age-plugin-tpm: 0.2.0 -> 0.3.0

[josh]

Upgrades age-plugin-tpm to 0.3.0.

What's really neat about this new version is it adds support for encrypting secrets on machines without a TPM—or even non-Linux. So you can encrypt secrets locally on a MacBook Pro and decrypt them only on your Linux server with that TPM. So I relaxed the Linux only platform requirement.

Other side note, it appears the test suite needs an age binary in the PATH, so I added that as a nativeCheckInputs dependency.

If maintainers think it would be useful, should I add a trivial passthru.test.encrypt?

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[stigtsp]

Cc @Foxboron

[Foxboron]

@stigtsp LGTM :)

[stigtsp]

If maintainers think it would be useful, should I add a trivial passthru.test.encrypt?

Some NixOS tests could be nice, we also have virtual TPM support for them if you'd like to test decrypt as well.

[josh]

Some NixOS tests could be nice, we also have virtual TPM support for them if you'd like to test decrypt as well.

Oh nice. I'll give that a shot.

[josh]

First time writing a nixpkgs nixosTest, this stuff is pretty cool.

Alright, so now we've got two smoke tests.

1. Platform native encrypt test, should run anywhere regardless of tpm
2. nixos vm test with virtualisation.tpm.enable, actually tests the full decryption path

[josh]

Pushed changes applying feedback. Thanks all!