Describe the bug
When running a sandboxed build on OS X, a derivation fails with sandbox-exec: pattern serialization length 71710 exceeds maximum (65535)
If you have a problem with a specific package or NixOS,
you probably want to file an issue at https://github.com/NixOS/nixpkgs/issues.
Steps To Reproduce
Create a derivation with a sufficiently large number of inputs, and attempt to build it.
Expected behavior
The derivation builds
nix-env --version output
2.3.7
Additional context
I have done a bit of digging and it seems most likely that this is due to the fact that the OS X sandbox config is created by building a pattern mapping every path in the dependency closure of the derivation to a path in the sandbox individually:
|
/* Our inputs (transitive dependencies and any impurities computed above) |
|
|
|
without file-write* allowed, access() incorrectly returns EPERM |
|
*/ |
|
sandboxProfile += "(allow file-read* file-write* process-exec\n"; |
|
for (auto & i : dirsInChroot) { |
|
if (i.first != i.second.source) |
|
throw Error( |
|
"can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", |
|
i.first, i.second.source); |
|
|
|
string path = i.first; |
|
struct stat st; |
|
if (lstat(path.c_str(), &st)) { |
|
if (i.second.optional && errno == ENOENT) |
|
continue; |
|
throw SysError("getting attributes of path '%s", path); |
|
} |
|
if (S_ISDIR(st.st_mode)) |
|
sandboxProfile += fmt("\t(subpath \"%s\")\n", path); |
|
else |
|
sandboxProfile += fmt("\t(literal \"%s\")\n", path); |
|
} |
|
sandboxProfile += ")\n"; |
Describe the bug
When running a sandboxed build on OS X, a derivation fails with
sandbox-exec: pattern serialization length 71710 exceeds maximum (65535)If you have a problem with a specific package or NixOS,
you probably want to file an issue at https://github.com/NixOS/nixpkgs/issues.
Steps To Reproduce
Create a derivation with a sufficiently large number of inputs, and attempt to build it.
Expected behavior
The derivation builds
nix-env --versionoutput2.3.7
Additional context
I have done a bit of digging and it seems most likely that this is due to the fact that the OS X sandbox config is created by building a pattern mapping every path in the dependency closure of the derivation to a path in the sandbox individually:
nix/src/libstore/build.cc
Lines 3706 to 3729 in d761485