cryptsetup: make all programs optional

Some use cases (think appliances) call for veritysetup but not
cryptsetup, and others (like NixOS) don't need veritysetup and usually
not integritysetup.  This is especially useful for pkgsStatic where
each program contains a whole copy of the libraries it needs so is
quite large.

1 files changed, 4 insertions, 2 deletions

diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 0e7988f4d99..acf3ec3f492 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
 , openssl, libuuid, pkg-config, popt, nixosTests
-
+  # Programs enabled by default upstream are implicitly enabled unless
+  # manually set to false.
+, programs ? { cryptsetup-reencrypt = true; }
   # The release tarballs contain precomputed manpage files, so we don't need
   # to run asciidoctor on the man sources. By avoiding asciidoctor, we make
   # the bare NixOS build hash independent of changes to the ruby ecosystem,
@@ -48,7 +50,7 @@ stdenv.mkDerivation rec {
     # support, because the path still gets included in the binary even
     # though it isn't used.
     "--with-luks2-external-tokens-path=/"
-  ];
+  ] ++ (with lib; mapAttrsToList (flip enableFeature)) programs;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
   buildInputs = [ lvm2 json_c openssl libuuid popt ];