nodejs: fix checkPhase with sandbox=relaxed on Darwin
#425699
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sandbox=relaxed on Darwin
|
Can you fix the commit message to use |
sandbox=relaxed on Darwin sandbox=relaxed on Darwin
ofalvai
approved these changes
Jul 23, 2025
aduh95
approved these changes
Jul 29, 2025
|
@al3xtjames any chance you could fix the conflicts here please? |
e3e1ac9 to
c6913c6
Compare
13 tasks
aduh95
approved these changes
Aug 19, 2025
|
Any chance we could get this merged? /cc @FliegendeWurst @dasJ @drupol |
|
@al3xtjames can you rebase to fix the conflicts please? |
This is no longer needed now that apple-sdk_11 is the default SDK.
test-macos-app-sandbox uses the system-provided codesign binary (/usr/bin/codesign) to apply entitlements to an app bundle. This fails in the sandbox as /usr/bin/codesign is not accessible. Patch the test to instead use the codesign binary from sigtool. The test was updated to pass the executable path to codesign as sigtool can't handle the bundle path.
The following tests fail on Darwin with the sandbox enabled [1]: not ok 2612 parallel/test-runner-output not ok 3053 parallel/test-tls-get-ca-certificates-system not ok 3054 parallel/test-tls-get-ca-certificates-system-without-flag not ok 3363 parallel/test-watch-file-shared-dependency not ok 4057 parallel/test-runner-complex-dependencies not ok 4058 parallel/test-runner-global-setup-watch-mode not ok 4228 sequential/test-watch-mode-watch-flags Node.js uses Security.framework to read the system CA certificates from the system keychain on Darwin. Fix the tls-get-ca-certificates-system tests by adding the files and Mach services used by Security.framework to the sandbox profile. Also allow the FSEvents Mach service as the runner and watch tests use FSEvents on Darwin. [1]: https://gist.github.com/al3xtjames/0eb3c30d37c1ebab99968c62ee544300
c6913c6 to
8362b18
Compare
aduh95
approved these changes
Aug 30, 2025
|
Any chance we could get this merged? /cc @dasJ @fabianhjr |
|
Can't test on darwin but going by the two previous approvals |
|
@al3xtjames do you think the failure in https://hydra.nixos.org/build/306435782 could be related to this PR? |
13 tasks
|
Hmm, e2e1617 builds fine on my local machine. I can reproduce the failure if I comment out |
|
I think that darwin builders on hydra.nixos.org are unsandboxed. (I'm trying to stay away from darwin-specific stuff.) |
|
I've opened nodejs/gyp-next#311 to hopefully fix the error |
|
So we now apply this to |
|
I've opened #439129 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following tests fail on Darwin with the sandbox enabled:
Node.js uses Security.framework to read the system CA certificates from the system keychain on Darwin. Fix the tls-get-ca-certificates-system tests by adding the files and Mach services used by Security.framework to the sandbox profile. Also allow the FSEvents Mach service as the runner and watch tests use FSEvents on Darwin.
Also patch test-macos-app-sandbox to use codesign from sigtool, which allows it to work with the sandbox enabled.
Fixes: #423244
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.