pinentry_mac: fix the build with sandbox = true (#431236)

pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch

@@ -0,0 +1,21 @@
+diff --git a/macosx/copyInfoPlist.sh b/macosx/copyInfoPlist.sh
+index f366665153..dfd9511e79 100755
+--- a/macosx/copyInfoPlist.sh
++++ b/macosx/copyInfoPlist.sh
+@@ -20,9 +20,10 @@
+ cp "$1" "$dest" || exit 1
+ 
+ 
+-/usr/libexec/PlistBuddy \
+-	-c "Set CommitHash '${COMMIT_HASH:--}'" \
+-	-c "Set BuildNumber '${BUILD_NUMBER:-0}'" \
+-	-c "Set CFBundleVersion '${BUILD_VERSION:-0n}'" \
+-	-c "Set CFBundleShortVersionString '$VERSION'" \
+-	"$dest" || exit 1
++PlistBuddy "$dest" <<EOF || exit 1
++    Set CommitHash "${COMMIT_HASH:--}"
++    Set BuildNumber "${BUILD_NUMBER:-0}"
++    Set CFBundleVersion "${BUILD_VERSION:-0n}"
++    Set CFBundleShortVersionString "$VERSION"
++    Save
++EOF

pkgs/tools/security/pinentry/mac.nix

@@ -7,6 +7,7 @@
   libgpg-error,
   makeBinaryWrapper,
   texinfo,
+  xcbuild,
   common-updater-scripts,
   writers,
 }:
@@ -27,6 +28,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gettext-0.25.patch
+
+    # Fix the build with xcbuild’s inferior `PlistBuddy(8)`.
+    ./fix-with-xcbuild-plistbuddy.patch
   ];
 
   # use pregenerated nib files because generating them requires XCode
@@ -38,16 +42,14 @@ stdenv.mkDerivation rec {
     cp '${lib.getDev libassuan}/share/aclocal/libassuan.m4' m4/libassuan.m4
   '';
 
-  # Unfortunately, PlistBuddy from xcbuild is not compatible enough pinentry-mac’s build process.
-  sandboxProfile = ''
-    (allow process-exec (literal "/usr/libexec/PlistBuddy"))
-  '';
-
   strictDeps = true;
   nativeBuildInputs = [
     autoreconfHook
     makeBinaryWrapper
     texinfo
+
+    # for `PlistBuddy(8)`
+    xcbuild
   ];
 
   configureFlags = [