From 9eb3c1be80d9374cb476d985e7e5afef7172a7af Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Mon, 21 Jul 2025 17:46:53 +0200
Subject: [PATCH] daemon: restore daemon-trust-override

apparently this feature got lost in the migration to exec'ing daemons.

Change-Id: Iac9425cf6d20781bb49e5cf12f2056f4a3ec23ba
---
 lix/nix/daemon.cc                             |  5 +++
 .../common/vars-and-functions.sh.in           |  2 +-
 tests/functional/daemon-trust.sh              | 33 +++++++++++++++++++
 tests/functional/meson.build                  |  1 +
 4 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 tests/functional/daemon-trust.sh

diff --git a/lix/nix/daemon.cc b/lix/nix/daemon.cc
index 6a2863220..e6fbc82d1 100644
--- a/lix/nix/daemon.cc
+++ b/lix/nix/daemon.cc
@@ -364,6 +364,11 @@ try {
                         {.dup = SUBDAEMON_SETTINGS_FD, .from = settings.readSide.get()},
                     }
             };
+            if (forceTrustClientOpt) {
+                options.args.push_back(
+                    *forceTrustClientOpt ? "--force-trusted" : "--force-untrusted"
+                );
+            }
             runProgram2(options).release();
 
             FdSink sink(settings.writeSide.get());
diff --git a/tests/functional/common/vars-and-functions.sh.in b/tests/functional/common/vars-and-functions.sh.in
index 647926efa..f6326e6fd 100644
--- a/tests/functional/common/vars-and-functions.sh.in
+++ b/tests/functional/common/vars-and-functions.sh.in
@@ -98,7 +98,7 @@ startDaemon() {
     fi
     # Start the daemon, wait for the socket to appear.
     rm -f $NIX_DAEMON_SOCKET_PATH
-    PATH=$DAEMON_PATH nix --extra-experimental-features 'nix-command' daemon &
+    PATH=$DAEMON_PATH nix --extra-experimental-features 'nix-command' daemon "$@" &
     _NIX_TEST_DAEMON_PID=$!
     export _NIX_TEST_DAEMON_PID
     for ((i = 0; i < 300; i++)); do
diff --git a/tests/functional/daemon-trust.sh b/tests/functional/daemon-trust.sh
new file mode 100644
index 000000000..52790ed9d
--- /dev/null
+++ b/tests/functional/daemon-trust.sh
@@ -0,0 +1,33 @@
+source common.sh
+
+clearStore
+
+withDaemonTrusting() {
+    local trusting="$1"
+    shift
+
+    trap killDaemon EXIT
+
+    NIX_CONFIG="
+extra-experimental-features = daemon-trust-override
+trusted-users = $trusting
+" startDaemon "$@"
+}
+
+(
+    withDaemonTrusting "" --default-trust
+    nix store ping --json | jq -e '.trusted | not'
+)
+(
+    withDaemonTrusting "" --force-trusted
+    nix store ping --json | jq -e '.trusted'
+)
+
+(
+    withDaemonTrusting "$(whoami)" --default-trust
+    nix store ping --json | jq -e '.trusted'
+)
+(
+    withDaemonTrusting "$(whoami)" --force-untrusted
+    nix store ping --json | jq -e '.trusted | not'
+)
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 4a3edefbb..eb1976430 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -169,6 +169,7 @@ functional_tests_scripts = [
   'regression-484.sh',
   'regression-reference-checks.sh',
   'redirected-filter-source.sh',
+  'daemon-trust.sh',
 ]
 
 # Plugin tests require shared libraries support.