gocryptfs: stop depending on fuse

Part of #526161.

The previous approach prefixed $PATH to make a fusermount available, but
this would be gone if we'd just replace it to fuse3, as #526670
attempted (which would break mounting via fstab).

Instead, patch the source to try our suid wrapper (which is always
preferred so mounting as non-root still works), and then fallback to a
fusermount from $PATH (to work on non-NixOS distros)

Ideally this would also try fusermount3, but whether to do that is
probably something for upstream to decide, and other distros probably
also provide a symlink for compatibility reasons.

Closes #526670.

pkgs/by-name/go/gocryptfs/0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch

@@ -0,0 +1,43 @@
+From ac51f09a9e1a1307ebaf38ffab66eb729cf1b0a5 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Tue, 2 Jun 2026 20:17:25 +0200
+Subject: [PATCH] mount.go: try fusermount3 suid wrapper and fallback to
+ fusermount from $PATH
+
+On NixOS, we want to use the fusermount3 suid wrapper to allow mounting
+as non-root user.
+
+We still want to try fusermount from `$PATH` to work on non-NixOS, and
+keep the /bin/fusermount fallback as a last resort.
+---
+ mount.go | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/mount.go b/mount.go
+index 2508409..defc967 100644
+--- a/mount.go
++++ b/mount.go
+@@ -526,14 +526,16 @@ func initGoFuse(rootNode fs.InodeEmbedder, args *argContainer) *fuse.Server {
+ 
+ // haveFusermount2 finds out if the "fusermount" binary is from libfuse 2.x.
+ func haveFusermount2() bool {
+-	path, err := exec.LookPath("fusermount")
+-	if err != nil {
+-		path = "/bin/fusermount"
++	path := "/bin/fusermount"
++	if _, err := os.Stat("/run/wrappers/bin/fusermount3"); err == nil {
++		path = "/run/wrappers/bin/fusermount3"
++	} else if newPath, err := exec.LookPath("fusermount"); err == nil {
++		path = newPath
+ 	}
+ 	cmd := exec.Command(path, "-V")
+ 	var out bytes.Buffer
+ 	cmd.Stdout = &out
+-	err = cmd.Run()
++	err := cmd.Run()
+ 	if err != nil {
+ 		tlog.Warn.Printf("warning: haveFusermount2: %v", err)
+ 		return false
+-- 
+2.53.0
+

pkgs/by-name/go/gocryptfs/package.nix

@@ -2,7 +2,6 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fuse,
   makeWrapper,
   openssl,
   pandoc,
@@ -22,6 +21,8 @@ buildGoModule (finalAttrs: {
     sha256 = "sha256-uQLFcabN418m1dvogJ71lJeTF3F9JycK/8qCPaXblSU=";
   };
 
+  patches = [ ./0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch ];
+
   vendorHash = "sha256-dvOROh5TsMl+52RvKmDG4ftNv3WF19trgttu5BGWktU=";
 
   nativeBuildInputs = [
@@ -56,11 +57,7 @@ buildGoModule (finalAttrs: {
     popd
   '';
 
-  # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
-  # as the setuid wrapper is required to use gocryptfs as non-root on NixOS
   postInstall = ''
-    wrapProgram $out/bin/gocryptfs \
-      --suffix PATH : ${lib.makeBinPath [ fuse ]}
     ln -s $out/bin/gocryptfs $out/bin/mount.fuse.gocryptfs
   '';