From 8362b1826bfcf4c599adf9f06c593389f76ad930 Mon Sep 17 00:00:00 2001 From: Alex James Date: Thu, 10 Jul 2025 14:08:47 -0500 Subject: [PATCH] nodejs: fix `checkPhase` with `sandbox=relaxed` on Darwin The following tests fail on Darwin with the sandbox enabled [1]: not ok 2612 parallel/test-runner-output not ok 3053 parallel/test-tls-get-ca-certificates-system not ok 3054 parallel/test-tls-get-ca-certificates-system-without-flag not ok 3363 parallel/test-watch-file-shared-dependency not ok 4057 parallel/test-runner-complex-dependencies not ok 4058 parallel/test-runner-global-setup-watch-mode not ok 4228 sequential/test-watch-mode-watch-flags Node.js uses Security.framework to read the system CA certificates from the system keychain on Darwin. Fix the tls-get-ca-certificates-system tests by adding the files and Mach services used by Security.framework to the sandbox profile. Also allow the FSEvents Mach service as the runner and watch tests use FSEvents on Darwin. [1]: https://gist.github.com/al3xtjames/0eb3c30d37c1ebab99968c62ee544300 --- pkgs/development/web/nodejs/nodejs.nix | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix index 08f159b3fbd0..316e7af9550b 100644 --- a/pkgs/development/web/nodejs/nodejs.nix +++ b/pkgs/development/web/nodejs/nodejs.nix @@ -427,6 +427,27 @@ let }" ]; + sandboxProfile = '' + (allow file-read* + (literal "/Library/Keychains/System.keychain") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (literal "/private/var/db/mds/system/mdsObject.db")) + + ; Allow files written by Module Directory Services (MDS), which is used + ; by Security.framework: https://apple.stackexchange.com/a/411476 + ; These rules are based on the system sandbox profiles found in + ; /System/Library/Sandbox/Profiles. + (allow file-write* + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_?$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$")) + + (allow mach-lookup + (global-name "com.apple.FSEvents") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.system.opendirectoryd.membership")) + ''; + postInstall = let # nodejs_18 does not have node_js2c, and we don't want to rebuild the other ones