nixos/gnome/gcr-ssh-agent: init (#379731)

doc/release-notes/rl-2511.section.md

···
 - `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by sil](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 
+- `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
+
+- [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.

nixos/modules/module-list.nix

···
   ./services/desktops/geoclue2.nix
   ./services/desktops/gnome/at-spi2-core.nix
   ./services/desktops/gnome/evolution-data-server.nix
+  ./services/desktops/gnome/gcr-ssh-agent.nix
   ./services/desktops/gnome/glib-networking.nix
   ./services/desktops/gnome/gnome-browser-connector.nix
   ./services/desktops/gnome/gnome-initial-setup.nix

nixos/modules/services/desktop-managers/gnome.nix

···
       services.gnome.at-spi2-core.enable = true;
       services.gnome.evolution-data-server.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gnome.gnome-online-accounts.enable = mkDefault true;
       services.gnome.localsearch.enable = mkDefault true;
       services.gnome.tinysparql.enable = mkDefault true;

nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix

···
+{
+  config,
+  options,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.gnome.gcr-ssh-agent;
+  opts = options.services.gnome.gcr-ssh-agent;
+  sshCfg = config.programs.ssh;
+  sshOpts = options.programs.ssh;
+in
+{
+  meta = {
+    maintainers = lib.teams.gnome.members;
+  };
+
+  options = {
+    services.gnome.gcr-ssh-agent = {
+      enable = lib.mkOption {
+        default = config.services.gnome.gnome-keyring.enable;
+        defaultText = lib.literalExpression "config.services.gnome.gnome-keyring.enable";
+        example = true;
+        description = "Whether to enable GCR SSH agent.";
+        type = lib.types.bool;
+      };
+
+      package = lib.mkPackageOption pkgs "GCR" {
+        default = [ "gcr_4" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
+      assertion = !sshCfg.startAgent;
+      message = ''
+        `${sshOpts.startAgent}' (defined in ${lib.showFiles sshOpts.startAgent.files}) and `${opts.enable}' (defined in ${lib.showFiles opts.enable.files}) cannot both be enabled at the same time.
+        These options conflict because only one SSH agent can be installed at a time.'';
+    };
+
+    systemd = {
+      packages = [ cfg.package ];
+      user.services.gcr-ssh-agent.wantedBy = [ "default.target" ];
+      user.sockets.gcr-ssh-agent.wantedBy = [ "sockets.target" ];
+    };
+  };
+}

nixos/modules/services/x11/desktop-managers/budgie.nix

···
     services.gnome.evolution-data-server.enable = mkDefault true;
     services.gnome.glib-networking.enable = mkDefault true;
     services.gnome.gnome-keyring.enable = mkDefault true;
+    services.gnome.gcr-ssh-agent.enable = mkDefault true;
     services.gnome.gnome-settings-daemon.enable = mkDefault true;
     services.gvfs.enable = mkDefault true;
 

nixos/modules/services/x11/desktop-managers/cinnamon.nix

···
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gvfs.enable = true;
       services.power-profiles-daemon.enable = mkDefault true;
       services.switcherooControl.enable = mkDefault true; # xapp-gpu-offload-helper

nixos/modules/services/x11/desktop-managers/deepin.nix

···
     services.gvfs.enable = mkDefault true;
     services.gnome.glib-networking.enable = mkDefault true;
     services.gnome.gnome-keyring.enable = mkDefault true;
+    services.gnome.gcr-ssh-agent.enable = mkDefault true;
     services.bamf.enable = mkDefault true;
 
     services.libinput.enable = mkDefault true;

nixos/modules/services/x11/desktop-managers/mate.nix

···
       services.gnome.at-spi2-core.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
       services.upower.enable = config.powerManagement.enable;

nixos/modules/services/x11/desktop-managers/pantheon.nix

···
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gvfs.enable = true;
       services.gnome.rygel.enable = mkDefault true;
       services.udisks2.enable = true;

pkgs/by-name/gn/gnome-keyring/package.nix

···
   libcap_ng,
   libselinux,
   p11-kit,
-  openssh,
   wrapGAppsNoGuiHook,
   docbook-xsl-nons,
   docbook_xml_dtd_43,
   gnome,
-  writeText,
   useWrappedDaemon ? true,
 }:
 
···
     glib
     libgcrypt
     pam
-    openssh
     libcap_ng
     libselinux
     gcr
···
     # installation directories
     "-Dpkcs11-config=${placeholder "out"}/etc/pkcs11" # todo: this should probably be /share/p11-kit/modules
     "-Dpkcs11-modules=${placeholder "out"}/lib/pkcs11"
-    # gnome-keyring doesn't build with ssh-agent by default anymore, we need to
-    # switch to using gcr https://github.com/NixOS/nixpkgs/issues/140824
-    "-Dssh-agent=true"
     # TODO: enable socket activation
     "-Dsystemd=disabled"
-    "--cross-file=${writeText "crossfile.ini" ''
-      [binaries]
-      ssh-add = '${lib.getExe' openssh "ssh-add"}'
-      ssh-agent = '${lib.getExe' openssh "ssh-agent"}'
-    ''}"
   ];
 
   # Tends to fail non-deterministically.

pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix

···
   meson,
   ninja,
 }:
-
 stdenv.mkDerivation rec {
   pname = "elementary-session-settings";
   version = "8.0.1";
···
     rev = version;
     sha256 = "sha256-4B7lUjHEa4LdKrmsFCB3iFIsdVd/rgwmtQUAgAj3rXs=";
   };
+
+  /*
+    This allows `elementary-session-settings` to not use gnome-keyring's ssh capabilities anymore, as they have been
+    moved to gcr upstream, in an effort to modularize gnome-keyring.
+
+    More info can be found here: https://gitlab.gnome.org/GNOME/gnome-keyring/-/merge_requests/60
+  */
+  patches = [ ./no-gnome-keyring-ssh-autostart.patch ];
 
   nativeBuildInputs = [
     desktop-file-utils

pkgs/desktops/pantheon/desktop/elementary-session-settings/no-gnome-keyring-ssh-autostart.patch

···
+diff --git a/session/meson.build b/session/meson.build
+index 501e836..3254658 100644
+--- a/session/meson.build
++++ b/session/meson.build
+@@ -79,7 +79,6 @@ if get_option('detect-program-prefixes') == true
+   autostarts = {
+     'gnome-keyring-pkcs11': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-pkcs11.desktop'),
+     'gnome-keyring-secrets': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-secrets.desktop'),
+-    'gnome-keyring-ssh': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-ssh.desktop'),
+     'onboard-autostart': join_paths(onboard_prefix, 'etc/xdg/autostart', 'onboard-autostart.desktop'),
+     'orca-autostart': join_paths(orca_prefix, 'etc/xdg/autostart', 'orca-autostart.desktop'),
+   }

pkgs/development/libraries/gcr/4.nix

···
 {
+  pkgs,
   stdenv,
   lib,
   fetchurl,
···
   shared-mime-info,
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
 }:
-
+let
+  ini = pkgs.formats.ini { };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcr";
   version = "4.4.0.1";
···
   ];
 
   mesonFlags = [
-    # We are still using ssh-agent from gnome-keyring.
-    # https://github.com/NixOS/nixpkgs/issues/140824
-    "-Dssh_agent=false"
     "-Dgpg_path=${lib.getBin gnupg}/bin/gpg"
     (lib.mesonEnable "systemd" systemdSupport)
+    "--cross-file=${
+      ini.generate "cross-file.conf" {
+        binaries =
+          {
+            ssh-add = "'${lib.getExe' openssh "ssh-add"}'";
+            ssh-agent = "'${lib.getExe' openssh "ssh-agent"}'";
+          }
+          // lib.optionalAttrs systemdSupport {
+            systemctl = "'${lib.getExe' systemd "systemctl"}'";
+          };
+      }
+    }"
   ];
 
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon