From 5a4da16094b6a126a7073f6ab7d20e8a060459e6 Mon Sep 17 00:00:00 2001 From: Stanislav Alekseev Date: Wed, 26 Mar 2025 10:27:58 +0000 Subject: [PATCH] Revert "fix: allow access to ca-certs in FODs on darwin" This reverts commit 692de16113390988f0dc82eb650ec12779958a20. Reason for revert: it's wrong at it doesn't actually work Change-Id: I495eed65bb7547ceffe98f979633c080e83ac154 --- doc/manual/change-authors.yml | 3 --- doc/manual/rl-next/darwin-ca-certs-sandbox.md | 11 ----------- lix/libstore/build/local-derivation-goal.cc | 6 +----- 3 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 doc/manual/rl-next/darwin-ca-certs-sandbox.md diff --git a/doc/manual/change-authors.yml b/doc/manual/change-authors.yml index da7e58023..2f9fddf33 100644 --- a/doc/manual/change-authors.yml +++ b/doc/manual/change-authors.yml @@ -36,9 +36,6 @@ Qyriad: SharzyL: github: SharzyL -WeetHet: - forgejo: WeetHet - alois31: forgejo: alois31 github: alois31 diff --git a/doc/manual/rl-next/darwin-ca-certs-sandbox.md b/doc/manual/rl-next/darwin-ca-certs-sandbox.md deleted file mode 100644 index 28d7578c7..000000000 --- a/doc/manual/rl-next/darwin-ca-certs-sandbox.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -synopsis: "Fix CA certificates access in macOS sandboxed builds" -cls: [2869] -category: Fixes -credits: [WeetHet] ---- - -Fixed an issue on macOS where fixed-output derivations that needed network access could not access the CA certificate. -The sandbox profile now explicitly allows access to the configured CA file when a fixed output derivation is built. - -This fixes `pkgs.fetchgit`, `fetchCargoVendor` and many others when run with `sandbox = true` diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index 27bc442bf..869cecec3 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -1831,14 +1831,10 @@ void LocalDerivationGoal::runChild() #include "sandbox-defaults.sb" ; - if (!derivationType->isSandboxed()) { + if (!derivationType->isSandboxed()) sandboxProfile += #include "sandbox-network.sb" ; - if (settings.caFile != "") { - sandboxProfile += fmt("(allow file-read* %s)\n", settings.caFile); - } - } /* Add the output paths we'll use at build-time to the chroot */ sandboxProfile += "(allow file-read* file-write* process-exec\n";