ,libxtst)
 176        ("qt" ,qt-4)))
 177     (native-inputs
 178      `(("zlib" ,zlib)))
 179     (home-page "https://www.keepassx.org")
 180     (synopsis "Password manager")
 181     (description "KeePassX is a password manager or safe which helps you to
 182 manage your passwords in a secure way.  You can put all your passwords in one
 183 database, which is locked with one master key or a key-file which can be stored
 184 on an external storage device.  The databases are encrypted using the
 185 algorithms AES or Twofish.")
 186     ;; Non functional parts use various licences.
 187     (license license:gpl3)
 188     (properties `((superseded . ,keepassxc)))))
 189
 190 (define-public pwsafe
 191   (package
 192     (name "pwsafe")
 193     (version "3.50.0")
 194     (home-page "https://www.pwsafe.org/")
 195     (source
 196      (origin
 197        (method git-fetch)
 198        (uri (git-reference
 199              (url "https://github.com/pwsafe/pwsafe.git")
 200              (commit version)))
 201        (sha256
 202         (base32 "01kfssd2vr64yh4dqhch58x36n3aj3hpj5n560f41rsxym69c6qs"))
 203        (file-name (git-file-name name version))))
 204     (build-system cmake-build-system)
 205     (native-inputs
 206      `(("gettext" ,gettext-minimal)
 207        ("gtest" ,googletest)
 208        ("perl" ,perl)
 209        ("zip" ,zip)))
 210     (inputs `(("curl" ,curl)
 211               ("file" ,file)
 212               ("libuuid" ,util-linux)
 213               ("libxt" ,libxt)
 214               ("libxtst" ,libxtst)
 215               ("openssl" ,openssl)
 216               ("qrencode" ,qrencode)
 217               ("wxwidgets" ,wxwidgets)
 218               ("xerces-c" ,xerces-c)))
 219     (arguments '(#:configure-flags (list "-DNO_GTEST=YES")
 220                  #:phases (modify-phases %standard-phases
 221                             (add-after 'unpack 'add-gtest
 222                               (lambda* (#:key inputs #:allow-other-keys)
 223                                 (chmod "CMakeLists.txt" #o644)
 224                                 (let ((cmake-port (open-file "CMakeLists.txt"
 225                                                              "a")))
 226                                   (display "find_package(GTest)
 227 add_subdirectory(src/test)\n" cmake-port)
 228                                   (close cmake-port)
 229                                   #t)))
 230                             (add-after 'add-gtest 'patch-executables
 231                               (lambda* (#:key inputs #:allow-other-keys)
 232                                 (chmod "src/test/OSTest.cpp" #o644)
 233                                 (substitute* "src/os/unix/media.cpp"
 234                                   (("/usr/bin/file")
 235                                    (string-append (assoc-ref inputs "file")
 236                                                   "/bin/file")))
 237                                 #t)))))
 238     (synopsis "Password safe with automatic input and key generation")
 239     (description "pwsafe is a password manager originally designed by Bruce
 240 Schneier.  It offers a simple UI to manage passwords for different services.
 241 There are other programs that support the file format on different
 242 platforms.")
 243     (license license:artistic2.0)))
 244
 245 (define-public shroud
 246   (package
 247     (name "shroud")
 248     (version "0.1.2")
 249     (source (origin
 250               (method url-fetch)
 251               (uri (string-append "https://files.dthompson.us/shroud/shroud-"
 252                                   version ".tar.gz"))
 253               (sha256
 254                (base32
 255                 "1l2shrhvcwfzkar9qiwb75nhcqmx25iz55lzmz0c187nbjhqzi9p"))))
 256     (build-system gnu-build-system)
 257     (native-inputs
 258      `(("pkg-config" ,pkg-config)))
 259     (arguments
 260      `(#:modules ((guix build gnu-build-system)
 261                     (guix build utils)
 262                     (ice-9 popen)
 263                     (ice-9 rdelim))
 264        #:phases
 265        (modify-phases %standard-phases
 266          (add-after 'install 'wrap-shroud
 267            (lambda* (#:key inputs outputs #:allow-other-keys)
 268              (let* ((out       (assoc-ref outputs "out"))
 269                     (guile (assoc-ref inputs "guile"))
 270                     (effective (read-line
 271                                 (open-pipe* OPEN_READ
 272                                             (string-append guile "/bin/guile")
 273                                             "-c" "(display (effective-version))")))
 274                     (ccachedir (string-append out
 275                                              "/lib/guile/" effective "/site-ccache"))
 276                     (prog      (string-append out "/bin/shroud")))
 277                (wrap-program prog
 278                  `("GUILE_LOAD_COMPILED_PATH" ":" prefix (,ccachedir)))
 279                #t))))))
 280     (inputs
 281      `(("guile" ,guile-2.2)
 282        ("gnupg" ,gnupg)
 283        ("xclip" ,xclip)))
 284     (synopsis "GnuPG-based secret manager")
 285     (description "Shroud is a simple secret manager with a command line
 286 interface.  The password database is stored as a Scheme s-expression and
 287 encrypted with a GnuPG key.  Secrets consist of an arbitrary number of
 288 key/value pairs, making Shroud suitable for more than just password storage.
 289 For copying and pasting secrets into web browsers and other graphical
 290 applications, there is xclip integration." )
 291     (home-page "https://dthompson.us/projects/shroud.html")
 292     (license license:gpl3+)))
 293
 294 (define-public yapet
 295   (package
 296     (name "yapet")
 297     (version "2.3")
 298     (source
 299      (origin
 300        (method url-fetch)
 301        (uri (string-append "https://yapet.guengel.ch/downloads/yapet-"
 302                            version ".tar.xz"))
 303        (sha256
 304         (base32 "1fl4s7v1psl52ndd6i7716i9f493aj8ipl6lgmraadnn5h26l3pm"))))
 305     (build-system gnu-build-system)
 306     (inputs
 307      `(("argon2" ,argon2)
 308        ("ncurses" ,ncurses)
 309        ("openssl" ,openssl)))
 310     (native-inputs
 311      `(("cppunit" ,cppunit)
 312        ("pkg-config" ,pkg-config)))
 313     (synopsis "Yet Another Password Encryption Tool")
 314     (description "YAPET is a text based password manager using the Blowfish
 315 encryption algorithm.  Because of its small footprint and very few library
 316 dependencies, it is suited for installing on desktop and server systems alike.
 317 The text based user interface allows you to run YAPET easily in a Secure Shell
 318 session.  Two companion utilities enable users to convert CSV files to YAPET
 319 and vice versa.")
 320     (home-page "http://www.guengel.ch/myapps/yapet/")
 321     (license license:gpl3+)))
 322
 323 (define-public cracklib
 324   (package
 325     (name "cracklib")
 326     (version "2.9.7")
 327     (source
 328      (origin
 329        (method url-fetch)
 330        (uri (string-append "https://github.com/cracklib/cracklib/"
 331                            "releases/download/v" version "/"
 332                            "cracklib-" version ".tar.bz2"))
 333        (sha256
 334         (base32 "1rimpjsdnmw8f5b7k558cic41p2qy2n2yrlqp5vh7mp4162hk0py"))))
 335     (build-system gnu-build-system)
 336     (arguments
 337      `(#:phases
 338        (modify-phases %standard-phases
 339          (add-after 'install 'install-dict
 340            (lambda* (#:key make-flags #:allow-other-keys)
 341              (begin
 342                (chmod (string-append "util/cracklib-format") #o755)
 343                (apply invoke "make" "dict" make-flags)
 344                #t))))))
 345     (synopsis "Password checking library")
 346     (home-page "https://github.com/cracklib/cracklib")
 347     (description
 348      "CrackLib is a library containing a C function which may be used in a
 349 @command{passwd}-like program.  The idea is simple: try to prevent users from
 350 choosing passwords that could easily be guessed (or \"cracked\") by filtering
 351 them out, at the source.")
 352     (license license:lgpl2.1)))
 353
 354 (define-public libpwquality
 355   (package
 356     (name "libpwquality")
 357     (version "1.4.2")
 358     (source (origin
 359               (method url-fetch)
 360               (uri (list
 361                     (string-append "https://github.com/libpwquality/libpwquality"
 362                                    "/releases/download/libpwquality-" version
 363                                    "/libpwquality-" version ".tar.bz2")
 364                     (string-append "https://launchpad.net/libpwquality/trunk/"
 365                                    version "/+download/"
 366                                    "libpwquality-" version ".tar.bz2")))
 367               (sha256
 368                (base32
 369                 "13hw532fmzc5xjpy75d74rlfdlxf2a8ibb4hyy9c0s92wsgf0qsj"))))
 370     (build-system gnu-build-system)
 371     (arguments
 372      ;; XXX: have RUNPATH issue.
 373      '(#:configure-flags '("--disable-python-bindings")))
 374     (inputs
 375      `(("cracklib" ,cracklib)))
 376     (synopsis "Password quality checker")
 377     (home-page "https://github.com/libpwquality/libpwquality")
 378     (description
 379      "Libpwquality is a library for password quality checking and generation of
 380 random passwords that pass the checks.")
 381     (license license:gpl2+)))
 382
 383 (define-public assword
 384   (package
 385     (name "assword")
 386     (version "0.11")
 387     (source (origin
 388               (method url-fetch)
 389               (uri (list
 390                     (string-append
 391                      "http://http.debian.net/debian/pool/main/a/assword/"
 392                      "assword_" version ".orig.tar.gz")))
 393               (sha256
 394                (base32
 395                 "03gkb6kvsghznbcw5l7nmrc6mn3ixkjd5jcs96ni4zs9l47jf7yp"))))
 396     (arguments
 397      `(;; irritatingly, tests do run but not there are two problems:
 398        ;;  - "import gtk" fails for unknown reasons here despite it the
 399        ;;    program working (indeed, I've found I have to do a logout and log
 400        ;;    back in in after an install order for some mumbo jumbo environment
 401        ;;    variable mess to work with pygtk and assword... what's up with
 402        ;;    that?)
 403        ;;  - even when the tests fail, they don't return a nonzero status,
 404        ;;    so I'm not sure how to programmatically get that information
 405        #:tests? #f
 406        #:phases
 407        (modify-phases %standard-phases
 408          (add-after 'install 'wrap-assword
 409            (lambda* (#:key outputs #:allow-other-keys)
 410              (let ((prog            (string-append
 411                                      (assoc-ref outputs "out")
 412                                      "/bin/assword"))
 413                    (gi-typelib-path (getenv "GI_TYPELIB_PATH")))
 414                (wrap-program prog
 415                  `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))
 416                #t)))
 417          (add-after 'install 'manpage
 418            (lambda* (#:key outputs #:allow-other-keys)
 419              ;; Without this substitution, it fails with
 420              ;; ImportError: No module named 'gpg'
 421              (substitute* "Makefile"
 422                (("PYTHONPATH=.") ""))
 423              (invoke "make" "assword.1")
 424              (install-file
 425               "assword.1"
 426               (string-append (assoc-ref outputs "out") "/share/man/man1")))))))
 427     (build-system python-build-system)
 428     (native-inputs
 429      `(("txt2man" ,txt2man)))
 430     (inputs
 431      `(("gtk+" ,gtk+)
 432        ("python-xdo" ,python-xdo)
 433        ("python-gpg" ,python-gpg)
 434        ("python-pygobject" ,python-pygobject)))
 435     (propagated-inputs
 436      `(("xclip" ,xclip)))
 437     (home-page "https://finestructure.net/assword/")
 438     (synopsis "Password manager")
 439     (description "assword is a simple password manager using GPG-wrapped
 440 JSON files.  It has a command line interface as well as a very simple
 441 graphical interface, which can even \"type\" your passwords into
 442 any X11 window.")
 443     (license license:gpl3+)))
 444
 445 (define-public password-store
 446   (package
 447     (name "password-store")
 448     (version "1.7.3")
 449     (source (origin
 450               (method url-fetch)
 451               (uri
 452                (string-append "https://git.zx2c4.com/password-store/snapshot/"
 453                               name "-" version ".tar.xz"))
 454               (sha256
 455                (base32
 456                 "1x53k5dn3cdmvy8m4fqdld4hji5n676ksl0ql4armkmsds26av1b"))))
 457     (build-system gnu-build-system)
 458     (arguments
 459      '(#:phases
 460        (modify-phases %standard-phases
 461          (delete 'configure)
 462          (delete 'build)
 463          (add-before 'install 'patch-system-extension-dir
 464            (lambda* (#:key outputs #:allow-other-keys)
 465              (let* ((out (assoc-ref outputs "out"))
 466                     (extension-dir (string-append out "/lib/password-store/extensions")))
 467                (substitute* "src/password-store.sh"
 468                  (("^SYSTEM_EXTENSION_DIR=.*$")
 469                   ;; lead with whitespace to prevent 'make install' from
 470                   ;; overwriting it again
 471                   (string-append " SYSTEM_EXTENSION_DIR=\""
 472                                  "${PASSWORD_STORE_SYSTEM_EXTENSION_DIR:-"
 473                                  extension-dir
 474                                  "}\"\n"))))
 475              #t))
 476          (add-before 'install 'patch-passmenu-path
 477            (lambda* (#:key inputs #:allow-other-keys)
 478              (substitute* "contrib/dmenu/passmenu"
 479                (("dmenu") (string-append (assoc-ref inputs "dmenu")
 480                                          "/bin/dmenu"))
 481                (("xdotool") (string-append (assoc-ref inputs "xdotool")
 482                                            "/bin/xdotool")))
 483              #t))
 484          (add-after 'install 'install-passmenu
 485            (lambda* (#:key outputs #:allow-other-keys)
 486              (let* ((out (assoc-ref outputs "out"))
 487                     (bin (string-append out "/bin")))
 488                (install-file "contrib/dmenu/passmenu" bin)
 489                #t)))
 490          (add-after 'install 'wrap-path
 491            (lambda* (#:key inputs outputs #:allow-other-keys)
 492              (let ((out (assoc-ref outputs "out"))
 493                    (path (map (lambda (pkg)
 494                                 (string-append (assoc-ref inputs pkg) "/bin"))
 495                               '("coreutils" "getopt" "git" "gnupg" "qrencode"
 496                                 "sed" "tree" "which" "xclip"))))
 497                (wrap-program (string-append out "/bin/pass")
 498                  `("PATH" ":" prefix (,(string-join path ":"))))
 499                #t)))
 500          (add-after 'wrap-path 'install-shell-completions
 501            (lambda* (#:key outputs #:allow-other-keys)
 502              (let* ((out      (assoc-ref outputs "out"))
 503                     (bashcomp (string-append out "/etc/bash_completion.d")))
 504                ;; TODO: install fish and zsh completions.
 505                (mkdir-p bashcomp)
 506                (copy-file "src/completion/pass.bash-completion"
 507                           (string-append bashcomp "/pass"))
 508                #t))))
 509        #:make-flags (list "CC=gcc" (string-append "PREFIX=" %output))
 510        ;; Parallel tests may cause a race condition leading to a
 511        ;; timeout in some circumstances.
 512        #:parallel-tests? #f
 513        #:test-target "test"))
 514     (native-search-paths
 515      (list (search-path-specification
 516             (variable "PASSWORD_STORE_SYSTEM_EXTENSION_DIR")
 517             (separator #f)                        ;single entry
 518             (files '("lib/password-store/extensions")))))
 519     (inputs
 520      `(("dmenu" ,dmenu)
 521        ("getopt" ,util-linux)
 522        ("git" ,git)
 523        ("gnupg" ,gnupg)
 524        ("qrencode" ,qrencode)
 525        ("sed" ,sed)
 526        ("tree" ,tree)
 527        ("which" ,which)
 528        ("xclip" ,xclip)
 529        ("xdotool" ,xdotool)))
 530     (home-page "https://www.passwordstore.org/")
 531     (synopsis "Encrypted password manager")
 532     (description "Password-store is a password manager which uses GnuPG to
 533 store and retrieve passwords.  The tool stores each password in its own
 534 GnuPG-encrypted file, allowing the program to be simple yet secure.
 535 Synchronization is possible using the integrated git support, which commits
 536 changes to your password database to a git repository that can be managed
 537 through the pass command.")
 538     (license license:gpl2+)))
 539
 540 (define-public pass-otp
 541   (package
 542     (name "pass-otp")
 543     (version "1.2.0")
 544     (source
 545      (origin
 546        (method url-fetch)
 547        (uri
 548         (string-append "https://github.com/tadfisher/pass-otp/releases/"
 549                        "download/v" version "/pass-otp-" version ".tar.gz"))
 550        (sha256
 551         (base32
 552          "0rrs3iazq80dn0wbl20xkh270428jd8l99m5gd7hl93s4r4sc82p"))))
 553     (build-system gnu-build-system)
 554     (arguments
 555      '(#:make-flags
 556        (let* ((out      (assoc-ref %outputs "out"))
 557               (bashcomp (string-append out "/etc/bash_completion.d")))
 558          (list (string-append "PREFIX=" %output)
 559                (string-append "BASHCOMPDIR=" bashcomp)))
 560        #:phases
 561        (modify-phases %standard-phases
 562          (delete 'configure)
 563          (add-after 'build 'patch-oath-path
 564            (lambda* (#:key inputs #:allow-other-keys)
 565              (substitute* "otp.bash"
 566                (("^OATH=.*$")
 567                 (string-append
 568                  "OATH="
 569                  (assoc-ref inputs "oath-toolkit")
 570                  "/bin/oathtool\n")))
 571              #t)))
 572        #:test-target "test"))
 573     (inputs
 574      `(("oath-toolkit" ,oath-toolkit)))
 575     (native-inputs
 576      `(("password-store" ,password-store)
 577        ("expect" ,expect)
 578        ("git" ,git)
 579        ("gnupg" ,gnupg)
 580        ("which" ,which)))
 581     (home-page "https://github.com/tadfisher/pass-otp")
 582     (synopsis "Pass extension for managing one-time-password (OTP) tokens")
 583     (description
 584      "Pass OTP is an extension for password-store that allows adding
 585 one-time-password (OTP) secrets, generating OTP codes, and displaying secret
 586 key URIs using the standard otpauth:// scheme.")
 587     (license license:gpl3+)))
 588
 589 (define-public qtpass
 590   (package
 591     (name "qtpass")
 592     (version "1.2.3")
 593     (source
 594      (origin
 595        (method git-fetch)
 596        (uri (git-reference
 597              (url "https://github.com/IJHack/QtPass.git")
 598              (commit (string-append "v" version))))
 599        (file-name (git-file-name name version))
 600        (sha256
 601         (base32
 602          "1vfhfyccrxq9snyvayqfzm5rqik8ny2gysyv7nipc91kvhq3bhky"))))
 603     (build-system gnu-build-system)
 604     (arguments
 605      `(#:phases
 606        (modify-phases %standard-phases
 607          (replace 'configure
 608            (lambda* (#:key inputs outputs #:allow-other-keys)
 609              (let ((out (assoc-ref outputs "out")))
 610                ;; lupdate/lrelease need to find qmake.
 611                (setenv "QMAKE" "qmake")
 612                ;; qmake needs to find lrelease/lupdate.
 613                (invoke "qmake"
 614                        "QMAKE_LRELEASE=lrelease"
 615                        "QMAKE_LUPDATE=lupdate"
 616                        (string-append "PREFIX=" out)))))
 617          (add-after 'configure 'reset-resource-timestamps
 618            ;; Reset timestamps on localization files for a reproducible build.
 619            (lambda _
 620              (with-directory-excursion "localization"
 621                (for-each (lambda (file)
 622                            (let* ((base (basename file ".qm"))
 623                                   (src (string-append base ".ts"))
 624                                   (st (stat src)))
 625                              (set-file-time file st)))
 626                          (find-files "." ".*\\.qm")))
 627              #t))
 628          (add-after 'install 'install-auxilliary
 629            ;; Install man-page, icon and .desktop file.
 630            (lambda* (#:key inputs outputs #:allow-other-keys)
 631              (let* ((out (assoc-ref outputs "out"))
 632                     (applications (string-append out "/share/applications"))
 633                     (icons (string-append out "/share/icons/hicolor/scalable/apps"))
 634                     (man (string-append out "/share/man/man1")))
 635                (install-file "qtpass.desktop" applications)
 636                (install-file "artwork/icon.svg" icons)
 637                (rename-file (string-append icons "/icon.svg")
 638                             (string-append icons "/qtpass-icon.svg"))
 639                (install-file "qtpass.1" man)
 640                #t)))
 641          (add-before 'check 'check-setup
 642            ;; Make Qt render "offscreen", required for tests.
 643            (lambda _
 644              (setenv "QT_QPA_PLATFORM" "offscreen")
 645              #t)))))
 646     (native-inputs
 647      `(("qttools" ,qttools)))
 648     (inputs
 649      `(("qtbase" ,qtbase)
 650        ("qtsvg" ,qtsvg)))
 651     (home-page "https://qtpass.org")
 652     (synopsis "GUI for password manager password-store")
 653     (description
 654      "Qt-based graphical user interface for the password manager
 655 password-store also known as pass.  Can use either pass or gpg to interact
 656 with password-store files.  Features configurable password generation,
 657 templates, clipboard handling, and per folder settings for multi-recipient
 658 encryption.")
 659     (license license:gpl3+)))
 660
 661 (define-public rofi-pass
 662   (package
 663     (name "rofi-pass")
 664     (version "2.0.2")
 665     (source
 666      (origin
 667        (method url-fetch)
 668        (uri
 669         (string-append "https://raw.githubusercontent.com/carnager/rofi-pass/"
 670                        version "/rofi-pass"))
 671        (sha256
 672         (base32 "0msldkndqp40nx1s5s7ggcr97ir4nshpmnyzvj5hqw1l7m3gvw6j"))
 673        (file-name name)))
 674     (build-system trivial-build-system)
 675     (arguments
 676      `(#:modules ((guix build utils))
 677        #:builder
 678        (begin
 679          (use-modules (guix build utils))
 680          (let ((source (string-append (assoc-ref %build-inputs "source")))
 681                (script "rofi-pass")
 682                (out (assoc-ref %outputs "out")))
 683            (copy-file source script)
 684            (chmod script #o555)
 685            (install-file script (string-append out "/bin"))))))
 686     (propagated-inputs
 687      `(("password-store" ,password-store)
 688        ("rofi" ,rofi)
 689        ("xdotool" ,xdotool)))
 690     (home-page "https://github.com/carnager/rofi-pass")
 691     (synopsis "Rofi frontend for password-store")
 692     (description "Rofi-pass provides a way to manipulate information stored
 693 using password-store through rofi interface:
 694 @enumerate
 695 @item open URLs of entries with hotkey;
 696 @item type any field from entry;
 697 @item auto-typing of user and/or password fields;
 698 @item auto-typing username based on path;
 699 @item auto-typing of more than one field, using the autotype entry;
 700 @item bookmarks mode (open stored URLs in browser, default: Alt+x).
 701 @end enumerate")
 702     (license license:gpl3)))
 703
 704 (define-public argon2
 705   (package
 706     (name "argon2")
 707     (version "20171227")
 708     (source
 709      (origin
 710        (method url-fetch)
 711        (uri
 712         (string-append "https://github.com/P-H-C/phc-winner-argon2/archive/"
 713                        version ".tar.gz"))
 714        (file-name (string-append name "-" version ".tar.gz"))
 715        (sha256
 716         (base32
 717          "1n6w5y3va7lrcym7cxr0nikapldqm80wxjdns584bvplq5r03spa"))))
 718     (build-system gnu-build-system)
 719     (arguments
 720      `(#:test-target "test"
 721        #:make-flags '("CC=gcc"
 722                       "OPTTEST=1")     ;disable CPU optimization
 723        #:phases
 724        (modify-phases %standard-phases
 725          (add-after 'unpack 'patch-Makefile
 726            (lambda* (#:key outputs #:allow-other-keys)
 727              (let ((out (assoc-ref outputs "out")))
 728                (substitute* "Makefile"
 729                  (("PREFIX = /usr") (string-append "PREFIX = " out)))
 730                (substitute* "libargon2.pc"
 731                  (("prefix=/usr") (string-append "prefix=" out))
 732                  (("@HOST_MULTIARCH@") "")
 733                  (("@UPSTREAM_VER@") ,version))
 734                #t)))
 735          (delete 'configure)
 736          (add-after 'install 'install-argon2.pc
 737            (lambda* (#:key outputs #:allow-other-keys)
 738              (let ((out (assoc-ref outputs "out")))
 739                (install-file "libargon2.pc"
 740                              (string-append out "/lib/pkgconfig"))
 741                #t))))))
 742     (home-page "https://www.argon2.com/")
 743     (synopsis "Password hashing library")
 744     (description "Argon2 provides a key derivation function that was declared
 745 winner of the 2015 Password Hashing Competition.")
 746     ;; Argon2 is dual licensed under CC0 and ASL 2.0.  Some of the source
 747     ;; files are CC0 only; see README.md and LICENSE for details.
 748     (license (list license:cc0 license:asl2.0))))
 749
 750 (define-public pass-git-helper
 751   (package
 752     (name "pass-git-helper")
 753     (version "0.3.1")
 754     (source
 755      (origin
 756        (method url-fetch)
 757        (uri (string-append "https://github.com/languitar/pass-git-helper/archive/release-"
 758                            version ".tar.gz"))
 759        (sha256
 760         (base32
 761          "0lz5ncy44pz7z1j2nnyildx8sq33zi3xvg5nkwg25n11nasqh2xn"))))
 762     (build-system python-build-system)
 763     (arguments
 764      `(#:phases
 765        (modify-phases %standard-phases
 766          (add-before 'build 'patch-pass-path
 767            (lambda* (#:key inputs #:allow-other-keys)
 768              (let* ((password-store (assoc-ref inputs "password-store"))
 769                     (pass (string-append password-store "/bin/pass")))
 770                (substitute* "pass-git-helper"
 771                  (("'pass'") (string-append "'" pass "'")))
 772                #t))))))
 773     (inputs
 774      `(("python-pyxdg" ,python-pyxdg)
 775        ("password-store" ,password-store)))
 776     (home-page "https://github.com/languitar/pass-git-helper")
 777     (synopsis "Git credential helper interfacing with pass")
 778     (description "pass-git-helper is a git credential helper which allows to
 779 use pass, the standard unix password manager, as the credential backend for
 780 your git repositories.  This is achieved by explicitly defining mappings
 781 between hosts and entries in the password store.")
 782     (license license:lgpl3+)))
 783
 784 (define-public john-the-ripper-jumbo
 785   (let ((official-version "1.9.0")
 786         (jumbo-version "1"))
 787     (package
 788       (name "john-the-ripper-jumbo")
 789       (version (string-append official-version "-" jumbo-version))
 790       (source
 791        (origin
 792          (method url-fetch)
 793          (uri (string-append "http://www.openwall.com/john/j/john-"
 794                              official-version "-jumbo-" jumbo-version ".tar.xz"))
 795          (sha256
 796           (base32
 797            "0fvz3v41hnaiv1ggpxanfykyfjq79cwp9qcqqn63vic357w27lgm"))))
 798       (build-system gnu-build-system)
 799       (native-inputs
 800        `(("perl" ,perl)))
 801       (inputs
 802        `(("gmp" ,gmp)
 803          ("libpcap" ,libpcap)
 804          ("nss" ,nss)
 805          ("openssl" ,openssl-1.0)
 806          ("python" ,python-2)           ; For "python" and "python2" shebangs
 807          ("ruby" ,ruby)                 ; For genincstats.rb
 808          ("zlib" ,zlib)))
 809       (arguments
 810        `(#:configure-flags
 811          (list "--with-systemwide"
 812                ;; Do not test for instruction set in configure, and do not
 813                ;; pass '-march=native' to gcc:
 814                "--disable-native-tests"
 815                "--disable-native-march"
 816                ,(string-append
 817                  "--enable-simd="
 818                  (let ((system (or (%current-target-system)
 819                                    (%current-system))))
 820                    (cond
 821                     ((or (string-prefix? "x86_64" system)
 822                          (string-prefix? "i686" system)) "sse2")
 823                     ((string-prefix? "aarch" system) "neon")
 824                     (else "no")))))
 825          #:phases
 826          (modify-phases %standard-phases
 827            (add-before 'configure 'chdir-src
 828              (lambda _ (chdir "src") #t))
 829            (replace 'install
 830              (lambda _
 831                (let ((bindir (string-append %output "/bin"))
 832                      (docdir (string-append %output "/share/doc/john"))
 833                      (execdir (string-append %output "/libexec/john"))
 834                      (datadir (string-append %output "/share/john"))
 835                      (install-file-to (lambda (dir)
 836                                         (lambda (f) (install-file f dir))))
 837                      (symlink? (lambda (_ s) (eq? (stat:type s) 'symlink))))
 838                  (with-directory-excursion "../run"
 839                    (for-each (install-file-to bindir)
 840                              (cons*
 841                               "john" "makechr" "cprepair" "SIPdump" "tgtsnarf"
 842                               "genmkvpwd" "mkvcalcproba" "calc_stat" "raw2dyna"
 843                               (find-files "." "(to|2)?john(-[^.]*)?$")))
 844                    (for-each (lambda (f) ; Install symlinked aliases
 845                                (let ((tgt (string-append bindir "/" (basename f))))
 846                                  ;; The use of install-file above dereferences
 847                                  ;; symlinks.  We'd rather have the symlinks
 848                                  ;; for clarity, so remove tgt before linking.
 849                                  (when (file-exists? tgt) (delete-file tgt))
 850                                  (symlink "john" tgt)))
 851                              (find-files "." symlink?))
 852                    (for-each (install-file-to execdir)
 853                              (cons* "mailer" "benchmark-unify" "relbench"
 854                                     (find-files "." ".*\\.js")))
 855                    (for-each (lambda (f)
 856                                (let* ((base (basename f))
 857                                       (name (substring base 0 (string-index base #\.)))
 858                                       (link (string-append bindir "/" name)))
 859                                  (install-file f execdir)
 860                                  (when (and (executable-file? f)
 861                                             (not (file-exists? link)))
 862                                    (symlink (string-append execdir "/" base) link))))
 863                              (find-files "." ".*\\.(pl|py|rb|lua)"))
 864                    (for-each (install-file-to datadir)
 865                              (append (find-files "." "(stats|dictionary.*)")
 866                                      (find-files "." "(.*\\.chr|.*\\.lst)")
 867                                      (find-files "." ".*\\.conf")))
 868                    (copy-recursively "rules" (string-append datadir "/rules")))
 869                  (copy-recursively "../doc" docdir)
 870                  #t)))
 871            (delete 'check) ; Tests need installed .conf files; move after install
 872            (add-after 'install 'check
 873              (lambda args
 874                (setenv "HOME" "/tmp")   ; Some tests need to write to ~/.john
 875                (setenv "OMP_NUM_THREADS" (number->string (parallel-job-count)))
 876                (apply (assoc-ref %standard-phases 'check) args))))))
 877       (home-page "http://www.openwall.com/john/")
 878       (synopsis "Password cracker")
 879       (description "John the Ripper is a fast password cracker.  Its primary
 880 purpose is to detect weak Unix passwords.  Besides several @code{crypt}
 881 password hash types most commonly found on various Unix systems, supported out
 882 of the box are Windows LM hashes, plus lots of other hashes and ciphers.  This
 883 is the community-enhanced, \"jumbo\" version of John the Ripper.")
 884       (license license:gpl2+))))
 885
 886 (define-public sala
 887   (package
 888     (name "sala")
 889     (version "1.3")
 890     (source
 891      (origin
 892        (method url-fetch)
 893        (uri (pypi-uri "sala" version))
 894        (sha256
 895         (base32
 896          "13qgmc3i2a0cqp8jqrfl93lnphfagb32pgfikc1gza2a14asxzi8"))))
 897     (build-system python-build-system)
 898     (arguments
 899      ;; Sala is supposed to work with Python 3.2 or higher,
 900      ;; but it doesn't work with Python 3.6. Better stick
 901      ;; to Python 2, which works fine.
 902      `(#:python ,python-2))
 903     (propagated-inputs
 904      `(("gnupg" ,gnupg)
 905        ("pwgen" ,pwgen)))
 906     (home-page "http://www.digip.org/sala/")
 907     (synopsis "Encrypted plaintext password store")
 908     (description
 909      "Store passwords and other bits of sensitive plain-text information
 910 to encrypted files on a directory hierarchy.  The information is protected
 911 by GnuPG's symmetrical encryption.")
 912     (license license:expat)))
 913
 914 (define-public fpm2
 915   (package
 916     (name "fpm2")
 917     (version "0.79")
 918     (source (origin
 919               (method url-fetch)
 920               (uri (string-append "https://als.regnet.cz/fpm2/download/fpm2-"
 921                                   version ".tar.bz2"))
 922               (sha256
 923                (base32
 924                 "19sdy1lygfhkg5nxi2w9a4d9kwvw24nxp0ix0p0lz91qpvk9qpnm"))))
 925     (build-system gnu-build-system)
 926     (inputs `(("gtk2" ,gtk+-2)
 927               ("gnupg" ,gnupg)
 928               ("libxml2" ,libxml2)))
 929     (native-inputs `(("pkg-config" ,pkg-config)
 930                      ("intltool" ,intltool)))
 931     (arguments
 932      `(#:phases
 933        (modify-phases %standard-phases
 934          (add-before 'configure 'pre-configure
 935            ;; The file po/POTFILES.in ends up missing for some reason in
 936            ;; both nix and guix builds. Adding the file with contents
 937            ;; found during troubleshooting.
 938            (lambda _
 939              (call-with-output-file "po/POTFILES.in"
 940                (lambda (port)
 941                  (format port "data/fpm2.desktop.in
 942 data/fpm2.desktop.in.in
 943 fpm2.glade
 944 src/callbacks.c
 945 src/fpm.c
 946 src/fpm_file.c
 947 src/interface.c
 948 src/support.c
 949 fpm2.glade
 950 ")))
 951              #t)))))
 952     (synopsis "Manage, generate and store passwords encrypted")
 953     (description "FPM2 is GTK2 port from Figaro's Password Manager
 954 originally developed by John Conneely, with some new enhancements.
 955
 956 Upstream development seems to have stopped.  It is therefore recommended
 957 to use a different password manager.")
 958     (home-page "https://als.regnet.cz/fpm2/")
 959     (license license:gpl2+)))
 960
 961 (define-public pass-rotate
 962   (package
 963     (name "pass-rotate")
 964     (version "0.1")
 965     (source
 966      (origin
 967        (method url-fetch)
 968        (uri (string-append "https://github.com/SirCmpwn/pass-rotate/archive/"
 969                            version ".tar.gz"))
 970        (sha256
 971         (base32
 972          "1svm5nj8bczv2dg8lh2zqqhbsrljqsw9680r03qwgl9vlci90210"))
 973        (file-name (string-append name "-" version ".tar.gz"))))
 974     (build-system python-build-system)
 975     (inputs
 976      `(("python-beautifulsoup4" ,python-beautifulsoup4)
 977        ("python-docopt" ,python-docopt)
 978        ("python-html5lib" ,python-html5lib)
 979        ("python-requests" ,python-requests)))
 980     (home-page "https://github.com/SirCmpwn/pass-rotate")
 981     (synopsis "Rotate password on online services")
 982     (description "pass-rotate is a command line utility and python library for
 983 rotating passwords on various web services.  It makes it easier to rotate your
 984 passwords, one at a time or in bulk, when security events or routine upkeep of
 985 your online accounts makes it necessary.")
 986     (license license:expat)))
 987
 988 (define-public hashcat
 989   (package
 990     (name "hashcat")
 991     (version "5.1.0")
 992     (source
 993      (origin
 994        (method url-fetch)
 995        (uri (string-append "https://hashcat.net/files/hashcat-"
 996                            version ".tar.gz"))
 997        (sha256
 998         (base32
 999          "0f73y4cg8c7a6q7x34qvpfi4g3lw6j9bnn0a13g43aqyiskflfr8"))))
1000     (native-inputs
1001      `(("opencl-headers" ,opencl-headers)))
1002     (build-system gnu-build-system)
1003     (arguments
1004      '(#:tests? #f                      ;no tests
1005        #:make-flags (list (string-append "PREFIX=" %output))
1006        #:phases
1007        (modify-phases %standard-phases
1008          (delete 'configure))))
1009     (home-page "https://hashcat.net/hashcat/")
1010     (synopsis "Advanced password recovery utility")
1011     (description "Hashcat is an password recovery utility, supporting five
1012 unique modes of attack for over 200 highly-optimized hashing algorithms.
1013 Hashcat currently supports CPUs, GPUs, and other hardware accelerators on
1014 Linux, Windows, and macOS, and has facilities to help enable distributed
1015 password cracking.")
1016     (license license:expat)))
1017
1018 (define-public hashcat-utils
1019   (package
1020     (name "hashcat-utils")
1021     (version "1.9")
1022     (source
1023      (origin
1024        (method url-fetch)
1025        (uri (string-append "https://github.com/hashcat/hashcat-utils/releases/"
1026                            "download/v" version "/"
1027                            "hashcat-utils-" version ".7z"))
1028        (sha256
1029         (base32 "0kq555kb338691qd7zjmi8vhq4km3apnsl2w63zh0igwzcjx6lx1"))))
1030     (native-inputs
1031      `(("p7zip" ,p7zip)))
1032     (inputs
1033      `(("perl" ,perl)))
1034     (build-system gnu-build-system)
1035     (arguments
1036      `(#:tests? #f                      ;no tests
1037        #:make-flags (list "CC=gcc"
1038                           ;; Upstream bug(?): "make all" seems to remove the
1039                           ;; Perl scripts from the source.
1040                           "native")
1041        #:phases
1042        (modify-phases %standard-phases
1043          (replace 'unpack
1044            (lambda* (#:key source #:allow-other-keys)
1045              (invoke "7z" "x" source)
1046              (chdir (string-append "hashcat-utils-" ,version "/src"))
1047              #t))
1048          (delete 'configure)
1049          (replace 'install
1050            (lambda* (#:key outputs #:allow-other-keys)
1051              (let ((out (string-append (assoc-ref outputs "out") "/bin")))
1052                (mkdir-p out)
1053                (for-each
1054                 (lambda (file)
1055                   (copy-file file (string-append out "/"
1056                                                  (basename file ".bin"))))
1057                 (find-files "." "\\.bin$"))
1058                (for-each
1059                 (lambda (file)
1060                   (copy-file file (string-append out "/"
1061                                                  (basename file ".pl"))))
1062                 (find-files "../bin" "\\.pl$"))
1063                #t))))))
1064     (home-page "https://github.com/hashcat/hashcat-utils/")
1065     (synopsis "Small utilities that are useful in advanced password cracking")
1066     (description "Hashcat-utils are a set of small utilities that are useful
1067 in advanced password cracking.  They all are packed into multiple stand-alone
1068 binaries.  All of these utils are designed to execute only one specific
1069 function.  Since they all work with @code{STDIN} and @code{STDOUT} you can
1070 group them into chains.")
1071     (license license:expat)))