RobOS
Community Discord Channel Download

Pass Unlock Daemon

Small dialog that asks for your GPG passphrase once a day and caches it in gpg-agent.

Download RobOS Source

packages/pass-unlock

Pass Unlock is a small always-on-top window, not a background daemon. It asks for your GPG passphrase and hands it to gpg-agent, so tools that call pass do not each prompt for it.

What it does

  1. On start it checks whether the store exists (~/.password-store/.gpg-id) and whether gpg-agent already has a cached key. If the unlock time recorded today is still valid, it shows “Pass is unlocked for today” and the time.
  2. Otherwise it shows a greeting and a passphrase field. Click Unlock for Today (or press Enter) and it runs gpg-preset-passphrase --preset <keygrip> for every secret key in your keyring. A wrong passphrase shows an error and nothing is cached.
  3. On success it writes the Unix time to ~/.cache/robos/pass-unlock-time, appends <timestamp>|user|unlock|<daily-unlock> to ~/.cache/robos/pass-access.log, and closes after a few seconds.
  4. Skip - remind me later quits without unlocking.

The dialog also shows counts of secret accesses (total, by agent and by user) read from ~/.cache/robos/pass-access.log for the current date. In this repository only Pass Unlock itself writes to that file, and only for the unlock event.

Requirements

  • gpg and /usr/lib/gnupg/gpg-preset-passphrase.
  • allow-preset-passphrase in ~/.gnupg/gpg-agent.conf. Pass Manager and Security Setup Wizard write this setting when they create keys; confirm for your own key.

Pass Manager opens this dialog when its header badge shows Locked. Its Lock button clears the cache and posts a notification that links back here. A second launch of Pass Unlock focuses the existing window.

Related

More in Security & Credentials

DocuVault Desktop

Offline-first secure markdown notes, personal snippet vault, and local workstation storage starter app.

Git Login Manager

Checks that GitHub access works (gh login, SSH key, SSH connection, git identity) and walks you through fixing what fails.

Pass Manager Vault

Desktop front end for the standard Unix password store (pass), with entries encrypted by GPG.

RobOS App Mesh

Zero-Trust App & IPC Port Mesh for connecting RobOS applications across machines (mTLS 1.3, OpenZiti, Tailscale, NetBird, WireGuard)

RobOS Cloud Accounts

One list of your cloud accounts, shared with Data Sources and Google Calendar; Google accounts can sign in through the browser and be written into Thunderbird.

RobOS Hardware Keys

YubiKey & FIDO2 physical push keys, touch verification, ed25519-sk SSH keys, Passkeys, and PAM U2F security studio

RobOS Private Networks

Cross-Network Zero-Trust P2P & Relay Mesh for linking RobOS machines across separate networks/NAT/CGNAT via Mutual TLS 1.3 (robos-net://), AES-256-GCM encrypted rendezvous, bidirectional Reverse-Mux tunneling, and cross-machine RobOS Movie Player (:19215) streaming

RobOS Setup Wizard

Eleven-step first-run wizard for GPG, pass, pinentry, git identity, SSH, Chrome, GitHub login, AI agent keys and optional tools.

RobOS VPN Sandbox

Launch any desktop or CLI app inside an isolated Linux network namespace (ip netns) routed exclusively through OpenVPN with a 3-barrier kernel kill-switch.

RobOS VPN Servers

Manage OpenVPN providers (IPVanish built-in with 3,598 server profiles), encrypted VPN accounts, live TLS 1.3 credential tests, and server locations.

Security Setup Wizard

Five-step wizard that configures GPG pinentry, a GPG key, the pass store and an SSH key.