In reply to @reckenrode:matrix.org
I created an issue to track Darwin stuff that mentions it, but I’m pretty sure it references Tristan Ross’s existing PR.

Been working on GCC NG and cross has 1 issue left:

hello> In file included from /nix/store/51pba7q0zhhrzy7ia5yq273r49fa4hz2-glibc-riscv64-unknown-linux-gnu-2.40-66-dev/include/stdlib.h:1159,
hello>                  from lib/stdlib.h:51,
hello>                  from src/system.h:25,
hello>                  from src/hello.c:25:
hello> /nix/store/51pba7q0zhhrzy7ia5yq273r49fa4hz2-glibc-riscv64-unknown-linux-gnu-2.40-66-dev/include/bits/stdlib.h: In function 'wctomb':
hello> /nix/store/51pba7q0zhhrzy7ia5yq273r49fa4hz2-glibc-riscv64-unknown-linux-gnu-2.40-66-dev/include/bits/stdlib.h:98:3: error: #error "Assumed value of MB_LEN_MAX wrong"
hello>    98 | # error "Assumed value of MB_LEN_MAX wrong"
hello>       |   ^~~~~

In reply to @reckenrode:matrix.org
I want to see how badly things break actually doing builds on case-sensitive APFS.

In reply to @emilazy:matrix.org
you'll need to set temp-dir to be in the partition too

https://lix.systems/blog/2025-06-24-lix-cves/

Hardening the build directory

As mentioned earlier, Lix used to rely on a shared temp directory to stage builds before copying them to the Nix store.

A better approach is to move the build directory into a location that’s under the exclusive control of the Nix daemon.

That’s what we’ve done: Lix now stages builds in /nix/var/nix/builds, a secure area controlled by the daemon.

In reply to @emilazy:matrix.org
you'll need to set temp-dir to be in the partition too

According to the blog post about the recent CVEs, they moved it in the fixed daemon.

https://lix.systems/blog/2025-06-24-lix-cves/

Hardening the build directory

As mentioned earlier, Lix used to rely on a shared temp directory to stage builds before copying them to the Nix store.

A better approach is to move the build directory into a location that’s under the exclusive control of the Nix daemon.

That’s what we’ve done: Lix now stages builds in /nix/var/nix/builds, a secure area controlled by the daemon.

  nix.settings = {
    use-case-hack = false;
    temp-dir = "/nix/tmp";
  };

  system.activationScripts.preActivation.text = ''
    mkdir -p /nix/tmp
    chmod 1777 /nix/tmp
  '';