Nix 1.11.10 fails to build on macOS

[matthewbauer]

The 1.11.10 Nix version is not building on the Hydra build farm currently. Here is the log:

http://hydra.nixos.org/build/54425786/nixlog/1

The relevant lines are:

sandbox-exec: sandbox_apply_container: Operation not permitted
builder for ‘/private/tmp/nix-build-nix-1.11.10.drv-0/nix-1.11.10/tests/test-tmp/store/cmk2j4kh5cqyyhv1z7zb6q1wi9667aaq-dependencies-input-1.drv’ failed with exit code 71
cannot build derivation ‘/private/tmp/nix-build-nix-1.11.10.drv-0/nix-1.11.10/tests/test-tmp/store/94asi55xz1xk44q8srklxaqrla13laf4-dependencies.drv’: 1 dependencies couldn't be built
error: build of ‘/private/tmp/nix-build-nix-1.11.10.drv-0/nix-1.11.10/tests/test-tmp/store/94asi55xz1xk44q8srklxaqrla13laf4-dependencies.drv’ failed
FAIL: tests/tarball.sh

I'm not exactly sure what's going on here. My theory is that MacOS sandboxing does not like running a sandbox within a sandbox. The tests need to create their own sandbox to run correctly even though they are already in their parent sandbox. Maybe there is a way to detect that the machine is in the sandbox and just assume that it is safe to reuse? (probably a security hazard unless you can check that everything that should be denied is actually denied).

[domenkozar]

cc @edolstra

[vcunat]

Note that this has been blocking nixpkgs-unstable for quite some time now. Disabling all nix's tests would probably fix that, but I'd personally prefer to avoid that, even as temporary solution.

[grahamc]

I believe this is fixed now, as I've built Nix a few times.

[vcunat]

On Hydra it did build for some time but now 1.11.11 fails: http://hydra.nixos.org/build/55984532