The sandbox script on macos denies to properly run various commands in the test phase, as an example security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain does not output the trust anchors as expected -- observed in https://travis-ci.org/github/ocaml/opam-repository/jobs/734785206

How to reproduce: on a macos system, opam pin -n ca-certs https://github.com/mirage/ca-certs.git#v0.1.2 && opam install -t ca-certs. The expected result is that all tests are passing (which is the case if you execute dune runtest from the above repository). The observed result are failures since the above mentioned command executed successfully (exit status = 0), but did not produce any output.