From 23453ae44729734377e35f527eec182cc45d8f2e Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Tue, 14 Apr 2026 17:46:24 +0100
Subject: [PATCH 1/3] nono: 0.5.0 -> 0.35.0

Diff: https://github.com/always-further/nono/compare/v0.5.0...v0.35.0

Changelog: https://github.com/always-further/nono/blob/refs/tags/v0.35.0/CHANGELOG.md

Co-authored-by: Opalbolt <119032768+opalbolt@users.noreply.github.com>
---
 pkgs/by-name/no/nono/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index 6d626bfe9e95..94829a7ef587 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -10,16 +10,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.5.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "always-further";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-32PiM84dwZ3dPIAIak1DL3iencguXCzehFCDsulDyhI=";
+    hash = "sha256-/bKquUbVMM1e/YPcuSb0vW4tX/3yNDUxmaBWHKFw+Qs=";
   };
-
-  cargoHash = "sha256-nE0vVBThXnqo8VnFCkOyqhpZZ40MIkXSqUoJUZcDVhE=";
+  cargoHash = "sha256-ibGIpH6Ls9nxtF6rRl+dZBbbmVRXDQA6vpPI/jzpDqI=";
 
   nativeBuildInputs = [
     pkg-config

From 936ec49b70f3c12bf553887b3cef015c55af527c Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Tue, 14 Apr 2026 17:46:53 +0100
Subject: [PATCH 2/3] nono: prepare home tmpdir for checks

---
 pkgs/by-name/no/nono/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index 94829a7ef587..6d68bd9783f6 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -6,6 +6,8 @@
   pkg-config,
 
   dbus,
+
+  writableTmpDirAsHomeHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -28,6 +30,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     dbus
   ];
 
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
   meta = {
     description = "Secure, kernel-enforced sandbox for AI agents, MCP and LLM workloads";
     homepage = "https://github.com/always-further/nono";

From ba315d644728f8b888e34d3489824dc13feaaaf0 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Wed, 15 Apr 2026 10:18:55 +0100
Subject: [PATCH 3/3] nono: skip test failures on darwin

---
 pkgs/by-name/no/nono/package.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index 6d68bd9783f6..047da60943cc 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
 
@@ -34,6 +35,29 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    # panics with "Deny-within-allow overlap on Linux ... Landlock cannot enforce this. ..."
+    # landlock is linux only
+    "--skip=policy::tests::test_all_groups_no_deny_within_allow_overlap"
+    # panics with "exact-path fallback must not recursively cover descendants"
+    "--skip=capability_ext::tests::test_from_profile_allow_file_falls_back_to_exact_directory_when_present"
+
+    # env_vars
+    # don't work inside of the /nix dir
+    # unsure why home is still under /nix with writableTmpDirAsHomeHook
+    # Sandbox initialization failed: Refusing to grant '/nix' (source: group:system_read_macos) because it overlaps protected nono state root '/nix/build/nix-<ID>/.home/.nono'.
+    "--skip=allow_net_overrides_profile_external_proxy"
+    "--skip=cli_flag_overrides_env_var"
+    "--skip=env_nono_allow_comma_separated"
+    "--skip=env_nono_block_net"
+    "--skip=env_nono_block_net_accepts_true"
+    "--skip=env_nono_network_profile"
+    "--skip=env_nono_profile"
+    "--skip=env_nono_upstream_bypass_comma_separated"
+    "--skip=env_nono_upstream_proxy"
+    "--skip=legacy_env_nono_net_block_still_works"
+  ];
+
   meta = {
     description = "Secure, kernel-enforced sandbox for AI agents, MCP and LLM workloads";
     homepage = "https://github.com/always-further/nono";