From 399da96059c2b7a8a3ca66896d069d1234f80294 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Thu, 2 Apr 2026 19:34:53 -0600
Subject: sys/boot: luks-ext4-fscrypt-impermanence: replace openssl with rage

---
 sys/boot/stack/luks-ext4-fscrypt-impermanence.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
index 81feb60..7905da3 100644
--- a/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
+++ b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
@@ -52,9 +52,10 @@ in {
       key_id=$(${fscryptctl} add_key /mnt-toplevel </boot-key)
       ${fscryptctl} set_policy "$key_id" "$root_from_toplevel"
       (umask 077; test -f /mnt-toplevel/boot-archive.pub && \
-        ${pkgs.openssl}/bin/openssl pkeyutl -encrypt \
-        -in /boot-key -pubin -inkey /mnt-toplevel/boot-archive.pub \
-        -out "/mnt-toplevel/boot-keys/$boot_stamp.key.crypt")
+        ${getExe pkgs.rage} -ae \
+          -R /mnt-toplevel/boot-archive.pub \
+          -o "/mnt-toplevel/boot-keys/$boot_stamp.key.age" \
+          /boot-key)
       rm -f /boot-key
 
       ln -Tsf "$boot_stamp" /mnt-toplevel/boots/last
-- 
cgit v1.2.3