MaterialPass

A secure, beautiful Material 3 askpass implementation for Linux (X11/Wayland).

MaterialPass was built specifically to empower AI coding assistants (like Gemini CLI, Claude Code, or Codex) to execute sudo commands safely via per-command GUI confirmation. However, it serves equally well as a general-purpose askpass for any user seeking a modern, secure, and aesthetic alternative to standard system dialogs.

MaterialPass provides a secure GUI confirmation dialog for sudo and other tools that use SUDO_ASKPASS. It encrypts your password using your existing SSH keys and provides a modern Material 3 interface.

Features

• Material 3 UI: Clean, modern confirmation dialog using QML and PySide6.
• SSH Key Encryption:
  • Ed25519: Uses age for modern encryption.
  • RSA/ECDSA/DSA: Uses OpenSSL asymmetric encryption.
• Multi-layered Security:
  • Path-based call restrictions.
  • Process allow-listing.
  • Rate limiting and lockout.
  • Secure memory clearing.
• Headless Support: TOTP-based confirmation for SSH/headless sessions.
• Fallback Support: Gracefully falls back to GTK4 (Adwaita), GTK3, or Zenity if QML is unavailable.

Installation

1. Dependencies

• Python 3
• Age: Required for Ed25519 keys (sudo pacman -S age or sudo apt install age).
• PySide6: Required for the Material UI (pip install PySide6).
• Qcm.Material: The QML module for Material 3 components.

2. Setup

1. Clone the repository:

   git clone ssh://git@code.milfs.party:2222/alex/MaterialPass.git
   cd MaterialPass
   

2. Run the setup script:

   ./setup.sh
   

3. Configure your shell: Add this to your .bashrc, .zshrc, or fish.config:

   export SUDO_ASKPASS="/path/to/MaterialPass/askpass"
   

4. Store your password:

   ./askpass-manager set
   

Usage

Use sudo -A to trigger the askpass helper:

sudo -A pacman -Syu

Commands

• ./askpass-manager set: Store your password securely.
• ./askpass-manager clear: Remove stored credentials.
• ./askpass-manager test: Test the integration.
• ./askpass-manager totp-setup: Configure TOTP for headless usage.

Configuration

Edit askpass-config.json to customize behavior:

• require_user_confirmation: Enable/disable the GUI dialog.
• allowed_processes: List of binaries permitted to trigger askpass.
• expiration_hours: How long the password remains valid.

License

MIT License. See LICENSE for details.