tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1Nix may already sandbox the build, in which case sandbox_apply will fail.
2
3--- a/Sources/Basics/Sandbox.swift
4+++ b/Sources/Basics/Sandbox.swift
5@@ -57,6 +57,8 @@
6 allowNetworkConnections: [SandboxNetworkPermission] = []
7 ) throws -> [String] {
8 #if os(macOS)
9+ let env = ProcessInfo.processInfo.environment
10+ if env["NIX_BUILD_TOP"] == nil || env["IN_NIX_SHELL"] != nil {
11 let profile = try macOSSandboxProfile(
12 fileSystem: fileSystem,
13 strictness: strictness,
14@@ -65,10 +67,10 @@
15 allowNetworkConnections: allowNetworkConnections
16 )
17 return ["/usr/bin/sandbox-exec", "-p", profile] + command
18- #else
19+ }
20+ #endif
21 // rdar://40235432, rdar://75636874 tracks implementing sandboxes for other platforms.
22 return command
23- #endif
24 }
25
26 /// Basic strictness level of a sandbox applied to a command line.
27