caesium: bump

caesium.home.nix

@@ -123,6 +123,76 @@ let
       echo "Review the diff in $MAP_FILE, then run nix-update to apply it."
     '';
   };
+
+  # Programs OTP slot 2 for KeePassXC HMAC-SHA1 challenge-response (see
+  # programs.keepassxc.nix). Unlike yubikey-enroll/-unenroll, this never
+  # touches the repo: the shared secret must stay off disk entirely, so it's
+  # only ever printed to the terminal for the user to record offline.
+  yubikeyChalresp = pkgs.writeShellApplication {
+    name = "yubikey-chalresp";
+    runtimeInputs = [ pkgs.yubikey-manager pkgs.openssl ];
+    text = ''
+      usage() {
+        cat >&2 <<'EOF'
+      usage:
+        yubikey-chalresp generate
+            Print one random 40-char hex secret. Record it offline (e.g. in
+            the KeePassXC database itself once it exists) -- it is never
+            written to disk by this script.
+
+        yubikey-chalresp apply <hex-secret> [--force]
+            Program the inserted YubiKey's OTP slot 2 with the given secret,
+            requiring touch to respond. Run once per key with the SAME
+            secret so any enrolled key can unlock the database. Refuses to
+            overwrite an already-programmed slot 2 unless --force is given.
+
+        yubikey-chalresp verify
+            Run a fixed test challenge against the inserted key's slot 2 and
+            print the response. Run this on every enrolled key and compare
+            the printed responses by eye -- they must all match before any
+            key is trusted with a real database.
+      EOF
+      }
+
+      require_hex_secret() {
+        local secret="$1"
+        if ! [[ "$secret" =~ ^[0-9a-fA-F]{40}$ ]]; then
+          echo "error: secret must be exactly 40 hex characters (20 bytes)" >&2
+          exit 1
+        fi
+      }
+
+      case "''${1:-}" in
+        generate)
+          openssl rand -hex 20
+          echo "Record this secret offline now -- it is the only credential" >&2
+          echo "for a hardware-key-only KeePassXC database. It was not saved" >&2
+          echo "to disk anywhere by this script." >&2
+          ;;
+        apply)
+          SECRET="''${2:-}"
+          FORCE="''${3:-}"
+          [[ -n "$SECRET" ]] || { usage; exit 1; }
+          require_hex_secret "$SECRET"
+          if ykman otp info | grep -q "Slot 2: programmed" && [[ "$FORCE" != "--force" ]]; then
+            echo "error: slot 2 is already programmed; pass --force to overwrite" >&2
+            exit 1
+          fi
+          ykman otp chalresp --touch --force 2 "$SECRET"
+          echo "Slot 2 programmed. Repeat on every other YubiKey with the same secret."
+          ;;
+        verify)
+          echo "Touch the key when it blinks..." >&2
+          ykman otp calculate 2 "deadbeef"
+          echo "Compare this response against the other enrolled keys." >&2
+          ;;
+        *)
+          usage
+          exit 1
+          ;;
+      esac
+    '';
+  };
 in
 {
 
@@ -131,6 +201,7 @@ in
     ./programs.thunderbird.nix
     ./module.accounts.nix
     ./module.evolution.nix
+    ./programs.keepassxc.nix
   ];
 
   programs.firefox.enable = true;
@@ -140,6 +211,7 @@ in
     faugus-launcher
     yubikeyEnroll
     yubikeyUnenroll
+    yubikeyChalresp
   ];
 
   services.flatpak = {