Revert "clan-cli: deprecate nix_shell() in favor of run_cmd()"

This reverts commit 37e6ca7a30.

pkgs/clan-cli/clan_cli/secrets/import_sops.py

@@ -11,7 +11,7 @@ from ..completions import (
     complete_users,
 )
 from ..errors import ClanError
-from ..nix import run_cmd
+from ..nix import nix_shell
 from .secrets import encrypt_secret, sops_secrets_folder
 
 
@@ -28,7 +28,7 @@ def import_sops(args: argparse.Namespace) -> None:
         if args.input_type:
             cmd += ["--input-type", args.input_type]
         cmd += ["--output-type", "json", "--decrypt", args.sops_file]
-        cmd = run_cmd(["sops"], cmd)
+        cmd = nix_shell(["nixpkgs#sops"], cmd)
 
         res = run(cmd, error_msg=f"Could not import sops file {file}")
         secrets = json.loads(res.stdout)

pkgs/clan-cli/clan_cli/secrets/sops.py

@@ -12,7 +12,7 @@ from typing import IO
 from ..cmd import Log, run
 from ..dirs import user_config_dir
 from ..errors import ClanError
-from ..nix import run_cmd
+from ..nix import nix_shell
 from .folders import sops_machines_folder, sops_users_folder
 
 
@@ -23,7 +23,7 @@ class SopsKey:
 
 
 def get_public_key(privkey: str) -> str:
-    cmd = run_cmd(["age"], ["age-keygen", "-y"])
+    cmd = nix_shell(["nixpkgs#age"], ["age-keygen", "-y"])
     try:
         res = subprocess.run(
             cmd, input=privkey, stdout=subprocess.PIPE, text=True, check=True
@@ -36,7 +36,7 @@ def get_public_key(privkey: str) -> str:
 
 
 def generate_private_key(out_file: Path | None = None) -> tuple[str, str]:
-    cmd = run_cmd(["age"], ["age-keygen"])
+    cmd = nix_shell(["nixpkgs#age"], ["age-keygen"])
     try:
         proc = run(cmd)
         res = proc.stdout.strip()
@@ -125,8 +125,8 @@ def update_keys(secret_path: Path, keys: list[str]) -> list[Path]:
     with sops_manifest(keys) as manifest:
         secret_path = secret_path / "secret"
         time_before = secret_path.stat().st_mtime
-        cmd = run_cmd(
-            ["sops"],
+        cmd = nix_shell(
+            ["nixpkgs#sops"],
             [
                 "sops",
                 "--config",
@@ -152,7 +152,7 @@ def encrypt_file(
         if not content:
             args = ["sops", "--config", str(manifest)]
             args.extend([str(secret_path)])
-            cmd = run_cmd(["sops"], args)
+            cmd = nix_shell(["nixpkgs#sops"], args)
             # Don't use our `run` here, because it breaks editor integration.
             # We never need this in our UI.
             p = subprocess.run(cmd, check=False)
@@ -180,7 +180,7 @@ def encrypt_file(
                 # we pass an empty manifest to pick up existing configuration of the user
                 args = ["sops", "--config", str(manifest)]
                 args.extend(["-i", "--encrypt", str(f.name)])
-                cmd = run_cmd(["sops"], args)
+                cmd = nix_shell(["nixpkgs#sops"], args)
                 run(cmd, log=Log.BOTH)
                 # atomic copy of the encrypted file
                 with NamedTemporaryFile(dir=folder, delete=False) as f2:
@@ -195,8 +195,8 @@ def encrypt_file(
 
 def decrypt_file(secret_path: Path) -> str:
     with sops_manifest([]) as manifest:
-        cmd = run_cmd(
-            ["sops"],
+        cmd = nix_shell(
+            ["nixpkgs#sops"],
             ["sops", "--config", str(manifest), "--decrypt", str(secret_path)],
         )
     res = run(cmd, error_msg=f"Could not decrypt {secret_path}")