Bind Super+p in sxhkd to new script rofi_pass

4 files changed, 83 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index b832e2d9..46315bfe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -186,5 +186,6 @@
 /less/less
 /mutt/filters/markdown-to-html
 /mutt/muttrc.d/src
+/rofi/bin/rofi_pass
 /tmux/bin/tmux
 /x/xsession
diff --git a/Makefile b/Makefile
index 687d4a14..38f674e6 100644
--- a/Makefile
+++ b/Makefile
@@ -42,6 +42,7 @@
 	install-rbenv \
 	install-readline \
 	install-redshift \
+	install-rofi \
 	install-scrot \
 	install-sh \
 	install-subversion \
@@ -563,6 +564,10 @@ install-redshift: install-x
 	cp -p -- redshift/redshift.conf $(XDG_CONFIG_HOME)
 	cp -p -- redshift/xsession.d/redshift.sh $(HOME)/.xsession.d
 
+install-rofi: rofi/bin/rofi_pass
+	mkdir -p -- $(HOME)/.local/bin
+	cp -p -- rofi/bin/rofi_pass $(HOME)/.local/bin
+
 install-scrot:
 	mkdir -p -- $(XDG_DATA_HOME)/scrot/screenshots
 
diff --git a/rofi/bin/rofi_pass.sh b/rofi/bin/rofi_pass.sh
new file mode 100644
index 00000000..305143e7
--- /dev/null
+++ b/rofi/bin/rofi_pass.sh
@@ -0,0 +1,74 @@
+# Pick password from local or remote password-store with rofi's dmenu emulation
+# mode, and write it to the active X11 window.
+#
+self=rofi_pass
+
+# Abstraction to handle running shell commands (args or stdin) in either
+# a remote or local shell.  If the environment variable PASSWORD_STORE_HOST is
+# set, it's used as the destination SSH hostname to the password store.
+#
+pass_shell() {
+	[ "$#" -le 1 ] || return
+	if [ -n "$PASSWORD_STORE_HOST" ] ; then
+		ssh -o StrictHostKeyChecking=yes -T -X -- \
+			"$PASSWORD_STORE_HOST" "$@"
+	elif [ "$#" -eq 1 ] ; then
+		"${SHELL:-/bin/sh}" -c "$1"
+	else
+		"${SHELL:-/bin/sh}" -s
+	fi
+}
+
+# Get a list of all the password paths, relative to the password store root,
+# including leading dot-slash and trailing .gpg extension.
+#
+get_paths() {
+	pass_shell <<-'EOF'
+		dir=${PASSWORD_STORE_DIR:-"$HOME"/.password-store}
+		cd -- "$dir" || exit
+		find . -name \*.gpg -type f || exit
+	EOF
+}
+
+# Get a list of all the password names, bytewise-sorted, with leading dot-slash
+# and trailing .gpg extension removed.
+#
+get_names() {
+	get_paths |
+		sed -e 's_^[.]/__' -e 's_[.]gpg$__' |
+		LC_COLLATE=C sort -f
+}
+
+get_password() {
+	name=$1
+	[ -n "$name" ] || return
+	printf '%s\n' "$name" |
+		pass_shell 'IFS= read -r name ; pass show "$name"' |
+		head -n 1
+}
+
+# Apply rofi -dmenu to pick a password name.  Use case-insensitive matching,
+# and don't accept arbitrary input.
+#
+name=$(get_names | rofi -dmenu -i -only_match -p pass) || exit
+[ -n "$name" ] || exit
+
+# Write the password name to a shell to retrieve it, read its first line, and
+# have xdotool write that as if the keyboard; write the name safely to the
+# command's input rather than as an argument.
+#
+password=$(get_password "$name") || exit
+[ -n "$password" ] || exit
+
+# Have xdotool type the password, receiving it on its standard input rather
+# than its arguments, for security.
+#
+printf %s "$password" |
+	xdotool type --clearmodifiers --delay=0 --file - \
+	|| exit
+
+# Tell the user we wrote the password out, in case they're typing a password
+# into a field with echo turned off.
+#
+notify-send --app-name="$self" --icon=gcr-password -- \
+	'Password typed' "$name"
diff --git a/sxhkd/sxhkdrc b/sxhkd/sxhkdrc
index 3864b84f..0e682dce 100644
--- a/sxhkd/sxhkdrc
+++ b/sxhkd/sxhkdrc
@@ -19,6 +19,9 @@ super + i
 super + m
 	exec x-terminal-emulator -e tm
 
+super + p
+	exec rofi_pass
+
 super + t
 	exec thunar