From 2e838bc3b6f8138492ae5065e6bea2ad450e4d3f Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <hi@m7.rs>
Date: Sat, 20 Dec 2025 18:09:20 -0300
Subject: [PATCH] fix(home/oama): use gpg instead of pass secret service

---
 home/gabriel/features/pass/default.nix       |   6 -
 home/gabriel/features/productivity/oama.nix  |   5 +-
 modules/home-manager/default.nix             |   1 -
 modules/home-manager/pass-secret-service.nix |  59 --------
 overlays/default.nix                         |   3 -
 overlays/pass-secret-service-native.diff     | 137 -------------------
 6 files changed, 4 insertions(+), 207 deletions(-)
 delete mode 100644 modules/home-manager/pass-secret-service.nix
 delete mode 100644 overlays/pass-secret-service-native.diff

diff --git a/home/gabriel/features/pass/default.nix b/home/gabriel/features/pass/default.nix
index 9835b44a..32b81db9 100644
--- a/home/gabriel/features/pass/default.nix
+++ b/home/gabriel/features/pass/default.nix
@@ -1,6 +1,5 @@
 {
   pkgs,
-  config,
   ...
 }: {
   programs.password-store = {
@@ -11,11 +10,6 @@
     package = pkgs.pass.withExtensions (p: [p.pass-otp]);
   };
 
-  services.pass-secret-service = {
-    enable = true;
-    extraArgs = ["-e${config.programs.password-store.package}/bin/pass"];
-  };
-
   home.persistence = {
     "/persist".directories = [".password-store"];
   };
diff --git a/home/gabriel/features/productivity/oama.nix b/home/gabriel/features/productivity/oama.nix
index 412c790f..e307c3b8 100644
--- a/home/gabriel/features/productivity/oama.nix
+++ b/home/gabriel/features/productivity/oama.nix
@@ -4,7 +4,10 @@ in {
   programs.oama = {
     enable = true;
     settings = {
-      encryption.tag = "KEYRING";
+      encryption = {
+        tag = "GPG";
+        contents = "hi@m7.rs";
+      };
       services.google = {
         client_id_cmd = "${pass} oama/google_client_id | head -1";
         client_secret_cmd = "${pass} oama/google_client_secret | head -1";
diff --git a/modules/home-manager/default.nix b/modules/home-manager/default.nix
index f224d544..07b2a5e6 100644
--- a/modules/home-manager/default.nix
+++ b/modules/home-manager/default.nix
@@ -2,7 +2,6 @@
   fonts = import ./fonts.nix;
   monitors = import ./monitors.nix;
   oama = import ./oama.nix;
-  pass-secret-service = import ./pass-secret-service.nix;
   wallpaper = import ./wallpaper.nix;
   xpo = import ./xpo.nix;
   colors = import ./colors.nix;
diff --git a/modules/home-manager/pass-secret-service.nix b/modules/home-manager/pass-secret-service.nix
deleted file mode 100644
index 480fd78d..00000000
--- a/modules/home-manager/pass-secret-service.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.services.pass-secret-service;
-in {
-  disabledModules = ["services/pass-secret-service.nix"];
-
-  meta.maintainers = with maintainers; [
-    cab404
-    cyntheticfox
-  ];
-
-  options.services.pass-secret-service = {
-    enable = mkEnableOption "Pass libsecret service";
-
-    package = mkPackageOption pkgs "pass-secret-service" {};
-
-    storePath = mkOption {
-      type = with types; nullOr str;
-      default = null;
-      defaultText = "~/.password-store";
-      example = "/home/user/.local/share/password-store";
-      description = "Absolute path to password store.";
-    };
-
-    extraArgs = lib.mkOption {
-      type = with lib.types; listOf str;
-      default = [];
-      description = "Extra command-line arguments to be passed to the service.";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    assertions = [(hm.assertions.assertPlatform "services.pass-secret-service" pkgs platforms.linux)];
-
-    services.pass-secret-service.extraArgs = optional (cfg.storePath != null) "--path=${cfg.storePath}";
-
-    systemd.user.services.pass-secret-service = {
-      Unit = {
-        AssertFileIsExecutable = "${cfg.package}/bin/pass_secret_service";
-        Description = "Pass libsecret service";
-        Documentation = "https://github.com/mdellweg/pass_secret_service";
-        PartOf = ["default.target"];
-      };
-
-      Service = {
-        ExecStart = "${cfg.package}/bin/pass_secret_service ${lib.escapeShellArgs cfg.extraArgs}";
-      };
-
-      Install = {
-        WantedBy = ["default.target"];
-      };
-    };
-  };
-}
diff --git a/overlays/default.nix b/overlays/default.nix
index 7e424f8e..7366868b 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -46,9 +46,6 @@ in {
         ];
       };
 
-    # https://github.com/mdellweg/pass_secret_service/pull/37
-    pass-secret-service = addPatches prev.pass-secret-service [./pass-secret-service-native.diff];
-
     qutebrowser = prev.qutebrowser.overrideAttrs (oldAttrs: {
       preFixup =
         oldAttrs.preFixup
diff --git a/overlays/pass-secret-service-native.diff b/overlays/pass-secret-service-native.diff
deleted file mode 100644
index 87013ced..00000000
--- a/overlays/pass-secret-service-native.diff
+++ /dev/null
@@ -1,137 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 64222c2..65d4c33 100644
---- a/Makefile
-+++ b/Makefile
-@@ -3,6 +3,7 @@ relgnupghome ::= test/.gnupghome
- export GNUPGHOME ::= $(projectdir)/$(relgnupghome)
- gpg_key_id ::= "8c2a59a7"
- relpassstore ::= test/.test-password-store
-+pass ::= pypass
- export PASSWORD_STORE_DIR ::= $(projectdir)/$(relpassstore)
-
- .PHONY: all test coverage style clean clean-pycache clean-build
-@@ -10,7 +11,7 @@ export PASSWORD_STORE_DIR ::= $(projectdir)/$(relpassstore)
- all: style test
-
- test: | $(relpassstore)
--	dbus-run-session -- pytest -v test
-+	dbus-run-session -- pytest -v test --asyncio-mode=auto
-
- coverage: | $(relpassstore)
- 	dbus-run-session -- python3 -m coverage run -m pytest -v test
-@@ -28,7 +29,7 @@ $(relgnupghome): test/test_key.asc test/test_ownertrust.txt
-
- $(relpassstore): | $(relgnupghome)
- 	@echo "===== Preparing password store in $(relpassstore) ====="
--	pypass init -p $(relpassstore) $(gpg_key_id)
-+	$(pass) init -p $(relpassstore) $(gpg_key_id)
-
- clean: clean-test-environment clean-pycache clean-build
-
-diff --git a/pass_secret_service/common/native_pass.py b/pass_secret_service/common/native_pass.py
-new file mode 100644
-index 0000000..b1a06aa
---- /dev/null
-+++ b/pass_secret_service/common/native_pass.py
-@@ -0,0 +1,30 @@
-+import subprocess
-+import os
-+
-+DEFAULT_PASS = "pass"
-+
-+class NativePasswordStore:
-+    def __init__(self, use_pass=None, path=None):
-+        self.pass_cmd = use_pass or DEFAULT_PASS
-+        self.path = path
-+
-+    def _pass(self, *args, **kwargs):
-+        env = os.environ
-+        if self.path is not None:
-+            env.update({'PASSWORD_STORE_DIR': self.path})
-+
-+        proc = subprocess.run([self.pass_cmd, *args],
-+            check=True,
-+            text=True,
-+            capture_output=True,
-+            env=env,
-+            **kwargs
-+        )
-+
-+        return proc
-+
-+    def get_decrypted_password(self, passname):
-+        return self._pass("show", passname).stdout.removesuffix("\n")
-+
-+    def insert_password(self, passname, password):
-+        self._pass("insert", "--echo", passname, input=password)
-diff --git a/pass_secret_service/common/pass_store.py b/pass_secret_service/common/pass_store.py
-index c1aa175..4f13438 100644
---- a/pass_secret_service/common/pass_store.py
-+++ b/pass_secret_service/common/pass_store.py
-@@ -2,19 +2,30 @@
- import shutil
- import uuid
- import json
--from pypass import PasswordStore
-
-+try:
-+    from pypass import PasswordStore
-
--# Work around a typo in pypass
--if not hasattr(PasswordStore, "get_decrypted_password"):
--    PasswordStore.get_decrypted_password = PasswordStore.get_decypted_password
-+    # Work around a typo in pypass
-+    if not hasattr(PasswordStore, "get_decrypted_password"):
-+        PasswordStore.get_decrypted_password = PasswordStore.get_decypted_password
-+
-+except ImportError:
-+    from .native_pass import NativePasswordStore
-+    PasswordStore = NativePasswordStore
-
-
- class PassStore:
-     PREFIX = "secret_service"
-
--    def __init__(self, *args, **kwargs):
--        self._store = PasswordStore(*args, **kwargs)
-+    def __init__(self, *args, use_pass=None, **kwargs):
-+        if not use_pass:
-+            self._store = PasswordStore(*args, **kwargs)
-+
-+        else:
-+            from .native_pass import NativePasswordStore
-+            self._store = NativePasswordStore(use_pass=use_pass, **kwargs)
-+
-         self.base_path = os.path.join(self._store.path, self.PREFIX)
-         if not os.path.exists(self.base_path):
-             os.makedirs(self.base_path)
-diff --git a/pass_secret_service/pass_secret_service.py b/pass_secret_service/pass_secret_service.py
-index 8c35db9..7dbcdf0 100755
---- a/pass_secret_service/pass_secret_service.py
-+++ b/pass_secret_service/pass_secret_service.py
-@@ -30,10 +30,10 @@ async def register_service(pass_store):
-     return service
-
-
--def _main(path, verbose):
-+def _main(path, pass_, verbose):
-     if verbose:
-         logging.basicConfig(level=20)
--    pass_store = PassStore(**({"path": path} if path else {}))
-+    pass_store = PassStore(use_pass=pass_, **({"path": path} if path else {}))
-     mainloop = asyncio.get_event_loop()
-     mainloop.add_signal_handler(signal.SIGTERM, functools.partial(term_loop, mainloop))
-     mainloop.add_signal_handler(signal.SIGINT, functools.partial(term_loop, mainloop))
-@@ -51,9 +51,10 @@ def _main(path, verbose):
-
- @click.command()
- @click.option("--path", help="path to the password store (optional)")
-+@click.option("-e", "pass_", help="use given pass executable")
- @click.option("-v", "--verbose", help="be verbose", is_flag=True, default=False)
--def main(path, verbose):
--    _main(path, verbose)
-+def main(path, pass_, verbose):
-+    _main(path, pass_, verbose)
-
-
- if __name__ == "__main__":  # pragma: no cover