From b424b375fc613806a8047776f1d3b8300b6d30e1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 10 Aug 2025 11:12:29 +0300
Subject: [PATCH] calamares: drop privileges before xdg-open

---
 pkgs/by-name/ca/calamares/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/ca/calamares/package.nix b/pkgs/by-name/ca/calamares/package.nix
index e360955ff6d3..682e0cbec8a2 100644
--- a/pkgs/by-name/ca/calamares/package.nix
+++ b/pkgs/by-name/ca/calamares/package.nix
@@ -1,6 +1,10 @@
 {
   lib,
   stdenv,
+
+  writeShellScriptBin,
+  xdg-utils,
+
   fetchFromGitea,
 
   cmake,
@@ -23,6 +27,13 @@
   calamares-nixos,
 }:
 
+let
+  # drop privileges so we can launch browsers, etc;
+  # force going through the portal so we get the right environment
+  xdg-open-nixos = writeShellScriptBin "xdg-open" ''
+    sudo --user $(id -nu $PKEXEC_UID) env NIXOS_XDG_OPEN_USE_PORTAL=1 ${xdg-utils}/bin/xdg-open "$@"
+  '';
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "calamares";
   version = "3.4.0";
@@ -97,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
         ckbcomp
         os-prober
         util-linux
+        xdg-open-nixos
       ]
     }"
   ];