Skip to content

age-plugin-se: init at 0.1.4#382902

Merged
phaer merged 1 commit intoNixOS:masterfrom
onnimonni:add-age-plugin-se
Apr 23, 2025
Merged

age-plugin-se: init at 0.1.4#382902
phaer merged 1 commit intoNixOS:masterfrom
onnimonni:add-age-plugin-se

Conversation

@onnimonni
Copy link
Contributor

@onnimonni onnimonni commented Feb 17, 2025

Added a plugin for age to create and use private keys using Apple's secure enclave coprocessor. This is my first time packaging anything into nix but I was able to see how others were using swift-crypto and swift programs in general and the make flags from corresponding homebrew formula.

Please teach me if there's a better way to reference the swift-crypto dependency.

I builded this on my machine and it works fine. Closes #382877.

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@NixOSInfra NixOSInfra added the 12.first-time contribution This PR is the author's first one; please be gentle! label Feb 17, 2025
@onnimonni onnimonni force-pushed the add-age-plugin-se branch 2 times, most recently from bd67aa3 to 7ca3a92 Compare February 17, 2025 20:06
@onnimonni
Copy link
Contributor Author

@remko I mentioned you in the maintainers. Let me know if you don't want to be mentioned there. Thanks again for providing this nice piece of software and hopefully this small PR will allow using it for even wider audience 👌

@github-actions github-actions bot added 8.has: maintainer-list (update) This PR changes `maintainers/maintainer-list.nix` 10.rebuild-darwin: 1 This PR causes 1 package to rebuild on Darwin. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 1 This PR causes 1 package to rebuild on Linux. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Feb 17, 2025
@onnimonni
Copy link
Contributor Author

@Kranzes I saw that you commented on the earlier PR on age-plugin-se and I'm wondering if you would want to look at this one as well.

I'm now building the plugin directly from source instead of downloading the binary like you suggested here.

@nixos-discourse
Copy link

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/how-to-get-a-new-package-merged-into-nixpkgs/60900/1

@elikoga
Copy link
Contributor

elikoga commented Feb 26, 2025

I am not sure wether remko belongs into the maintainers field

@oddlama
Copy link
Member

oddlama commented Feb 26, 2025

@remko I mentioned you in the maintainers. Let me know if you don't want to be mentioned there. Thanks again for providing this nice piece of software and hopefully this small PR will allow using it for even wider audience 👌

I don't think you should add the creator of original software as a maintainer in nixpkgs unless they actually want to maintain this nixpkgs package. Correct me if I'm wrong but from a quick look at their profile I don't think remko is using Nix.

@onnimonni
Copy link
Contributor Author

onnimonni commented Feb 26, 2025

Hey, I pinged him above and he reacted with the heart emoji ❤️ 5 minutes later with his other account https://github.com/remko-bw so I assumed it was okay for him.

I'm happy to remove him and do to the maintenance myself if this is a blocker 👍.

Again this is my first contribution so I apologize if I'm not able to follow all conventions and please teach me 🙇

EDIT: added 3 missing words (sorry for my dyslexia)

@onnimonni
Copy link
Contributor Author

Correct me if I'm wrong but from a quick look at their profile I don't think remko is using Nix.

Yes I'm highly confident that he is not using Nix 👍

@eclairevoyant
Copy link
Contributor

I don't know of any guideline that requires that they use nix; the idea of the "maintainer" field is that they are pinged whenever there are PRs on the package and can help with the packaging.

If the upstream is willing to do that, I see no issue having them as a maintainer here 🤷

Copy link
Contributor

@eclairevoyant eclairevoyant left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, please change your commit and PR title to be lower-case, nix is case sensitive and the name of the commit is used by CI to build/test the package.

@ofborg build age-plugin-se

@onnimonni onnimonni changed the title Age-plugin-se: init at 0.1.4 age-plugin-se: init at 0.1.4 Feb 26, 2025
@onnimonni
Copy link
Contributor Author

Thanks @eclairevoyant for taking the time from your day. You gave very pleasant feedback which helped me to learn and I really wish I can be helpful in this community in return. If I ever see you IRL I'm happy to offer a beer or soda to you 🍻🥤🤝.

@eclairevoyant
Copy link
Contributor

btw I don't have merge access, so a committer would have to review and merge

@wegank wegank added the 12.approvals: 1 This PR was reviewed and approved by one person. label Feb 26, 2025
@nixos-discourse
Copy link

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-already-reviewed/2617/2282

@FliegendeWurst FliegendeWurst added the 8.has: package (new) This PR adds a new package label Mar 12, 2025
@FliegendeWurst
Copy link
Member

I get a build error: https://paste.fliegendewurst.eu/jEnz8b

error: Invalid manifest (compiled with: ["/nix/store/3zy8cys6ar5m5400928wh69sw2ayg55a-swift-wrapper-5.8/bin/swiftc", "-vfsoverlay", "/build/TemporaryDirectory.tM3i46/vfs.yaml", "-L", "/nix/store/66bzf0bkzbsk8iwk55i89nsxbd112p0w-swiftpm-5.8/lib/swift/pm/ManifestAPI", "-lPackageDescription", "-Xlinker", "-rpath", "-Xlinker", "/nix/store/66bzf0bkzbsk8iwk55i89nsxbd112p0w-swiftpm-5.8/lib/swift/pm/ManifestAPI", "-swift-version", "5", "-I", "/nix/store/66bzf0bkzbsk8iwk55i89nsxbd112p0w-swiftpm-5.8/lib/swift/pm/ManifestAPI", "-package-description-version", "5.8.0", "/build/source/swift-crypto/Package.swift", "-o", "/build/TemporaryDirectory.hZJny3/swift-crypto-manifest"])
Warning: supplying the --target argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead./build/TemporaryDirectory.hZJny3/swift-crypto-manifest: error while loading shared libraries: libdispatch.so: cannot open shared object file: No such file or directory

@github-actions github-actions bot added 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. and removed 10.rebuild-linux: 1 This PR causes 1 package to rebuild on Linux. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Mar 12, 2025
@wegank wegank removed the 12.approvals: 1 This PR was reviewed and approved by one person. label Mar 12, 2025
@onnimonni
Copy link
Contributor Author

@SuperSandro2000 & @FliegendeWurst I fixed all comments you had. Anything else I should still do or would you like to approve this?

@FliegendeWurst
Copy link
Member

Formatting CI fails as:

Please format them using the Nixpkgs-specific nixfmt by going to the Nixpkgs root directory, running nix-shell, then:

nixfmt 'pkgs/by-name/ag/age-plugin-se/package.nix'

The package itself looks good to me, however I can't test it.

@eclairevoyant
Copy link
Contributor

@onnimonni Please ensure to use nixfmt-rfc-style here, from nixos-unstable or newer.

@andre4ik3
Copy link
Contributor

andre4ik3 commented Apr 16, 2025

Would it be possible to add Linux support (e.g. by repackaging with swiftpm2nix)? Currently not having Linux support means it's not possible to rekey secrets for age1se identities on Linux (even though the plugin isn't used for authentication, it's still needed for rekeying).

Also the upstream Package.swift specifies swift-crypto should be up to version 3.0.0, meaning last version before 3.0.0, meaning 2.6.0, but in the derivation it's 3.7.1. It still compiles fine since the package only allows macOS, and on macOS the dependency isn't used, but you might want to change it if adding Linux support. (Maybe this is what was causing the manifest issue when compiling on Linux?)

nevermind, upon further testing the manifest issue seems to be unrelated, and also swift-crypto 1.x, 2.x, and 3.x are all mostly API-compatible so that shouldn't be an issue. Good news though is that packaging with swiftpm2nix seems to solve the manifest issue and enable compilation on Linux :)

Also-also, if it will remain macOS only, then maybe it would be possible to patch out the swift-crypto dependency altogether, since it isn't used?

@Enzime
Copy link
Member

Enzime commented Apr 18, 2025

Can you rebase this on top of the latest nixos-unstable and add the plugin to the list inside pkgs/by-name/ag/age/package.nix?

@onnimonni
Copy link
Contributor Author

Would it be possible to add Linux support (e.g. by repackaging with swiftpm2nix)? Currently not having Linux support means it's not possible to rekey secrets for age1se identities on Linux (even though the plugin isn't used for authentication, it's still needed for rekeying).

Also the upstream Package.swift specifies swift-crypto should be up to version 3.0.0, meaning last version before 3.0.0, meaning 2.6.0, but in the derivation it's 3.7.1. It still compiles fine since the package only allows macOS, and on macOS the dependency isn't used, but you might want to change it if adding Linux support. (Maybe this is what was causing the manifest issue when compiling on Linux?)

nevermind, upon further testing the manifest issue seems to be unrelated, and also swift-crypto 1.x, 2.x, and 3.x are all mostly API-compatible so that shouldn't be an issue. Good news though is that packaging with swiftpm2nix seems to solve the manifest issue and enable compilation on Linux :)

Also-also, if it will remain macOS only, then maybe it would be possible to patch out the swift-crypto dependency altogether, since it isn't used?

This goes well beyond the scope of my current nix/age/swift understanding. I'm happy to let someone more experienced to continue from here to fulfil all of these wishes.

It seems that getting this merged is not that easy and I will just need to rely on installing it from homebrew instead. This is a bit sad since I would really want to use nix more not less.

@onnimonni
Copy link
Contributor Author

Can you rebase this on top of the latest nixos-unstable and add the plugin to the list inside pkgs/by-name/ag/age/package.nix?

Done and done. I hope I ran the nix formatter properly too and it doesn't now give errors.

$ nixfmt pkgs/by-name/ag/age-plugin-se/package.nix pkgs/by-name/ag/age/package.nix maintainers/maintainer-list.nix

@eclairevoyant
Copy link
Contributor

@andre4ik3 IMO if this package works on darwin, this can be merged as-is with further discussion on refactoring for linux later.

Copy link
Contributor

@andre4ik3 andre4ik3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good. I agree Linux support and refactoring can be done later. Other than that I've been using this for a few weeks now to manage my secrets and it's worked like a charm :)

Oh and btw the upstream swift-crypto dependency has been bumped past 3.0 as well so doesn't look like there's any compatibility issues between 2.x and 3.x.

@andre4ik3
Copy link
Contributor

andre4ik3 commented Apr 23, 2025

It seems that getting this merged is not that easy and I will just need to rely on installing it from homebrew instead. This is a bit sad since I would really want to use nix more not less.

Until it's merged you can use an overlay, e.g. something like this

(final: prev: {
  age-plugin-se = final.callPackage ./path/to/age-plugin-se/package.nix { };
})

Then simply use age-plugin-se like a normal package name everywhere else in Nix (where the overlay is applied, of course)

@eclairevoyant
Copy link
Contributor

If using an overlay, final.callPackage would be better (final should generally be preferred)

@wegank wegank added the 12.approvals: 2 This PR was reviewed and approved by two persons. label Apr 23, 2025
@phaer
Copy link
Member

phaer commented Apr 23, 2025

Merging this as It works on darwin and is marked as such. Linux support, which I do have a personal interest in, can be done in a new PR. :)

Thanks for your patience & work @onnimonni! 🎉

@phaer phaer merged commit 97bf468 into NixOS:master Apr 23, 2025
27 of 30 checks passed
@phaer phaer mentioned this pull request Apr 23, 2025
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

6.topic: darwin Running or building packages on Darwin 8.has: maintainer-list (update) This PR changes `maintainers/maintainer-list.nix` 8.has: package (new) This PR adds a new package 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-darwin: 1 This PR causes 1 package to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. 12.approvals: 2 This PR was reviewed and approved by two persons. 12.first-time contribution This PR is the author's first one; please be gentle!

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Package request: age-plugin-se