Merge "fix: allow access to ca-certs in FODs on darwin" into main

doc/manual/change-authors.yml

@@ -36,6 +36,9 @@ Qyriad:
 SharzyL:
   github: SharzyL
 
+WeetHet:
+  forgejo: WeetHet
+
 alois31:
   forgejo: alois31
   github: alois31

doc/manual/rl-next/darwin-ca-certs-sandbox.md

@@ -0,0 +1,11 @@
+---
+synopsis: "Fix CA certificates access in macOS sandboxed builds"
+cls: [2869]
+category: Fixes
+credits: [WeetHet]
+---
+
+Fixed an issue on macOS where fixed-output derivations that needed network access could not access the CA certificate.
+The sandbox profile now explicitly allows access to the configured CA file when a fixed output derivation is built.
+
+This fixes `pkgs.fetchgit`, `fetchCargoVendor` and many others when run with `sandbox = true`

lix/libstore/build/local-derivation-goal.cc

@@ -1831,10 +1831,14 @@ void LocalDerivationGoal::runChild()
                 #include "sandbox-defaults.sb"
                 ;
 
-            if (!derivationType->isSandboxed())
+            if (!derivationType->isSandboxed()) {
                 sandboxProfile +=
                     #include "sandbox-network.sb"
                     ;
+                if (settings.caFile != "") {
+                    sandboxProfile += fmt("(allow file-read* %s)\n", settings.caFile);
+                }
+            }
 
             /* Add the output paths we'll use at build-time to the chroot */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";