sshAuthSock: for Zsh, initialize in .zprofile and .zshenv

modules/misc/ssh-auth-sock.nix

@@ -103,7 +103,17 @@ in
       programs.bash.profileExtra = lib.mkOrder 900 bashIntegration;
       programs.fish.shellInit = lib.mkOrder 900 fishIntegration;
       programs.nushell.extraConfig = lib.mkOrder 900 nushellIntegration;
-      programs.zsh.envExtra = lib.mkOrder 900 zshIntegration;
+      programs.zsh = {
+        # Mimic how `home.sessionVariablesPackage` is sourced in the Zsh module
+        # to ensure that session variables which SSH_AUTH_SOCK might rely on are
+        # set.
+        envExtra = lib.mkOrder 900 ''
+          if [[ ! -o login ]]; then
+          ${indentNonEmptyLines zshIntegration}
+          fi
+        '';
+        profileExtra = lib.mkOrder 900 zshIntegration;
+      };
 
       # Replace this service by an environment generator as soon as they are
       # available per-user. See https://github.com/systemd/systemd/issues/32423

tests/modules/misc/ssh-auth-sock/disabled.nix

@@ -19,6 +19,9 @@
     assertFileNotRegex \
       home-files/.zshenv \
       'SSH_AUTH_SOCK'
+    assertFileNotRegex \
+      home-files/.zprofile \
+      'SSH_AUTH_SOCK'
 
     assertPathNotExists home-files/.config/systemd/user/set-SSH_AUTH_SOCK.service
   '';

tests/modules/misc/ssh-auth-sock/enabled.nix

@@ -29,6 +29,9 @@
     assertFileContains \
       home-files/.zshenv \
       'if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then'
+    assertFileContains \
+      home-files/.zprofile \
+      'if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then'
   ''
   + lib.optionalString config.systemd.user.enable ''
     assertFileExists home-files/.config/systemd/user/set-SSH_AUTH_SOCK.service

tests/modules/services/proton-pass-agent/ssh-auth-sock.nix

@@ -38,5 +38,8 @@
       assertFileContains \
         home-files/.zshenv \
         'export SSH_AUTH_SOCK="${bashDir}/proton-pass-agent"'
+      assertFileContains \
+        home-files/.zprofile \
+        'export SSH_AUTH_SOCK="${bashDir}/proton-pass-agent"'
     '';
 }

tests/modules/services/ssh-agent/darwin/ssh-auth-sock.nix

@@ -18,5 +18,8 @@
     assertFileContains \
       home-files/.zshenv \
       'export SSH_AUTH_SOCK="$(@system_cmds@/bin/getconf DARWIN_USER_TEMP_DIR)/ssh-agent"'
+    assertFileContains \
+      home-files/.zprofile \
+      'export SSH_AUTH_SOCK="$(@system_cmds@/bin/getconf DARWIN_USER_TEMP_DIR)/ssh-agent"'
   '';
 }

tests/modules/services/ssh-agent/linux/ssh-auth-sock.nix

@@ -18,5 +18,8 @@
     assertFileContains \
       home-files/.zshenv \
       'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"'
+    assertFileContains \
+      home-files/.zprofile \
+      'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"'
   '';
 }

tests/modules/services/ssh-tpm-agent/ssh-auth-sock.nix

@@ -18,5 +18,8 @@
     assertFileContains \
       home-files/.zshenv \
       'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"'
+    assertFileContains \
+      home-files/.zprofile \
+      'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"'
   '';
 }

tests/modules/services/yubikey-agent/darwin/ssh-auth-sock.nix

@@ -18,5 +18,8 @@
     assertFileContains \
       home-files/.zshenv \
       'export SSH_AUTH_SOCK="/tmp/yubikey-agent.sock"'
+    assertFileContains \
+      home-files/.zprofile \
+      'export SSH_AUTH_SOCK="/tmp/yubikey-agent.sock"'
   '';
 }

tests/modules/services/yubikey-agent/linux/ssh-auth-sock.nix

@@ -18,5 +18,8 @@
     assertFileContains \
       home-files/.zshenv \
       'export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-agent/yubikey-agent.sock"'
+    assertFileContains \
+      home-files/.zprofile \
+      'export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-agent/yubikey-agent.sock"'
   '';
 }