From 0671e652896d868474ae7ba3fd521910615e6c58 Mon Sep 17 00:00:00 2001
From: 0xrsydn <rafayrussani@gmail.com>
Date: Thu, 27 Aug 2026 18:53:00 +0700
Subject: [PATCH] fix(homebrew): declaratively trust owo-network/brew tap

---
 modules/darwin/homebrew.nix | 49 +++++++++++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/modules/darwin/homebrew.nix b/modules/darwin/homebrew.nix
index b69fed2..1fb64bb 100644
--- a/modules/darwin/homebrew.nix
+++ b/modules/darwin/homebrew.nix
@@ -1,7 +1,19 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  user,
+  ...
+}:
 let
-  inherit (lib) mkIf mkOption types;
+  inherit (lib)
+    mkIf
+    mkOption
+    mkAfter
+    types
+    ;
   cfg = config.rsydn.homebrew;
+  userHome = config.users.users.${user}.home;
 in
 {
   options.rsydn.homebrew = {
@@ -57,5 +69,38 @@ in
       };
       inherit (cfg) taps brews casks;
     };
+
+    # nix-darwin runs `brew bundle` via `sudo --user … --set-home env`, which
+    # strips XDG_CONFIG_HOME, so brew reads trust state from `${HOME}/.homebrew/trust.json`.
+    # Keep that file (and the XDG one used by interactive shells) in sync.
+    system.activationScripts.extraActivation.text = mkAfter ''
+      ${pkgs.python3}/bin/python3 - <<'PY'
+      import json
+      import os
+
+      home = "${userHome}"
+      rel_paths = [
+        os.path.join(".homebrew", "trust.json"),
+        os.path.join(".config", "homebrew", "trust.json"),
+      ]
+      entry = "owo-network/brew"
+
+      for rel in rel_paths:
+        path = os.path.join(home, rel)
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        data = {"trustedtaps": []}
+        try:
+            with open(path) as fh:
+                data = json.load(fh)
+        except Exception:
+            pass
+        data.setdefault("trustedtaps", [])
+        if entry not in data["trustedtaps"]:
+            data["trustedtaps"].append(entry)
+        with open(path, "w") as fh:
+            json.dump(data, fh, indent=2)
+            fh.write("\n")
+      PY
+    '';
   };
 }