zarf: fix shell completions on Darwin

pkgs/by-name/za/zarf/package.nix

@@ -2,7 +2,9 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  iana-etc,
   installShellFiles,
+  libredirect,
   stdenv,
 }:
 
@@ -20,7 +22,10 @@ buildGoModule rec {
   vendorHash = "sha256-As7xDEo+bMslv9Xd6CbHTqvf2XaXmO6Gp3f9+xD3kNU=";
   proxyVendor = true;
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ libredirect.hook ];
 
   preBuild = ''
     mkdir -p build/ui
@@ -43,17 +48,17 @@ buildGoModule rec {
     "k8s.io/component-base/version.buildDate=1970-01-01T00:00:00Z"
   ];
 
-  # Breaks with sandbox on Darwin because it wants to read /etc/protocols
   postInstall =
     lib.optionalString
-      ((stdenv.buildPlatform.canExecute stdenv.hostPlatform) && !stdenv.buildPlatform.isDarwin)
-      ''
-        export K9S_LOGS_DIR=$(mktemp -d)
-        installShellCompletion --cmd zarf \
-          --bash <($out/bin/zarf completion bash) \
-          --fish <($out/bin/zarf completion fish) \
-          --zsh  <($out/bin/zarf completion zsh)
-      '';
+      (stdenv.buildPlatform.canExecute stdenv.hostPlatform && stdenv.hostPlatform.isDarwin)
+      "export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/services=${iana-etc}/etc/services"
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      export K9S_LOGS_DIR=$(mktemp -d)
+      installShellCompletion --cmd zarf \
+        --bash <($out/bin/zarf completion bash) \
+        --fish <($out/bin/zarf completion fish) \
+        --zsh  <($out/bin/zarf completion zsh)
+    '';
 
   meta = with lib; {
     description = "DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev";