From 2ca19ba6eed74de98988416322fe03b5b80ad59b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Tue, 5 Aug 2025 18:39:37 +0100
Subject: [PATCH] pinentry_mac: fix the build with `sandbox = true`

---
 .../fix-with-xcbuild-plistbuddy.patch         | 21 +++++++++++++++++++
 pkgs/tools/security/pinentry/mac.nix          | 12 ++++++-----
 2 files changed, 28 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch

diff --git a/pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch b/pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch
new file mode 100644
index 000000000000..3af1da2319de
--- /dev/null
+++ b/pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch
@@ -0,0 +1,21 @@
+diff --git a/macosx/copyInfoPlist.sh b/macosx/copyInfoPlist.sh
+index f366665153..dfd9511e79 100755
+--- a/macosx/copyInfoPlist.sh
++++ b/macosx/copyInfoPlist.sh
+@@ -20,9 +20,10 @@
+ cp "$1" "$dest" || exit 1
+ 
+ 
+-/usr/libexec/PlistBuddy \
+-	-c "Set CommitHash '${COMMIT_HASH:--}'" \
+-	-c "Set BuildNumber '${BUILD_NUMBER:-0}'" \
+-	-c "Set CFBundleVersion '${BUILD_VERSION:-0n}'" \
+-	-c "Set CFBundleShortVersionString '$VERSION'" \
+-	"$dest" || exit 1
++PlistBuddy "$dest" <<EOF || exit 1
++    Set CommitHash "${COMMIT_HASH:--}"
++    Set BuildNumber "${BUILD_NUMBER:-0}"
++    Set CFBundleVersion "${BUILD_VERSION:-0n}"
++    Set CFBundleShortVersionString "$VERSION"
++    Save
++EOF
diff --git a/pkgs/tools/security/pinentry/mac.nix b/pkgs/tools/security/pinentry/mac.nix
index 59e5f1cad613..17978b0ae856 100644
--- a/pkgs/tools/security/pinentry/mac.nix
+++ b/pkgs/tools/security/pinentry/mac.nix
@@ -7,6 +7,7 @@
   libgpg-error,
   makeBinaryWrapper,
   texinfo,
+  xcbuild,
   common-updater-scripts,
   writers,
 }:
@@ -27,6 +28,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gettext-0.25.patch
+
+    # Fix the build with xcbuild’s inferior `PlistBuddy(8)`.
+    ./fix-with-xcbuild-plistbuddy.patch
   ];
 
   # use pregenerated nib files because generating them requires XCode
@@ -38,16 +42,14 @@ stdenv.mkDerivation rec {
     cp '${lib.getDev libassuan}/share/aclocal/libassuan.m4' m4/libassuan.m4
   '';
 
-  # Unfortunately, PlistBuddy from xcbuild is not compatible enough pinentry-mac’s build process.
-  sandboxProfile = ''
-    (allow process-exec (literal "/usr/libexec/PlistBuddy"))
-  '';
-
   strictDeps = true;
   nativeBuildInputs = [
     autoreconfHook
     makeBinaryWrapper
     texinfo
+
+    # for `PlistBuddy(8)`
+    xcbuild
   ];
 
   configureFlags = [