feat(nix-on-droid): add rish module

- Adds `su` and `sudo` commands
- Piggy-backs off of `Shizuku`
- Uses a modified `rish` script
  (static paths, `LD_PRELOAD` clearing)
  (also `TODO` for more `tsu` features)
- Fetches the `rish_shizuku.dex` from the Shizuku `apk`
  (which itself is fetched from the GitHub release)

modules/nix-on-droid/rish/default.nix

@@ -0,0 +1,85 @@
+{ lib, pkgs, config, ... }:
+
+let
+  dex = pkgs.stdenv.mkDerivation {
+    name = "rish-shizuku-dex";
+
+    src = pkgs.fetchurl {
+      url = "https://github.com/RikkaApps/Shizuku/releases/download/v13.5.4/shizuku-v13.5.4.r1049.0e53409-release.apk";
+      hash = "sha256-oFgyzjcWr7H8zPRvNIAG0qKWynd+H/PSI3l9x00Gsx8=";
+    };
+
+    unpackPhase = ''
+      ${lib.getExe pkgs.unzip} -j $src "assets/rish_shizuku.dex"
+    '';
+
+    installPhase = ''
+      cp rish_shizuku.dex $out
+      chmod 400 $out
+    '';
+
+    passthru.updateScript = pkgs.callPackage ./update-script.nix { };
+  };
+  rish = pkgs.writeShellScriptBin "rish" ''
+    #!/bin/sh
+    DEX="${dex.outPath}"
+
+    # Clear `LD_PRELOAD` (could have `/nix/store` paths)
+    export LD_PRELOAD=
+
+    if [ ! -f "$DEX" ]; then
+      echo "Cannot find $DEX, please check the tutorial in Shizuku app"
+      exit 1
+    fi
+
+    # NOTE: already done in `dex` derivarion
+    # if [ $(/system/bin/getprop ro.build.version.sdk) -ge 34 ]; then
+    #   if [ -w $DEX ]; then
+    #     echo "On Android 14+, app_process cannot load writable dex."
+    #     echo "Attempting to remove the write permission..."
+    #     chmod 400 $DEX
+    #   fi
+    #   if [ -w $DEX ]; then
+    #     echo "Cannot remove the write permission of $DEX."
+    #     echo "You can copy to file to terminal app's private directory (/data/data/<package>, so that remove write permission is possible"
+    #     exit 1
+    #   fi
+    # fi
+
+    # Replace "PKG" with the application id of your terminal app
+    [ -z "$RISH_APPLICATION_ID" ] && export RISH_APPLICATION_ID="com.termux.nix"
+
+    # Restrict `PATH` to root-only binaries
+    export PATH="/bin:/system/bin"
+
+    # TODO: mimic `tsu` more (custom `$HOME`, maybe running `login`)
+
+    /system/bin/app_process \
+      -Djava.class.path="$DEX" \
+      /system/bin \
+      --nice-name=rish \
+      rikka.shizuku.shell.ShizukuShellLoader \
+      "$@"
+  '';
+
+  su = pkgs.writeShellScriptBin "su" ''
+    ${lib.getExe rish}
+  '';
+  sudo = pkgs.writeShellScriptBin "sudo" ''
+    ${lib.getExe rish} -c "''${@}"
+  '';
+in
+{
+  options.rish = lib.mkOption {
+    type = lib.types.bool;
+    description ="Whether to enable `su`/`sudo` wrappers of Shizuku's `rish`";
+    default = true;
+  };
+
+  config = lib.mkIf config.rish {
+    environment.packages = [
+      su
+      sudo
+    ];
+  };
+}

modules/nix-on-droid/rish/update_script.nix

@@ -0,0 +1,47 @@
+{ lib
+, writeShellScript
+, coreutils
+, bash
+, curl
+, jq
+, gnugrep
+, gnused
+, nix
+}:
+
+writeShellScript "update-shizuku" ''
+  set -euo pipefail
+
+  # Get the latest release information from GitHub API
+  latest_release=$(${lib.getExe' curl "curl"} -s https://api.github.com/repos/RikkaApps/Shizuku/releases/latest)
+
+  # Extract version
+  version=$(echo "$latest_release" | ${lib.getExe' jq "jq"} -r '.tag_name' | ${lib.getExe' gnused "sed"} 's/^v//')
+
+  # Find the APK asset URL
+  apk_url=$(echo "$latest_release" | \
+    ${lib.getExe' jq "jq"} -r '.assets[] | select(.name | endswith(".apk")) | .browser_download_url')
+
+  # Download the APK to get its hash
+  hash=$(${lib.getExe' nix "nix-prefetch-url"} "$apk_url" 2>/dev/null)
+
+  # Update the package expression
+  sed_script="
+    s|version = \"[0-9.]*\"|version = \"$version\"|
+    s|url = \".*\"|url = \"$apk_url\"|
+    s|hash = \".*\"|hash = \"$hash\"|
+  "
+
+  # Path to the package expression
+  expr_file="default.nix"
+
+  if [ -f "$expr_file" ]; then
+    ${lib.getExe' gnused "sed"} -i "$sed_script" "$expr_file"
+    echo "Updated $expr_file to version $version"
+    echo "New URL: $apk_url"
+    echo "New hash: $hash"
+  else
+    echo "Error: Could not find package expression at $expr_file"
+    exit 1
+  fi
+''