nixos/utils: support JSON secret files in genJqSecretsReplacementSnippet

[linyinfeng]

Description of changes

An alternative to #324955.

genJqReplacementSnippet quotes the content of the secret file in the
output json file, which prevents structured secret, such as a list or
an object, from being used.

This PR adds a quote = true|false option to the { _secret = "/path/to/secret"; } attribute set. quote = true threats the content of /path/to/secret as string, while quote = false threats the content of /path/to/secret as a JSON document.

quote = true is the default, so this PR maintains backward compatibility.

# demo.nix

let
  demoNixpkgs = fetchTarball "https://github.com/linyinfeng/nixpkgs/archive/refs/heads/json-secrets.zip";
  pkgs = import demoNixpkgs {};
  inherit (pkgs) lib;
  utils = import "${demoNixpkgs}/nixos/lib/utils.nix" {
    inherit lib pkgs;
    config = null;
  };
  settings = {
    example = [
      {
        irrelevant = "not interesting";
      }
      {
        ignored = "ignored attr";
        relevant = {
          secretString1 = {
            _secret = pkgs.writeText "password1" "secret-quote-1";
            # quote = true is the default
          };
          secretString2 = {
            _secret = pkgs.writeText "password2" "secret-quote-2";
            quote = true;
          };
          secretJson = {
            _secret = pkgs.writeText "password3" (builtins.toJSON {
              p1 = "supersecret";
              p2 = [2 3];
            });
            quote = false;
          };
        };
      }
    ];
  };
  snippet = utils.genJqSecretsReplacementSnippet settings;
in
pkgs.runCommand "test.json" {} ''
  ${snippet "result.json"}
  cp result.json "$out"
''

$ nix-build ./demo.nix && cat result
/nix/store/36rgaa21gml1xl0lk3rdm28z3vw1rv84-test.json
{
  "example": [
    {
      "irrelevant": "not interesting"
    },
    {
      "ignored": "ignored attr",
      "relevant": {
        "secretJson": {
          "p1": "supersecret",
          "p2": [
            2,
            3
          ]
        },
        "secretString1": "secret-quote-1",
        "secretString2": "secret-quote-2"
      }
    }
  ]
}

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[jian-lin]

LGTM

Could you add the context (motivation and other things) into the commit message so that it can be accessed without going to github?

[jian-lin]

@ofborg test sing-box lemmy engelsystem artalk discourse

filebeat does not have a NixOS test.

netbird's NixOS test does not use secrets.

gitlab's NixOS test is flaky.