From b48d6e16617a0bc3eb787d2ecd50f799ef8bcdc2 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Mon, 1 Jun 2026 11:13:31 +0200
Subject: [PATCH 1/2] gocryptfs: stop depending on fuse

Part of #526161.

The previous approach prefixed $PATH to make a fusermount available, but
this would be gone if we'd just replace it to fuse3, as #526670
attempted (which would break mounting via fstab).

Instead, patch the source to try our suid wrapper (which is always
preferred so mounting as non-root still works), and then fallback to a
fusermount from $PATH (to work on non-NixOS distros)

Ideally this would also try fusermount3, but whether to do that is
probably something for upstream to decide, and other distros probably
also provide a symlink for compatibility reasons.

Closes #526670.
---
 ...ermount3-suid-wrapper-and-fallback-t.patch | 43 +++++++++++++++++++
 pkgs/by-name/go/gocryptfs/package.nix         |  7 +--
 2 files changed, 45 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/by-name/go/gocryptfs/0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch

diff --git a/pkgs/by-name/go/gocryptfs/0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch b/pkgs/by-name/go/gocryptfs/0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch
new file mode 100644
index 000000000000..9b33ff97f23e
--- /dev/null
+++ b/pkgs/by-name/go/gocryptfs/0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch
@@ -0,0 +1,43 @@
+From ac51f09a9e1a1307ebaf38ffab66eb729cf1b0a5 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Tue, 2 Jun 2026 20:17:25 +0200
+Subject: [PATCH] mount.go: try fusermount3 suid wrapper and fallback to
+ fusermount from $PATH
+
+On NixOS, we want to use the fusermount3 suid wrapper to allow mounting
+as non-root user.
+
+We still want to try fusermount from `$PATH` to work on non-NixOS, and
+keep the /bin/fusermount fallback as a last resort.
+---
+ mount.go | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/mount.go b/mount.go
+index 2508409..defc967 100644
+--- a/mount.go
++++ b/mount.go
+@@ -526,14 +526,16 @@ func initGoFuse(rootNode fs.InodeEmbedder, args *argContainer) *fuse.Server {
+ 
+ // haveFusermount2 finds out if the "fusermount" binary is from libfuse 2.x.
+ func haveFusermount2() bool {
+-	path, err := exec.LookPath("fusermount")
+-	if err != nil {
+-		path = "/bin/fusermount"
++	path := "/bin/fusermount"
++	if _, err := os.Stat("/run/wrappers/bin/fusermount3"); err == nil {
++		path = "/run/wrappers/bin/fusermount3"
++	} else if newPath, err := exec.LookPath("fusermount"); err == nil {
++		path = newPath
+ 	}
+ 	cmd := exec.Command(path, "-V")
+ 	var out bytes.Buffer
+ 	cmd.Stdout = &out
+-	err = cmd.Run()
++	err := cmd.Run()
+ 	if err != nil {
+ 		tlog.Warn.Printf("warning: haveFusermount2: %v", err)
+ 		return false
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index 04de5bd09ea1..7411469c34bb 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fuse,
   makeWrapper,
   openssl,
   pandoc,
@@ -22,6 +21,8 @@ buildGoModule (finalAttrs: {
     sha256 = "sha256-uQLFcabN418m1dvogJ71lJeTF3F9JycK/8qCPaXblSU=";
   };
 
+  patches = [ ./0001-mount.go-try-fusermount3-suid-wrapper-and-fallback-t.patch ];
+
   vendorHash = "sha256-dvOROh5TsMl+52RvKmDG4ftNv3WF19trgttu5BGWktU=";
 
   nativeBuildInputs = [
@@ -56,11 +57,7 @@ buildGoModule (finalAttrs: {
     popd
   '';
 
-  # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
-  # as the setuid wrapper is required to use gocryptfs as non-root on NixOS
   postInstall = ''
-    wrapProgram $out/bin/gocryptfs \
-      --suffix PATH : ${lib.makeBinPath [ fuse ]}
     ln -s $out/bin/gocryptfs $out/bin/mount.fuse.gocryptfs
   '';
 

From 063b1b777bbb0edae739e07e5aa1cc9b8881f508 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Wed, 3 Jun 2026 23:00:08 +0200
Subject: [PATCH 2/2] nixosTests.gocryptfs: make test less flaky

Sometimes files take a bit to appear.
Wait for the file to be present to not run into this.
---
 nixos/tests/gocryptfs.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix
index 548f8b424e16..d0e5df5e40b5 100644
--- a/nixos/tests/gocryptfs.nix
+++ b/nixos/tests/gocryptfs.nix
@@ -44,6 +44,9 @@
     # Wait for mounts
     machine.wait_for_unit("local-fs.target")
 
+    # Sometimes gocryptfs files are slow to appear
+    machine.wait_for_file("/plain/data.txt")
+
     # Ensure the canary is alive
     machine.succeed("grep -q success /plain/data.txt")