From 045ce4854b5b3efc3dd126a1630439ab56ca1f24 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Wed, 29 Apr 2026 09:32:26 +0100
Subject: [PATCH] nono: 0.35.0 -> 0.43.1

Diff: https://github.com/always-further/nono/compare/v0.35.0...v0.43.1

Changelog: https://github.com/always-further/nono/blob/refs/tags/v0.43.1/CHANGELOG.md
---
 pkgs/by-name/no/nono/package.nix | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index 047da60943cc..7bfc52646cc8 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -13,15 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.35.0";
+  version = "0.43.1";
+
+  __darwinAllowLocalNetworking = true; # required for tests
 
   src = fetchFromGitHub {
     owner = "always-further";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/bKquUbVMM1e/YPcuSb0vW4tX/3yNDUxmaBWHKFw+Qs=";
+    hash = "sha256-a9RwEbe0x49EyBSGX0mBk2GNeWmc6NhanExqbDyTM40=";
   };
-  cargoHash = "sha256-ibGIpH6Ls9nxtF6rRl+dZBbbmVRXDQA6vpPI/jzpDqI=";
+  cargoHash = "sha256-/+CfiWbg3anUbzgGigFxWs0+KavGEa2odo5kBF9c7Wg=";
 
   nativeBuildInputs = [
     pkg-config
@@ -35,7 +37,23 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+  checkFlags = [
+    # fails to initialize the sandbox under '/build'
+    "--skip=test_all_profiles_signal_mode_resolves"
+    # panic
+    "--skip=build_run_profile_patch_adds_override_deny_for_sensitive_file"
+    "--skip=build_run_profile_patch_merges_read_and_write_to_allow_file"
+    "--skip=prepare_profile_save_from_patch_updates_existing_user_profile"
+    "--skip=would_shadow_builtin_allows_update_of_existing_user_override"
+    "--skip=would_shadow_builtin_flags_known_builtin_names"
+    "--skip=create_audit_state_creates_session_when_enabled"
+
+    # audit_attestation
+    # needs /bin/pwd
+    "--skip=audit_verify_reports_signed_attestation_with_pinned_public_key"
+    "--skip=rollback_signed_session_verifies_from_audit_dir_bundle"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # panics with "Deny-within-allow overlap on Linux ... Landlock cannot enforce this. ..."
     # landlock is linux only
     "--skip=policy::tests::test_all_groups_no_deny_within_allow_overlap"
@@ -56,6 +74,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=env_nono_upstream_bypass_comma_separated"
     "--skip=env_nono_upstream_proxy"
     "--skip=legacy_env_nono_net_block_still_works"
+    "--skip=environment_allow_vars_bare_star"
+    "--skip=environment_allow_vars_default_allows_all"
+    "--skip=environment_allow_vars_prefix_patterns"
+    "--skip=environment_allow_vars_with_profile"
   ];
 
   meta = {