Better chess, cuda maintainers fix, elfeed update

features/encryption/default.nix

@@ -39,6 +39,15 @@
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;
       home.file.".gnupg/sshcontrol".source = ./sshcontrol;
+
+      # home-manager creates ~/.gnupg (via the files above) with the default
+      # umask, which can leave it group/other-readable. gpg refuses to trust
+      # a homedir like that and prints an "unsafe permissions" warning on
+      # every invocation, which pollutes anything that captures gpg/pass
+      # output (e.g. shell-command-to-string). Enforce 700 on every switch.
+      home.activation.gnupgPerms = lib.hm.dag.entryAfter ["writeBoundary"] ''
+        $DRY_RUN_CMD chmod 700 "$HOME/.gnupg"
+      '';
     };
   };
 }