Merge remote-tracking branch 'origin/staging' into staging-next

pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch

@@ -1,16 +0,0 @@
-Disable v8 system instrumentation on Darwin
-
-On Darwin, the v8 system instrumentation requires the header "os/signpost.h"
-which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584
-
---- old/tools/v8_gypfiles/features.gypi
-+++ new/tools/v8_gypfiles/features.gypi
-@@ -62,7 +62,7 @@
-       }, {
-         'is_component_build': 0,
-       }],
--      ['OS == "win" or OS == "mac"', {
-+      ['OS == "win"', {
-         # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing
-         'v8_enable_system_instrumentation': 1,
-       }, {

pkgs/development/web/nodejs/nodejs.nix

@@ -28,6 +28,7 @@
   runtimeShell,
   gnupg,
   installShellFiles,
+  darwin,
 }:
 
 {
@@ -298,6 +299,11 @@ let
 
       inherit patches;
 
+      postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+        substituteInPlace test/parallel/test-macos-app-sandbox.js \
+          --subst-var-by codesign '${darwin.sigtool}/bin/codesign'
+      '';
+
       __darwinAllowLocalNetworking = true; # for tests
 
       doCheck = canExecute;
@@ -391,7 +397,7 @@ let
             ]
             ++ lib.optionals stdenv.buildPlatform.isDarwin [
               # Disable tests that don’t work under macOS sandbox.
-              "test-macos-app-sandbox"
+              # uv_os_setpriority returned EPERM (operation not permitted)
               "test-os"
               "test-os-process-priority"
 
@@ -421,6 +427,27 @@ let
         }"
       ];
 
+      sandboxProfile = ''
+        (allow file-read*
+          (literal "/Library/Keychains/System.keychain")
+          (literal "/private/var/db/mds/system/mdsDirectory.db")
+          (literal "/private/var/db/mds/system/mdsObject.db"))
+
+        ; Allow files written by Module Directory Services (MDS), which is used
+        ; by Security.framework: https://apple.stackexchange.com/a/411476
+        ; These rules are based on the system sandbox profiles found in
+        ; /System/Library/Sandbox/Profiles.
+        (allow file-write*
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_?$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$"))
+
+        (allow mach-lookup
+          (global-name "com.apple.FSEvents")
+          (global-name "com.apple.SecurityServer")
+          (global-name "com.apple.system.opendirectoryd.membership"))
+      '';
+
       postInstall =
         let
           # nodejs_18 does not have node_js2c, and we don't want to rebuild the other ones

pkgs/development/web/nodejs/use-nix-codesign.patch

@@ -0,0 +1,18 @@
+diff --git a/test/parallel/test-macos-app-sandbox.js b/test/parallel/test-macos-app-sandbox.js
+index 60ad67b3db..b6ac0dcef4 100644
+--- a/test/parallel/test-macos-app-sandbox.js
++++ b/test/parallel/test-macos-app-sandbox.js
+@@ -45,11 +45,11 @@ fs.copyFileSync(
+ 
+ // Sign the app bundle with sandbox entitlements:
+ assert.strictEqual(
+-  child_process.spawnSync('/usr/bin/codesign', [
++  child_process.spawnSync('@codesign@', [
+     '--entitlements', fixtures.path(
+       'macos-app-sandbox', 'node_sandboxed.entitlements'),
+     '--force', '-s', '-',
+-    appBundlePath,
++    appExecutablePath,
+   ]).status,
+   0);
+ 

pkgs/development/web/nodejs/v20.nix

@@ -40,9 +40,9 @@ buildNodejs {
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
-    ./disable-darwin-v8-system-instrumentation-node19.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
+    ./use-nix-codesign.patch
 
     # TODO: remove when included in a release
     (fetchpatch2 {

pkgs/development/web/nodejs/v22.nix

@@ -56,10 +56,10 @@ buildNodejs {
     ++ gypPatches
     ++ [
       ./configure-armv6-vfpv2.patch
-      ./disable-darwin-v8-system-instrumentation-node19.patch
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
 
       # TODO: remove when included in a release
       (fetchpatch2 {

pkgs/development/web/nodejs/v24.nix

@@ -55,10 +55,10 @@ buildNodejs {
     ]
     ++ [
       ./configure-armv6-vfpv2.patch
-      ./disable-darwin-v8-system-instrumentation-node19.patch
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [