From e848cf1316d00afdf903acbe17111b5ad861cbc0 Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Mon, 3 Mar 2025 20:26:35 -0600
Subject: [PATCH] dumbpipe: fix `checkPhase` with `sandbox=relaxed` on Darwin

dumbpipe's tests run the binary, which requires local network access.
dumbpipe also ends up invoking CoreFoundation APIs which require access
to system ICU data. [CoreFoundation will segfault if it cannot access
the system ICU data][1], so add these paths to the sandbox.

[1]: https://gist.github.com/al3xtjames/e8a260602c719bf35dae63988798e835
---
 pkgs/by-name/du/dumbpipe/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/du/dumbpipe/package.nix b/pkgs/by-name/du/dumbpipe/package.nix
index d49fdfd68a1d..368017e0fa45 100644
--- a/pkgs/by-name/du/dumbpipe/package.nix
+++ b/pkgs/by-name/du/dumbpipe/package.nix
@@ -19,6 +19,15 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-uuY0nh4VHzyM7+cbgyycr5I3IjE0OeQ0eg12qVXe4BQ=";
 
+  __darwinAllowLocalNetworking = true;
+
+  # On Darwin, dumbpipe invokes CoreFoundation APIs that read ICU data from the
+  # system. Ensure these paths are accessible in the sandbox to avoid segfaults
+  # during checkPhase.
+  sandboxProfile = ''
+    (allow file-read* (subpath "/usr/share/icu"))
+  '';
+
   meta = with lib; {
     description = "Connect A to B - Send Data";
     homepage = "https://www.dumbpipe.dev/";