From 1bc6e6c0954a2089f067fac8cc43fa65a7d204cc Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Thu, 10 Jul 2025 20:45:15 -0500
Subject: [PATCH] nodejs: use sigtool's codesign in test-macos-app-sandbox

test-macos-app-sandbox uses the system-provided codesign binary
(/usr/bin/codesign) to apply entitlements to an app bundle. This fails
in the sandbox as /usr/bin/codesign is not accessible. Patch the test to
instead use the codesign binary from sigtool. The test was updated to
pass the executable path to codesign as sigtool can't handle the bundle
path.
---
 pkgs/development/web/nodejs/nodejs.nix         |  8 +++++++-
 .../web/nodejs/use-nix-codesign.patch          | 18 ++++++++++++++++++
 pkgs/development/web/nodejs/v20.nix            |  1 +
 pkgs/development/web/nodejs/v22.nix            |  1 +
 pkgs/development/web/nodejs/v24.nix            |  1 +
 5 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/web/nodejs/use-nix-codesign.patch

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index b4192a98008b..08f159b3fbd0 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -28,6 +28,7 @@
   runtimeShell,
   gnupg,
   installShellFiles,
+  darwin,
 }:
 
 {
@@ -298,6 +299,11 @@ let
 
       inherit patches;
 
+      postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+        substituteInPlace test/parallel/test-macos-app-sandbox.js \
+          --subst-var-by codesign '${darwin.sigtool}/bin/codesign'
+      '';
+
       __darwinAllowLocalNetworking = true; # for tests
 
       doCheck = canExecute;
@@ -391,7 +397,7 @@ let
             ]
             ++ lib.optionals stdenv.buildPlatform.isDarwin [
               # Disable tests that don’t work under macOS sandbox.
-              "test-macos-app-sandbox"
+              # uv_os_setpriority returned EPERM (operation not permitted)
               "test-os"
               "test-os-process-priority"
 
diff --git a/pkgs/development/web/nodejs/use-nix-codesign.patch b/pkgs/development/web/nodejs/use-nix-codesign.patch
new file mode 100644
index 000000000000..3d95a000d5e2
--- /dev/null
+++ b/pkgs/development/web/nodejs/use-nix-codesign.patch
@@ -0,0 +1,18 @@
+diff --git a/test/parallel/test-macos-app-sandbox.js b/test/parallel/test-macos-app-sandbox.js
+index 60ad67b3db..b6ac0dcef4 100644
+--- a/test/parallel/test-macos-app-sandbox.js
++++ b/test/parallel/test-macos-app-sandbox.js
+@@ -45,11 +45,11 @@ fs.copyFileSync(
+ 
+ // Sign the app bundle with sandbox entitlements:
+ assert.strictEqual(
+-  child_process.spawnSync('/usr/bin/codesign', [
++  child_process.spawnSync('@codesign@', [
+     '--entitlements', fixtures.path(
+       'macos-app-sandbox', 'node_sandboxed.entitlements'),
+     '--force', '-s', '-',
+-    appBundlePath,
++    appExecutablePath,
+   ]).status,
+   0);
+ 
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index c79e37c98c39..56fc4c4ac2c6 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -42,6 +42,7 @@ buildNodejs {
     ./configure-armv6-vfpv2.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
+    ./use-nix-codesign.patch
 
     # TODO: remove when included in a release
     (fetchpatch2 {
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 0ad029f5a153..49066f95d19a 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -59,6 +59,7 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
 
       # TODO: remove when included in a release
       (fetchpatch2 {
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index b8fd3ce679c5..4982172f2ef2 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -58,6 +58,7 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [