[Nix#9625] aarch64-darwin: sandbox issue with /private/etc/ssl/openssl.cnf
#83
Labels
No labels
Area/build-packaging
Area/cli
Area/evaluator
Area/fetching
Area/flakes
Area/language
Area/profiles
Area/protocol
Area/releng
Area/remote-builds
Area/repl
Area/store
bug
crash 💥
Cross Compilation
devx
docs
Downstream Dependents
E/easy
E/hard
E/help wanted
E/reproducible
E/requires rearchitecture
imported
Needs Langver
OS/Linux
OS/macOS
performance
regression
release-blocker
RFD
stability
Status
blocked
Status
invalid
Status
postponed
Status
wontfix
testing
testing/flakey
ux
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: lix-project/lix#83
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Upstream-Issue: NixOS/nix#9625
Describe the bug
Migrating from https://github.com/oxalica/rust-overlay/issues/148
In short, I'm having a new build failure for rust packages using
oxalica/rust-overlay
that seems to be related to a sandboxing issue (as it is giving a permissions error for/private/etc/ssl/openssl.cnf
but succeeds with--option sandbox false
. An identical flake was building without issue previously, so my guess is that it's related to the recently installed MacOS Sonoma 14.2 update.I've been following https://github.com/NixOS/nix/issues/4119 with great interest, so I thought this ?sandbox issue belonged in nixos/nix but would be happy to move elsewhere.
Steps To Reproduce
Run the following with the below
flake.nix
:Expected behavior
Successful build
nix-env --version
outputAdditional context
I'm not finding any relevant issues googling or searching nixpkgs issues for "/private/etc/ssl/openssl.cnf" or "Auto configuration failed".
Full log:
Priorities
Add 👍 to issues you find important.
This was caused by the curl binary from the rust overlay linking against the system libcurl and was fixed in https://github.com/oxalica/rust-overlay/pull/149. There's also a similar issue with nixpkgs's bootstrap cargo, with an open PR (https://github.com/NixOS/nixpkgs/pull/300521) to fix that. I don't believe there's anything for us to do here.
The upstream NixOS/nix issue is still open, but I don't expect them to do anything about this either, so I'm going to go ahead and close it. Derivations should not be invoking tools linked against the system libcurl.