allow piped PIN input

Cargo.toml

@@ -25,6 +25,7 @@ serde_derive = "1.0.116"
 serde = "1.0.116"
 anyhow = "1.0.56"
 ctap-hid-fido2 = "3.4.1"
+atty = "0.2"
 
 [build-dependencies]
 hex = "0.3.2"
@@ -34,6 +35,7 @@ rpassword = "4.0.1"
 libcryptsetup-rs = "0.9.1"
 structopt = "0.3.2"
 anyhow = "1.0.56"
+atty = "0.2"
 
 [profile.release]
 lto = true

src/util.rs

@@ -3,6 +3,7 @@ use ring::digest;
 use std::fs::File;
 use std::io::Read;
 use std::path::PathBuf;
+use std::io::{self, BufRead};
 
 pub fn sha256(messages: &[&[u8]]) -> [u8; 32] {
     let mut digest = digest::Context::new(&digest::SHA256);
@@ -17,18 +18,23 @@ pub fn read_password_tty(q: &str, verify: bool) -> Fido2LuksResult<String> {
     read_password(q, verify, true)
 }
 pub fn read_password(q: &str, verify: bool, tty: bool) -> Fido2LuksResult<String> {
-    let res = if tty {
+    // Check if the standard input is a TTY (interactive) or piped
+    let is_tty = atty::is(atty::Stream::Stdin);
+
+    // Read password depending on TTY status
+    let res = if tty && is_tty {
         rpassword::read_password_from_tty(Some(&[q, ": "].join("")))
     } else {
-        print!("{}: ", q);
-        rpassword::read_password()
+        // Use stdin directly if it's not a TTY (e.g., piped input)
+        println!("{}: ", q);
+        let mut input = String::new();
+        io::stdin().lock().read_line(&mut input)?;
+        Ok(input.trim().to_string())
     }?;
+
+    // Handle verification if needed
     match res {
-        ref pass
-            if verify
-                && &rpassword::read_password_from_tty(Some(&[q, "(again): "].join(" ")))?
-                    != pass =>
-        {
+        ref pass if verify && is_tty && &rpassword::read_password_from_tty(Some(&[q, "(again): "].join(" ")))? != pass => {
             Err(Fido2LuksError::AskPassError {
                 cause: AskPassError::Mismatch,
             })