Okay it fails on an unrelated thing, because it tries to access system proxy by default and gets

2025-11-18 21:23:01.093926+0200  localhost kernel[0]: (Sandbox) Sandbox: test-native(79417) deny(1) mach-lookup com.apple.SystemConfiguration.configd

Why don't you work...

fetched-content> Error: reqwest::Error { kind: Request, url: "https://dummyjson.com/test", source: hyper_util::client::legacy::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) }
building of '/nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv^out' from .drv file: build done
killing process 71696
builder process for '/nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv' finished
killing all processes running under uid '351'
lock released on '/nix/store/vjl83xzpf5nxihbp164nm7n1dakl85pj-fetched-content.lock'
building of '/nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv^out' from .drv file: done
building of '/nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv^out' from .drv file: goal destroyed
error: builder for '/nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv' failed with exit code 1;
       last 1 log lines:
       > Error: reqwest::Error { kind: Request, url: "https://dummyjson.com/test", source: hyper_util::client::legacy::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) }
       For full logs, run:
               nix-store -l /nix/store/z3lg2ccma5grszxmkwdwvibdzlpd2gl0-fetched-content.drv

This is for

[package]
name = "test-native"
version = "0.1.0"
edition = "2024"

[dependencies]
tokio = { version = "1.48.0", features = ["macros", "rt-multi-thread"] }

[dependencies.reqwest]
version = "0.12.24"
default-features = false
features = [
  "rustls-tls-native-roots",
  "charset",
  "http2",
  "system-proxy"
]

It's not pretty:

; Allow system proxy
(allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))

; Allow native TLS
(allow mach-lookup
       (global-name "com.apple.SecurityServer"))
(allow file-read-data
       (literal "/Library/Keychains/System.keychain")
       (literal "/System/Library/Keychains/SystemRootCertificates.keychain")
       (literal "/System/Library/Keychains/SystemTrustSettings.plist"))
(allow file-read-metadata
       (literal "/Library/Keychains/System.keychain")
       (literal "/System/Library/Keychains/SystemRootCertificates.keychain")
       (literal "/System/Library/Keychains/SystemTrustSettings.plist"))

It's not pretty:

; Allow system proxy
(allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))

; Allow native TLS
(allow mach-lookup
       (global-name "com.apple.SecurityServer"))
(allow file-read-data
       (literal "/Library/Keychains/System.keychain")
       (literal "/System/Library/Keychains/SystemRootCertificates.keychain")
       (literal "/System/Library/Keychains/SystemTrustSettings.plist"))

It's not pretty:

; Allow system proxy
(allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))

; Allow native TLS
(allow mach-lookup (global-name "com.apple.SecurityServer"))
(allow file-read-data
       (literal "/Library/Keychains/System.keychain")
       (literal "/System/Library/Keychains/SystemRootCertificates.keychain")
       (literal "/System/Library/Keychains/SystemTrustSettings.plist"))

declare -x NIX_SSL_CERT_FILE="/private/tmp/2412pn9wp2vk7abqp0glq967n4/etc/ssl/certs/ca-certificates.crt"
declare -x SSL_CERT_FILE="/no-cert-file.crt"

if [[ -z "${NIX_SSL_CERT_FILE:-}" && "${IN_NIX_SHELL:-}" != "impure" ]]; then
  export NIX_SSL_CERT_FILE=/no-cert-file.crt
fi
# Another variant left for compatibility.
if [[ -z "${SSL_CERT_FILE:-}" && "${IN_NIX_SHELL:-}" != "impure" ]]; then
  export SSL_CERT_FILE=/no-cert-file.crt
fi

https://docs.lix.systems/manual/lix/stable/release-notes/rl-2.94.html

Global certificate authorities are copied inside the builder's environment gh#12698 fj#885 cl/3765