Merge "Revert "fix: allow access to ca-certs in FODs on darwin"" into main

doc/manual/change-authors.yml

@@ -36,9 +36,6 @@ Qyriad:
 SharzyL:
   github: SharzyL
 
-WeetHet:
-  forgejo: WeetHet
-
 alois31:
   forgejo: alois31
   github: alois31

doc/manual/rl-next/darwin-ca-certs-sandbox.md

@@ -1,11 +0,0 @@
----
-synopsis: "Fix CA certificates access in macOS sandboxed builds"
-cls: [2869]
-category: Fixes
-credits: [WeetHet]
----
-
-Fixed an issue on macOS where fixed-output derivations that needed network access could not access the CA certificate.
-The sandbox profile now explicitly allows access to the configured CA file when a fixed output derivation is built.
-
-This fixes `pkgs.fetchgit`, `fetchCargoVendor` and many others when run with `sandbox = true`

lix/libstore/build/local-derivation-goal.cc

@@ -1831,14 +1831,10 @@ void LocalDerivationGoal::runChild()
                 #include "sandbox-defaults.sb"
                 ;
 
-            if (!derivationType->isSandboxed()) {
+            if (!derivationType->isSandboxed())
                 sandboxProfile +=
                     #include "sandbox-network.sb"
                     ;
-                if (settings.caFile != "") {
-                    sandboxProfile += fmt("(allow file-read* %s)\n", settings.caFile);
-                }
-            }
 
             /* Add the output paths we'll use at build-time to the chroot */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";