From ceb5ad8e3243ade1ad2703d5975faa164224a29a Mon Sep 17 00:00:00 2001
From: state plumber <273540141+state-plumber@users.noreply.github.com>
Date: Sat, 4 Apr 2026 00:00:00 +0000
Subject: [PATCH 1/2] sequoia-chameleon-gnupg: add wrappers to mimic gpg

---
 .../se/sequoia-chameleon-gnupg/gpgconf.el     |  3 +++
 .../se/sequoia-chameleon-gnupg/package.nix    | 26 ++++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100755 pkgs/by-name/se/sequoia-chameleon-gnupg/gpgconf.el

diff --git a/pkgs/by-name/se/sequoia-chameleon-gnupg/gpgconf.el b/pkgs/by-name/se/sequoia-chameleon-gnupg/gpgconf.el
new file mode 100755
index 000000000000..ee4d4e4365e8
--- /dev/null
+++ b/pkgs/by-name/se/sequoia-chameleon-gnupg/gpgconf.el
@@ -0,0 +1,3 @@
+#!@execlineb@ -s0
+pipeline -w { @sed@ -e "s|^gpg:OpenPGP:.*/bin/gpg$|gpg:OpenPGP:@out@/bin/gpg|" }
+@gpgconf@ $@
diff --git a/pkgs/by-name/se/sequoia-chameleon-gnupg/package.nix b/pkgs/by-name/se/sequoia-chameleon-gnupg/package.nix
index 25ea9c1591a8..f2bda78b6122 100644
--- a/pkgs/by-name/se/sequoia-chameleon-gnupg/package.nix
+++ b/pkgs/by-name/se/sequoia-chameleon-gnupg/package.nix
@@ -1,12 +1,15 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitLab,
   pkg-config,
+  makeWrapper,
   nettle,
   openssl,
   sqlite,
+  gnupg,
+  execline,
+  gnused,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,6 +28,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     rustPlatform.bindgenHook
     pkg-config
+    makeWrapper
   ];
 
   buildInputs = [
@@ -33,6 +37,26 @@ rustPlatform.buildRustPackage rec {
     sqlite
   ];
 
+  postInstall = ''
+    # Wrap to find gpg-agent from GnuPG.
+    makeWrapper $out/bin/gpg-sq $out/bin/gpg \
+      --suffix PATH : ${lib.makeBinPath [ gnupg ]}
+    makeWrapper $out/bin/gpgv-sq $out/bin/gpgv \
+      --suffix PATH : ${lib.makeBinPath [ gnupg ]}
+
+    # Modify the output of gpgconf to resolve gpg to this package.
+    substitute ${./gpgconf.el} $out/bin/gpgconf \
+      --subst-var-by execlineb ${lib.getExe' execline "execlineb"} \
+      --subst-var-by gpgconf ${lib.getExe' gnupg "gpgconf"} \
+      --subst-var-by sed ${lib.getExe' gnused "sed"} \
+      --subst-var out
+
+    # Additional wrappers.
+    chmod +x $out/bin/gpgconf
+    ln -s gpg $out/bin/gpg2
+    ln -s ${lib.getExe' gnupg "gpg"} $out/bin/gpg-g10code
+  '';
+
   # gpgconf: error creating socket directory
   doCheck = false;
 

From f195e55daba05e71f2a34b1b9cf556a6c9691f43 Mon Sep 17 00:00:00 2001
From: state plumber <273540141+state-plumber@users.noreply.github.com>
Date: Tue, 7 Apr 2026 00:00:00 +0000
Subject: [PATCH 2/2] pass: use git, gpg from runtime $PATH

---
 pkgs/tools/security/pass/default.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 962bbbf1fc17..9efc93c89390 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -108,14 +108,12 @@ stdenv.mkDerivation rec {
     cp "contrib/dmenu/passmenu" "$out/bin/"
   '';
 
-  wrapperPath = lib.makeBinPath (
+  wrapperPathPrefix = lib.makeBinPath (
     [
       coreutils
       findutils
       getopt
-      git
       gnugrep
-      gnupg
       gnused
       tree
       which
@@ -136,6 +134,11 @@ stdenv.mkDerivation rec {
     ]
   );
 
+  wrapperPathSuffix = lib.makeBinPath [
+    git
+    gnupg
+  ];
+
   postFixup = ''
     # Fix program name in --help
     substituteInPlace $out/bin/pass \
@@ -143,13 +146,15 @@ stdenv.mkDerivation rec {
 
     # Ensure all dependencies are in PATH
     wrapProgram $out/bin/pass \
-      --prefix PATH : "${wrapperPath}"
+      --prefix PATH : "${wrapperPathPrefix}" \
+      --suffix PATH : "${wrapperPathSuffix}"
   ''
   + lib.optionalString dmenuSupport ''
     # We just wrap passmenu with the same PATH as pass. It doesn't
     # need all the tools in there but it doesn't hurt either.
     wrapProgram $out/bin/passmenu \
-      --prefix PATH : "$out/bin:${wrapperPath}"
+      --prefix PATH : "$out/bin:${wrapperPathPrefix}" \
+      --suffix PATH : "${wrapperPathSuffix}"
   '';
 
   # Turn "check" into "installcheck", since we want to test our pass,