From b452edc74c44aff69a6e631dbc6dbb8d6e758418 Mon Sep 17 00:00:00 2001
From: Dmitry <1315874+dniku@users.noreply.github.com>
Date: Thu, 4 Jun 2026 14:53:27 +0100
Subject: [PATCH] Remove escapeShellArg in reading secret source

Sometimes secret source contains env vars, which are incorrectly escaped.
---
 lib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/default.nix b/lib/default.nix
index 255ebf1..8e95375 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -60,7 +60,7 @@ let
           if isNull transform then x: x else transform;
       in
       lib.attrsets.nameValuePair (secretName secret.name) (
-        (t secret) "$(cat ${escapeShellArg (toString secret.source)})"
+        (t secret) "$(cat ${toString secret.source})"
       );
 
     replaceSecretsScript =