From c80d453e9ced5d380a508a1e2f1624fe785eb984 Mon Sep 17 00:00:00 2001
From: gbhu753 <gbhu753@aucklanduni.ac.nz>
Date: Tue, 30 Jun 2026 01:49:45 +1200
Subject: [PATCH] modctl: fix darwin install check with versionCheckHook

modctl's cobra commands invoke config.NewRoot(), which resolves the
home directory via os/user.Current(). On darwin os/user bypasses $HOME
and calls getpwuid directly, returning /var/empty for the nixbld user,
so writableTmpDirAsHomeHook (which only sets $HOME) cannot redirect
the .modctl directory and the install check fails with
"mkdir /var/empty/.modctl: operation not permitted".

Drop writableTmpDirAsHomeHook and instead use preVersionCheck to point
versionCheckProgram at a small wrapper that appends
--log-dir/--storage-dir=$TMPDIR, mirroring the flags the previous
manual installCheckPhase used. versionCheckHook still performs the
actual --version/--help invocation, output capture, and ${version}
matching.

Assisted-by: opencode (GLM-5.2)
---
 pkgs/by-name/mo/modctl/package.nix | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mo/modctl/package.nix b/pkgs/by-name/mo/modctl/package.nix
index eb149689558f..c910dd3112ad 100644
--- a/pkgs/by-name/mo/modctl/package.nix
+++ b/pkgs/by-name/mo/modctl/package.nix
@@ -3,7 +3,6 @@
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
-  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -26,12 +25,25 @@ buildGoModule (finalAttrs: {
   ];
 
   doInstallCheck = true;
-  nativeInstallCheckInputs = [
-    writableTmpDirAsHomeHook
-    versionCheckHook
-  ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "version";
-  versionCheckKeepEnvironment = [ "HOME" ];
+
+  # modctl's cobra commands invoke config.NewRoot(), which uses
+  # os/user.Current() to find the home directory. On darwin os/user
+  # bypasses $HOME and resolves it via getpwuid (returning /var/empty,
+  # not writable), so the install check fails. versionCheckHook only
+  # accepts a single argument, so wrap the binary and point
+  # --log-dir/--storage-dir at TMPDIR to keep the check working on all
+  # platforms.
+  preVersionCheck = ''
+    wrapper="$NIX_BUILD_TOP/modctl-version-check"
+    cat > "$wrapper" <<EOF
+    #!/bin/sh
+    exec "$out/bin/modctl" "\$@" --log-dir="$TMPDIR" --storage-dir="$TMPDIR"
+    EOF
+    chmod +x "$wrapper"
+    versionCheckProgram="$wrapper"
+  '';
 
   meta = {
     description = "CLI tool for managing OCI model artifacts based on Model Spec";