Your pass-secret-service with nix

[mannp]

Hey there @grimsteel thanks for creating this

I have been trying to swap out the mdellweg pass_secret_service for yours, using the same service defn with your package being used.

Unfortunately I get the following systemd error, and I am not sure on how to debug further.

Do you support --path command line option to specify the path of the pass-store?

https://github.com/mdellweg/pass_secret_service

https://github.com/nix-community/home-manager/blob/release-24.11/modules/services/pass-secret-service.nix

○ pass-secret-service.service - Pass libsecret service
     Loaded: loaded (/home/me/.config/systemd/user/pass-secret-service.service; enabled; preset: ignored)
     Active: inactive (dead) since Sat 2025-01-18 21:04:35 GMT; 24min ago
   Duration: 222ms
 Invocation: bf04f036dea0461ea9650f76c28f5a9b
     Assert: start assertion failed at Sat 2025-01-18 21:29:24 GMT; 1s ago
             AssertFileIsExecutable=/nix/store/nv9g194v0l0kjnhk7nvccbpybicl3pr5-pass-secret-service-0.2.1/bin/pass_secret_service was not met
       Docs: https://github.com/mdellweg/pass_secret_service
   Main PID: 219740 (code=exited, status=2)
   Mem peak: 17.1M
        CPU: 181ms

Jan 18 21:04:35 dt systemd[2918]: pass-secret-service.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Jan 18 21:04:35 dt systemd[2918]: pass-secret-service.service: Failed with result 'exit-code'.
Jan 18 21:15:47 dt systemd[2918]: pass-secret-service.service: Starting requested but asserts failed.
Jan 18 21:15:47 dt systemd[2918]: Assertion failed for Pass libsecret service.
Jan 18 21:21:44 dt systemd[2918]: pass-secret-service.service: Starting requested but asserts failed.
Jan 18 21:21:44 dt systemd[2918]: Assertion failed for Pass libsecret service.
Jan 18 21:29:04 dt systemd[2918]: pass-secret-service.service: Starting requested but asserts failed.
Jan 18 21:29:04 dt systemd[2918]: Assertion failed for Pass libsecret service.
Jan 18 21:29:24 dt systemd[2918]: pass-secret-service.service: Starting requested but asserts failed.
Jan 18 21:29:24 dt systemd[2918]: Assertion failed for Pass libsecret service.

    systemd.user.services.pass-secret-service =
      let binPath = "${cfg.package}/bin/pass_secret_service";
      in {
        Unit = {
          AssertFileIsExecutable = "${binPath}";
          Description = "Pass libsecret service";
          Documentation = "https://github.com/mdellweg/pass_secret_service";
          PartOf = [ "default.target" ];
        };

        Service = {
          Type = "dbus";
          ExecStart = "${binPath} ${
              optionalString (cfg.storePath != null) "--path ${cfg.storePath}"
            }";
          BusName = busName;
          Environment = [ "GNUPGHOME=${config.programs.gpg.homedir}" ];
        };

        Install.WantedBy = [ "default.target" ];
      };

[grimsteel]

It looks like the assertion failed error has something to do with the nix packaging (apparently pass_secret_service isn't executable)

I don't support --path, but I do support the PASSWORD_STORE_DIR env var

[mannp]

Okay thanks.

Strange as everything works as expected with the other pass secret service package.

Seems this is not a drop in replacement, I guess 😀

[anuramat]

fyi I'm kinda trying to wrap it in a home-manager module: https://github.com/anuramat/pass-secret-service/tree/nix

builds, runs, but isn't reachable somehow

[grimsteel]

Thanks for working on this! I actually just removed the test_keygrip test as it now needs environment-specific arguments (collection id) to work.

Do you support --path command line option to specify the path of the pass-store?

I also added support for that recently.

[mannp]

Tried again with 0.3 and getting an 'assertion error'. No opportunity to investigate further at the moment.

[mbainter]

@mannp - In the original Issue you reported note that it is configured to setup the systemd service using this for the binPath variable:

      let binPath = "${cfg.package}/bin/pass_secret_service";

But the binary generated if you build this project is "pass-secret-service". So if you don't replace that systemd unit file it's going to configure the unit to look in the wrong place, which would throw the Assert error. It isn't really working for me unfortunately due to some applications I need it to support, but I do have it running if you want to crib whatever you find useful from my setup:

• package
• service

[mbainter]

@anuramat - what do you mean by this:

builds, runs, but isn't reachable somehow

[mannp]

@mannp - In the original Issue you reported note that it is configured to setup the systemd service using this for the binPath variable:

      let binPath = "${cfg.package}/bin/pass_secret_service";

But the binary generated if you build this project is "pass-secret-service". So if you don't replace that systemd unit file it's going to configure the unit to look in the wrong place, which would throw the Assert error. It isn't really working for me unfortunately due to some applications I need it to support, but I do have it running if you want to crib whatever you find useful from my setup:

* [package](https://github.com/mbainter/nixos-configs/blob/vidar-improvements/pkgs/pass-secret-service-rs/package.nix)

* [service](https://github.com/mbainter/nixos-configs/blob/vidar-improvements/modules/home/services/pass-secret-service-rs/default.nix)

Thanks for the info @mbainter I am aware of the change of name and had updated my service since the first post.

When I quickly tried for 0.3 everything was healthy and seemed to be fine but when trying to use the service I got an assertion error.

I've had no chance to look further, so cannot explain further.

btw your files seem private if others wanted to use, but thanks for the thought though 👍🏻

[grimsteel]

I'm not sure, but it looks like the only assertion is AssertFileIsExecutable = "${binPath}";, so it might just be that the binary isn't executable for some reason.

[anuramat]

@mbainter the service is running, but it's almost like it doesn't connect to dbus (it's been a while since I tried running it)

probably something stupid like environment variables; I'll take a look eventually (exams this month 😫), not having a keyring while testing is kinda annoying

[jalil-salame]

The binary from the Python version is named differently (pass_secret_service instead of pass-secret-service), which is why it doesn't work.

[jraygauthier]

Packaged at https://github.com/jraygauthier/jrg-nixpkgs/blob/master/.nix/pkgs/pass-secret-service-rust/default.nix.

Run it directly:

$ nix run github:jraygauthier/jrg-nixpkgs#pass-secret-service-rust
# ..

After applying the jrg-nixpkgs overlay, the above pkgs.pass-secret-service-rust package works as a drop-in replacement for the pkgs.pass-secret-service python implementation used as default for services.passSecretService.package.

{
  nixpkgs.overlays = [
    (builtins.getFlake "github:jraygauthier/jrg-nixpkgs?rev=dd434c493d298f2e55be5cb867ed75071e894e93")
    .overlays.default
  ];
  services.passSecretService.enable = true;
  services.passSecretService.package = pkgs.pass-secret-service-rust;
}

$ systemctl --user status pass-secret-service.service 
● pass-secret-service.service - org.freedesktop.secrets agent for pass
     Loaded: loaded (/etc/systemd/user/pass-secret-service.service; static)
     Active: active (running) since Thu 2025-08-28 13:41:53 EDT; 24min ago
 Invocation: c32e1d2f456a4629b07d9ab5cfaa8791
   Main PID: 3456 (.pass-secret-se)
      Tasks: 17 (limit: 76557)
     Memory: 9M (peak: 11.2M)
        CPU: 56ms
     CGroup: /user.slice/user-1234.slice/user@1234.service/app.slice/pass-secret-service.service
             └─3456 /nix/store/mkk52r7msx3msswkay3sm1c1vhffpfv1-pass-secret-service-rust-0.4.1/bin/pass-secret-service

Aug 28 13:41:53 my-host systemd[2345]: Starting org.freedesktop.secrets agent for pass...
Aug 28 13:41:53 my-host pass-secret-service[3456]: D-Bus session connection established. Unique name: :1.37
Aug 28 13:41:53 my-host pass-secret-service[3456]: Acquired well-known name: `org.freedesktop.secrets`
Aug 28 13:41:53 my-host systemd[2345]: Started org.freedesktop.secrets agent for pass.

[mannp]

@jraygauthier have you had success with apps interacting with the service too?

Reverting for now, but will check again when I have a chance

> systemctl --user status pass-secret-service.service
○ pass-secret-service.service - Pass libsecret service
     Loaded: loaded (/home/paul/.config/systemd/user/pass-secret-service.service; enabled; preset: ignored)
     Active: inactive (dead)
     Assert: start assertion failed at Fri 2025-08-29 21:06:56 BST; 7s ago
             AssertFileIsExecutable=/nix/store/8lwfkrz3jvxnal7nlm5ifmshmhwfpjan-pass-secret-service-rust-0.4.1/bin/pass_secret_service was not met
       Docs: https://github.com/mdellweg/pass_secret_service

Aug 29 21:01:53 dt systemd[3025]: pass-secret-service.service: Starting requested but asserts failed.
Aug 29 21:01:53 dt systemd[3025]: Assertion failed for Pass libsecret service.
Aug 29 21:06:56 dt systemd[3025]: pass-secret-service.service: Starting requested but asserts failed.
Aug 29 21:06:56 dt systemd[3025]: Assertion failed for Pass libsecret service.

[jraygauthier]

@mannp: yes, used seahorse on top of it. Worked fine outside of auto refresh (#13) and some CLI warnings about aliases (#14). Secret files were written to the store and read back without any problem.

[grimsteel]

@mannp it looks like the issue is that pass_secret_service isn't executable for some reason