Merge changes Icf26010a,Ib6161567 into main

* changes:
  Always initialize curl in parent process on darwin
  Fix failing darwin tests

misc/launchd/org.nixos.nix-daemon.plist.in

@@ -2,11 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <key>EnvironmentVariables</key>
-    <dict>
-      <key>OBJC_DISABLE_INITIALIZE_FORK_SAFETY</key>
-      <string>YES</string>
-    </dict>
     <key>Label</key>
     <string>org.nixos.nix-daemon</string>
     <key>KeepAlive</key>

package.nix

@@ -398,10 +398,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonInstallCheckFlags = [ "--suite=installcheck" ];
 
-  preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
-  '';
-
   installCheckPhase = lib.optionalString buildWithMeson ''
     runHook preInstallCheck
     flagsArray=($mesonInstallCheckFlags "''${mesonInstallCheckFlagsArray[@]}")

src/libstore/globals.cc

@@ -25,6 +25,7 @@
 #include "config-impl.hh"
 
 #ifdef __APPLE__
+#include <curl/curl.h>
 #include <sys/sysctl.h>
 #endif
 
@@ -409,10 +410,21 @@ void initLibStore() {
 
     preloadNSS();
 
+#if __APPLE__
+    /* Because of an objc quirk[1], calling curl_global_init for the first time
+       after fork() will always result in a crash.
+       Up until now the solution has been to set OBJC_DISABLE_INITIALIZE_FORK_SAFETY
+       for every nix process to ignore that error.
+       Instead of working around that error we address it at the core -
+       by calling curl_global_init here, which should mean curl will already
+       have been initialized by the time we try to do so in a forked process.
+
+       [1] https://github.com/apple-oss-distributions/objc4/blob/01edf1705fbc3ff78a423cd21e03dfc21eb4d780/runtime/objc-initialize.mm#L614-L636
+    */
+    curl_global_init(CURL_GLOBAL_ALL);
     /* On macOS, don't use the per-session TMPDIR (as set e.g. by
        sshd). This breaks build users because they don't have access
        to the TMPDIR, in particular in ‘nix-store --serve’. */
-#if __APPLE__
     if (getEnv("TMPDIR").value_or("/tmp").starts_with("/var/folders/"))
         unsetenv("TMPDIR");
 #endif

tests/functional/bash-profile.sh

@@ -2,7 +2,7 @@ source common.sh
 
 sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
 
-user=$(whoami)
+user=$(whoami || echo -n nixbld)
 rm -rf $TEST_HOME $TEST_ROOT/profile-var
 mkdir -p $TEST_HOME
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh; set"

tests/functional/init.sh

@@ -28,7 +28,7 @@ substituters =
 flake-registry = $TEST_ROOT/registry.json
 show-trace = true
 include nix.conf.extra
-trusted-users = $(whoami)
+trusted-users = $(whoami || id -u)
 EOF
 
 cat > "$NIX_CONF_DIR"/nix.conf.extra <<EOF