From 4d4952ae28c707aeb66c7def830fd1dd60669510 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Thu, 16 Apr 2026 20:34:20 +0200
Subject: [PATCH] polkit-stdin-agent: init at 0.3.0

A non-interactive polkit authentication agent that answers PAM prompts
from a file descriptor. Provides the missing `sudo --stdin` equivalent
for run0/systemd-run, which authorise via polkit and otherwise require
a controlling terminal for pkttyagent.

Used by the upcoming `nixos-rebuild --elevate=run0
--ask-elevate-password`. The machine performing the elevation enables
system.tools.nixos-rebuild.enableRun0Elevation (added in the next
commit), which puts this package on PATH locally and at
<toplevel>/sw/bin on a remote target.
---
 .../by-name/po/polkit-stdin-agent/package.nix | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 pkgs/by-name/po/polkit-stdin-agent/package.nix

diff --git a/pkgs/by-name/po/polkit-stdin-agent/package.nix b/pkgs/by-name/po/polkit-stdin-agent/package.nix
new file mode 100644
index 000000000000..7377d1727ca6
--- /dev/null
+++ b/pkgs/by-name/po/polkit-stdin-agent/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  nix-update-script,
+  nixosTests,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "polkit-stdin-agent";
+  version = "0.3.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "r-vdp";
+    repo = "polkit-stdin-agent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Nl/+IBbUEsxSKSWLXwUB3mV4iAG0z9mv+Bl6CSeFzR4=";
+  };
+
+  cargoHash = "sha256-Eb/7ejVmtG5FNSh66gZO3337KCPNi+xtYVC5qyFKJzg=";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) nixos-rebuild-target-host; };
+  };
+
+  meta = {
+    description = "Non-interactive polkit authentication agent that answers PAM prompts from a file descriptor";
+    longDescription = ''
+      Registers a per-process polkit authentication agent for a wrapped
+      command and answers the PAM conversation from a file descriptor
+      instead of /dev/tty, giving run0 / systemd-run the same
+      "password on stdin" ergonomics as `sudo --stdin`.
+
+      Used by `nixos-rebuild --elevate=run0 --ask-elevate-password` to
+      authenticate on a target host over SSH without allocating a TTY.
+    '';
+    homepage = "https://codeberg.org/r-vdp/polkit-stdin-agent";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rvdp ];
+    platforms = lib.platforms.linux;
+    mainProgram = "polkit-stdin-agent";
+  };
+})