Merge pull request #234122 from reckenrode/qt-darwin-sandbox

qt5: fix build with Darwin sandbox enabled
NixOS · Jun 15, 2023 · c1fa08f · c1fa08f
2 parents 4ea871d + 71fc5f5
commit c1fa08f
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/pkgs/applications/misc/qtpass/default.nix b/pkgs/applications/misc/qtpass/default.nix
@@ -34,6 +34,9 @@ mkDerivation rec {
     })
   ];
 
+  # HACK `propagatedSandboxProfile` does not appear to actually propagate the sandbox profile from `qt5.qtbase`
+  sandboxProfile = toString qtbase.__propagatedSandboxProfile;
+
   qmakeFlags = [
     # setup hook only sets QMAKE_LRELEASE, set QMAKE_LUPDATE too:
     "QMAKE_LUPDATE=${qttools.dev}/bin/lupdate"

diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -84,6 +84,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedNativeBuildInputs = [ lndir ];
 
+  # libQt5Core links calls CoreFoundation APIs that call into the system ICU. Binaries linked
+  # against it will crash during build unless they can access `/usr/share/icu/icudtXXl.dat`.
+  propagatedSandboxProfile = lib.optionalString stdenv.isDarwin ''
+    (allow file-read* (subpath "/usr/share/icu"))
+  '';
+
   enableParallelBuilding = true;
 
   outputs = [ "bin" "dev" "out" ];

diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
+  # HACK `propagatedSandboxProfile` does not appear to actually propagate the sandbox profile from `qtbase`
+  sandboxProfile = toString qtbase.__propagatedSandboxProfile or null;
+
   cmakeFlags = [
     "-DBUILD_WITH_QT6=${if lib.versions.major qtbase.version == "6" then "ON" else "OFF"}"
     "-DQT_TRANSLATIONS_DIR=share/qt/translations"