From f09ed729b5dcacbbff5e1ae6f85bc93933ecf2f1 Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Mon, 2 Feb 2026 14:43:35 +0100
Subject: [PATCH] libstore: generate darwin sandbox profile outside of sandbox
 process

Change-Id: I1a82e1dfa3709e1513d7acbdff50dc594cbc2323
---
 lix/libstore/platform/darwin.cc | 7 +++++--
 lix/libstore/platform/darwin.hh | 7 ++++---
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/lix/libstore/platform/darwin.cc b/lix/libstore/platform/darwin.cc
index 6b7c3a152..a078f9f3d 100644
--- a/lix/libstore/platform/darwin.cc
+++ b/lix/libstore/platform/darwin.cc
@@ -254,10 +254,10 @@ try {
     co_return result::current_exception();
 }
 
-void DarwinLocalDerivationGoal::finishChildSetup()
+void DarwinLocalDerivationGoal::prepareSandbox()
 {
     /* This has to appear before import statements. */
-    std::string sandboxProfile = "(version 1)\n";
+    sandboxProfile = "(version 1)\n";
 
     if (useChroot) {
 
@@ -369,7 +369,10 @@ void DarwinLocalDerivationGoal::finishChildSetup()
     }
 
     debug("Generated sandbox profile: %1%", sandboxProfile);
+}
 
+void DarwinLocalDerivationGoal::finishChildSetup()
+{
     bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");
 
     /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try
diff --git a/lix/libstore/platform/darwin.hh b/lix/libstore/platform/darwin.hh
index eeffe7dc4..0ac6c8c4f 100644
--- a/lix/libstore/platform/darwin.hh
+++ b/lix/libstore/platform/darwin.hh
@@ -37,11 +37,12 @@ public:
     using LocalDerivationGoal::LocalDerivationGoal;
 
 private:
+    std::string sandboxProfile;
+
     /**
-     * Prepare the sandbox: This is empty on Darwin since sandbox setup happens in
-     * enterSandbox
+     * Prepare the sandbox: generate the sandboxProfile
      */
-    void prepareSandbox() override{};
+    void prepareSandbox() override;
 
     void finishChildSetup() override;