From 079a3b5d1aa6a719920a51316253b7d6dd22738d Mon Sep 17 00:00:00 2001 From: Benedikt Rips Date: Tue, 7 Jul 2026 12:37:53 +0200 Subject: [PATCH] sshAuthSock: for Zsh, initialize in .zprofile and .zshenv --- modules/misc/ssh-auth-sock.nix | 12 +++++++++++- tests/modules/misc/ssh-auth-sock/disabled.nix | 3 +++ tests/modules/misc/ssh-auth-sock/enabled.nix | 3 +++ .../services/proton-pass-agent/ssh-auth-sock.nix | 3 +++ .../services/ssh-agent/darwin/ssh-auth-sock.nix | 3 +++ .../services/ssh-agent/linux/ssh-auth-sock.nix | 3 +++ .../modules/services/ssh-tpm-agent/ssh-auth-sock.nix | 3 +++ .../services/yubikey-agent/darwin/ssh-auth-sock.nix | 3 +++ .../services/yubikey-agent/linux/ssh-auth-sock.nix | 3 +++ 9 files changed, 35 insertions(+), 1 deletion(-) diff --git a/modules/misc/ssh-auth-sock.nix b/modules/misc/ssh-auth-sock.nix index 3d74a6dca..7bc5d7561 100644 --- a/modules/misc/ssh-auth-sock.nix +++ b/modules/misc/ssh-auth-sock.nix @@ -103,7 +103,17 @@ in programs.bash.profileExtra = lib.mkOrder 900 bashIntegration; programs.fish.shellInit = lib.mkOrder 900 fishIntegration; programs.nushell.extraConfig = lib.mkOrder 900 nushellIntegration; - programs.zsh.envExtra = lib.mkOrder 900 zshIntegration; + programs.zsh = { + # Mimic how `home.sessionVariablesPackage` is sourced in the Zsh module + # to ensure that session variables which SSH_AUTH_SOCK might rely on are + # set. + envExtra = lib.mkOrder 900 '' + if [[ ! -o login ]]; then + ${indentNonEmptyLines zshIntegration} + fi + ''; + profileExtra = lib.mkOrder 900 zshIntegration; + }; # Replace this service by an environment generator as soon as they are # available per-user. See https://github.com/systemd/systemd/issues/32423 diff --git a/tests/modules/misc/ssh-auth-sock/disabled.nix b/tests/modules/misc/ssh-auth-sock/disabled.nix index d7223b595..4fddd7932 100644 --- a/tests/modules/misc/ssh-auth-sock/disabled.nix +++ b/tests/modules/misc/ssh-auth-sock/disabled.nix @@ -19,6 +19,9 @@ assertFileNotRegex \ home-files/.zshenv \ 'SSH_AUTH_SOCK' + assertFileNotRegex \ + home-files/.zprofile \ + 'SSH_AUTH_SOCK' assertPathNotExists home-files/.config/systemd/user/set-SSH_AUTH_SOCK.service ''; diff --git a/tests/modules/misc/ssh-auth-sock/enabled.nix b/tests/modules/misc/ssh-auth-sock/enabled.nix index 0bc7c3cfa..1d499556a 100644 --- a/tests/modules/misc/ssh-auth-sock/enabled.nix +++ b/tests/modules/misc/ssh-auth-sock/enabled.nix @@ -29,6 +29,9 @@ assertFileContains \ home-files/.zshenv \ 'if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then' + assertFileContains \ + home-files/.zprofile \ + 'if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then' '' + lib.optionalString config.systemd.user.enable '' assertFileExists home-files/.config/systemd/user/set-SSH_AUTH_SOCK.service diff --git a/tests/modules/services/proton-pass-agent/ssh-auth-sock.nix b/tests/modules/services/proton-pass-agent/ssh-auth-sock.nix index 4b139a5ed..59fa252e9 100644 --- a/tests/modules/services/proton-pass-agent/ssh-auth-sock.nix +++ b/tests/modules/services/proton-pass-agent/ssh-auth-sock.nix @@ -38,5 +38,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="${bashDir}/proton-pass-agent"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="${bashDir}/proton-pass-agent"' ''; } diff --git a/tests/modules/services/ssh-agent/darwin/ssh-auth-sock.nix b/tests/modules/services/ssh-agent/darwin/ssh-auth-sock.nix index 44659b1db..2f4d9ded9 100644 --- a/tests/modules/services/ssh-agent/darwin/ssh-auth-sock.nix +++ b/tests/modules/services/ssh-agent/darwin/ssh-auth-sock.nix @@ -18,5 +18,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="$(@system_cmds@/bin/getconf DARWIN_USER_TEMP_DIR)/ssh-agent"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="$(@system_cmds@/bin/getconf DARWIN_USER_TEMP_DIR)/ssh-agent"' ''; } diff --git a/tests/modules/services/ssh-agent/linux/ssh-auth-sock.nix b/tests/modules/services/ssh-agent/linux/ssh-auth-sock.nix index efadf1d95..6fd1dbe6f 100644 --- a/tests/modules/services/ssh-agent/linux/ssh-auth-sock.nix +++ b/tests/modules/services/ssh-agent/linux/ssh-auth-sock.nix @@ -18,5 +18,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"' ''; } diff --git a/tests/modules/services/ssh-tpm-agent/ssh-auth-sock.nix b/tests/modules/services/ssh-tpm-agent/ssh-auth-sock.nix index c4c5a3d79..da51c2466 100644 --- a/tests/modules/services/ssh-tpm-agent/ssh-auth-sock.nix +++ b/tests/modules/services/ssh-tpm-agent/ssh-auth-sock.nix @@ -18,5 +18,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"' ''; } diff --git a/tests/modules/services/yubikey-agent/darwin/ssh-auth-sock.nix b/tests/modules/services/yubikey-agent/darwin/ssh-auth-sock.nix index fda842345..20f163968 100644 --- a/tests/modules/services/yubikey-agent/darwin/ssh-auth-sock.nix +++ b/tests/modules/services/yubikey-agent/darwin/ssh-auth-sock.nix @@ -18,5 +18,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="/tmp/yubikey-agent.sock"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="/tmp/yubikey-agent.sock"' ''; } diff --git a/tests/modules/services/yubikey-agent/linux/ssh-auth-sock.nix b/tests/modules/services/yubikey-agent/linux/ssh-auth-sock.nix index 7036b0a01..060026a28 100644 --- a/tests/modules/services/yubikey-agent/linux/ssh-auth-sock.nix +++ b/tests/modules/services/yubikey-agent/linux/ssh-auth-sock.nix @@ -18,5 +18,8 @@ assertFileContains \ home-files/.zshenv \ 'export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-agent/yubikey-agent.sock"' + assertFileContains \ + home-files/.zprofile \ + 'export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-agent/yubikey-agent.sock"' ''; }