From 1f47ecef4ef5f67b34653b9c61d6d99b2720eb44 Mon Sep 17 00:00:00 2001
From: WeetHet <stas.ale66@gmail.com>
Date: Sun, 3 Aug 2025 13:33:58 +0300
Subject: [PATCH] libstore/build: adjust setupConfiguredCertificateAuthority

Always use tmpDir on darwin. Call setupConfiguredCertificateAuthority even if useChroot = 1 on non-linux.
Even though macOS builds are not executed in a chroot, enabling the sandbox
sets `useChroot = 1`. Basically, useChroot is set when the sandbox is enabled,
not really when a chroot build is executed

Change-Id: I8d4c1e617abcc05dfabd998a8ce94bb11587f9d1
---
 lix/libstore/build/local-derivation-goal.cc | 23 ++++++++++++---------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc
index e882cae47..be1240ce5 100644
--- a/lix/libstore/build/local-derivation-goal.cc
+++ b/lix/libstore/build/local-derivation-goal.cc
@@ -911,7 +911,15 @@ void LocalDerivationGoal::setupConfiguredCertificateAuthority()
 {
     if (settings.caFile != "") {
         if (pathAccessible(settings.caFile)) {
-            auto prefix = useChroot ? chrootRootDir : tmpDir;
+            auto prefix = useChroot ?
+#if __linux__
+                                    chrootRootDir
+#elif __APPLE__
+                                    tmpDir
+#else
+#error "Your platform has no known behavior under `useChroot` flag"
+#endif
+                                    : tmpDir;
             debug(
                 "rendering visible configured CA '%s' in the builder (prefix directory: '%s')",
                 settings.caFile,
@@ -1102,6 +1110,10 @@ void LocalDerivationGoal::runChild()
             } catch (SysError &) { }
         }
 
+        if (!derivationType->isSandboxed()) {
+            setupConfiguredCertificateAuthority();
+        }
+
 #if __linux__
         if (useChroot) {
 
@@ -1242,8 +1254,6 @@ void LocalDerivationGoal::runChild()
                         "non-functional."
                     );
                 }
-
-                setupConfiguredCertificateAuthority();
             }
 
             for (auto & i : ss) pathsInChroot.emplace(i, i);
@@ -1399,13 +1409,6 @@ void LocalDerivationGoal::runChild()
         }
 #endif
 
-        if (!useChroot) {
-            /* When chroot is not used, FODs still requires a CA to be available as well. */
-            if (!derivationType->isSandboxed()) {
-                setupConfiguredCertificateAuthority();
-            }
-        }
-
         if (chdir(tmpDirInSandbox.c_str()) == -1)
             throw SysError("changing into '%1%'", tmpDir);