From f306c2d01c02c830eccb7b65f80ec10b5b2e1db9 Mon Sep 17 00:00:00 2001
From: 0xrsydn <rafayrussani@gmail.com>
Date: Thu, 27 Aug 2026 19:20:30 +0700
Subject: [PATCH] fix(homebrew): own trust store files to user (root-created
 files blocked brew writes)

---
 modules/darwin/homebrew.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/modules/darwin/homebrew.nix b/modules/darwin/homebrew.nix
index 1fb64bb..518171c 100644
--- a/modules/darwin/homebrew.nix
+++ b/modules/darwin/homebrew.nix
@@ -77,8 +77,12 @@ in
       ${pkgs.python3}/bin/python3 - <<'PY'
       import json
       import os
+      import pwd
 
       home = "${userHome}"
+      user = "${user}"
+      uid = pwd.getpwnam(user).pw_uid
+      gid = pwd.getpwnam(user).pw_gid
       rel_paths = [
         os.path.join(".homebrew", "trust.json"),
         os.path.join(".config", "homebrew", "trust.json"),
@@ -100,6 +104,13 @@ in
         with open(path, "w") as fh:
             json.dump(data, fh, indent=2)
             fh.write("\n")
+        try:
+            os.chmod(path, 0o600)
+            os.chown(path, uid, gid)
+        except OSError:
+            # Not running as root (e.g. standalone activation); brew will
+            # still read the file, it just may not be able to rewrite it.
+            pass
       PY
     '';
   };