From cbb3c85f0eec1174ea20fe7706a75583a4c2e97f Mon Sep 17 00:00:00 2001 From: Alex James Date: Thu, 10 Jul 2025 20:32:11 -0500 Subject: [PATCH 1/3] nodejs: drop v8 instrumentation patch This is no longer needed now that apple-sdk_11 is the default SDK. --- ...darwin-v8-system-instrumentation-node19.patch | 16 ---------------- pkgs/development/web/nodejs/v20.nix | 1 - pkgs/development/web/nodejs/v22.nix | 1 - pkgs/development/web/nodejs/v24.nix | 1 - 4 files changed, 19 deletions(-) delete mode 100644 pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch diff --git a/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch b/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch deleted file mode 100644 index 5d56af784973..000000000000 --- a/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch +++ /dev/null @@ -1,16 +0,0 @@ -Disable v8 system instrumentation on Darwin - -On Darwin, the v8 system instrumentation requires the header "os/signpost.h" -which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584 - ---- old/tools/v8_gypfiles/features.gypi -+++ new/tools/v8_gypfiles/features.gypi -@@ -62,7 +62,7 @@ - }, { - 'is_component_build': 0, - }], -- ['OS == "win" or OS == "mac"', { -+ ['OS == "win"', { - # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing - 'v8_enable_system_instrumentation': 1, - }, { diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix index 2323931f99cd..c79e37c98c39 100644 --- a/pkgs/development/web/nodejs/v20.nix +++ b/pkgs/development/web/nodejs/v20.nix @@ -40,7 +40,6 @@ buildNodejs { patches = [ ./configure-emulator.patch ./configure-armv6-vfpv2.patch - ./disable-darwin-v8-system-instrumentation-node19.patch ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix index 21c70e049faa..0ad029f5a153 100644 --- a/pkgs/development/web/nodejs/v22.nix +++ b/pkgs/development/web/nodejs/v22.nix @@ -56,7 +56,6 @@ buildNodejs { ++ gypPatches ++ [ ./configure-armv6-vfpv2.patch - ./disable-darwin-v8-system-instrumentation-node19.patch ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix index 99ba1a30a308..b8fd3ce679c5 100644 --- a/pkgs/development/web/nodejs/v24.nix +++ b/pkgs/development/web/nodejs/v24.nix @@ -55,7 +55,6 @@ buildNodejs { ] ++ [ ./configure-armv6-vfpv2.patch - ./disable-darwin-v8-system-instrumentation-node19.patch ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch From 1bc6e6c0954a2089f067fac8cc43fa65a7d204cc Mon Sep 17 00:00:00 2001 From: Alex James Date: Thu, 10 Jul 2025 20:45:15 -0500 Subject: [PATCH 2/3] nodejs: use sigtool's codesign in test-macos-app-sandbox test-macos-app-sandbox uses the system-provided codesign binary (/usr/bin/codesign) to apply entitlements to an app bundle. This fails in the sandbox as /usr/bin/codesign is not accessible. Patch the test to instead use the codesign binary from sigtool. The test was updated to pass the executable path to codesign as sigtool can't handle the bundle path. --- pkgs/development/web/nodejs/nodejs.nix | 8 +++++++- .../web/nodejs/use-nix-codesign.patch | 18 ++++++++++++++++++ pkgs/development/web/nodejs/v20.nix | 1 + pkgs/development/web/nodejs/v22.nix | 1 + pkgs/development/web/nodejs/v24.nix | 1 + 5 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 pkgs/development/web/nodejs/use-nix-codesign.patch diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix index b4192a98008b..08f159b3fbd0 100644 --- a/pkgs/development/web/nodejs/nodejs.nix +++ b/pkgs/development/web/nodejs/nodejs.nix @@ -28,6 +28,7 @@ runtimeShell, gnupg, installShellFiles, + darwin, }: { @@ -298,6 +299,11 @@ let inherit patches; + postPatch = lib.optionalString stdenv.hostPlatform.isDarwin '' + substituteInPlace test/parallel/test-macos-app-sandbox.js \ + --subst-var-by codesign '${darwin.sigtool}/bin/codesign' + ''; + __darwinAllowLocalNetworking = true; # for tests doCheck = canExecute; @@ -391,7 +397,7 @@ let ] ++ lib.optionals stdenv.buildPlatform.isDarwin [ # Disable tests that don’t work under macOS sandbox. - "test-macos-app-sandbox" + # uv_os_setpriority returned EPERM (operation not permitted) "test-os" "test-os-process-priority" diff --git a/pkgs/development/web/nodejs/use-nix-codesign.patch b/pkgs/development/web/nodejs/use-nix-codesign.patch new file mode 100644 index 000000000000..3d95a000d5e2 --- /dev/null +++ b/pkgs/development/web/nodejs/use-nix-codesign.patch @@ -0,0 +1,18 @@ +diff --git a/test/parallel/test-macos-app-sandbox.js b/test/parallel/test-macos-app-sandbox.js +index 60ad67b3db..b6ac0dcef4 100644 +--- a/test/parallel/test-macos-app-sandbox.js ++++ b/test/parallel/test-macos-app-sandbox.js +@@ -45,11 +45,11 @@ fs.copyFileSync( + + // Sign the app bundle with sandbox entitlements: + assert.strictEqual( +- child_process.spawnSync('/usr/bin/codesign', [ ++ child_process.spawnSync('@codesign@', [ + '--entitlements', fixtures.path( + 'macos-app-sandbox', 'node_sandboxed.entitlements'), + '--force', '-s', '-', +- appBundlePath, ++ appExecutablePath, + ]).status, + 0); + diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix index c79e37c98c39..56fc4c4ac2c6 100644 --- a/pkgs/development/web/nodejs/v20.nix +++ b/pkgs/development/web/nodejs/v20.nix @@ -42,6 +42,7 @@ buildNodejs { ./configure-armv6-vfpv2.patch ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch + ./use-nix-codesign.patch # TODO: remove when included in a release (fetchpatch2 { diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix index 0ad029f5a153..49066f95d19a 100644 --- a/pkgs/development/web/nodejs/v22.nix +++ b/pkgs/development/web/nodejs/v22.nix @@ -59,6 +59,7 @@ buildNodejs { ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch + ./use-nix-codesign.patch # TODO: remove when included in a release (fetchpatch2 { diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix index b8fd3ce679c5..4982172f2ef2 100644 --- a/pkgs/development/web/nodejs/v24.nix +++ b/pkgs/development/web/nodejs/v24.nix @@ -58,6 +58,7 @@ buildNodejs { ./node-npm-build-npm-package-logic.patch ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch + ./use-nix-codesign.patch ] ++ gypPatches ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [ From 8362b1826bfcf4c599adf9f06c593389f76ad930 Mon Sep 17 00:00:00 2001 From: Alex James Date: Thu, 10 Jul 2025 14:08:47 -0500 Subject: [PATCH 3/3] nodejs: fix `checkPhase` with `sandbox=relaxed` on Darwin The following tests fail on Darwin with the sandbox enabled [1]: not ok 2612 parallel/test-runner-output not ok 3053 parallel/test-tls-get-ca-certificates-system not ok 3054 parallel/test-tls-get-ca-certificates-system-without-flag not ok 3363 parallel/test-watch-file-shared-dependency not ok 4057 parallel/test-runner-complex-dependencies not ok 4058 parallel/test-runner-global-setup-watch-mode not ok 4228 sequential/test-watch-mode-watch-flags Node.js uses Security.framework to read the system CA certificates from the system keychain on Darwin. Fix the tls-get-ca-certificates-system tests by adding the files and Mach services used by Security.framework to the sandbox profile. Also allow the FSEvents Mach service as the runner and watch tests use FSEvents on Darwin. [1]: https://gist.github.com/al3xtjames/0eb3c30d37c1ebab99968c62ee544300 --- pkgs/development/web/nodejs/nodejs.nix | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix index 08f159b3fbd0..316e7af9550b 100644 --- a/pkgs/development/web/nodejs/nodejs.nix +++ b/pkgs/development/web/nodejs/nodejs.nix @@ -427,6 +427,27 @@ let }" ]; + sandboxProfile = '' + (allow file-read* + (literal "/Library/Keychains/System.keychain") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (literal "/private/var/db/mds/system/mdsObject.db")) + + ; Allow files written by Module Directory Services (MDS), which is used + ; by Security.framework: https://apple.stackexchange.com/a/411476 + ; These rules are based on the system sandbox profiles found in + ; /System/Library/Sandbox/Profiles. + (allow file-write* + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_?$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$")) + + (allow mach-lookup + (global-name "com.apple.FSEvents") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.system.opendirectoryd.membership")) + ''; + postInstall = let # nodejs_18 does not have node_js2c, and we don't want to rebuild the other ones