error: config contains the wrong home directory for hydra-queue-builder, aborting activation
nix-darwin does not support changing the home directory of existing users.

Please set:

    users.users.hydra-queue-builder.home = "/private/var/lib/hydra-queue-builder";

or remove it from your configuration.

users = {
  users.hydra-queue-builder = {
    uid = lib.mkDefault 535;
    gid = lib.mkDefault config.users.groups.hydra.gid;
    home = lib.mkDefault "/var/lib/hydra-queue-builder";
    shell = "/bin/bash";
    description = "hydra-queue-builder service user";
  };
  knownUsers = [ "hydra-queue-builder" ];
  groups.hydra = {
    gid = lib.mkDefault 535;
    description = "Nix group for hydra-queue-builder service";
  };
  knownGroups = [ "hydra" ];
};

nevermind, I needed to add an entitlement to the qemu binary to attach this instrument (Allocations):

% plutil -p tmp.entitlements 
{
  "com.apple.security.get-task-allow" => 1
}

% codesign -s - -f --entitlements tmp.entitlements …/qemu

clang question: I'm trying to build python3Packages.m2crypto and the SWIG-generated code is breaking clang:

       > src/SWIG/_m2crypto_wrap.c:4131:1: error: unknown type name 'PRAGMA_IGNORE_UNUSED_LABEL'
       >  4131 | PRAGMA_IGNORE_UNUSED_LABEL
       >       | ^
       > src/SWIG/_m2crypto_wrap.c:4132:30: error: expected ';' after top level declarator
       >  4132 | PRAGMA_WARN_STRICT_PROTOTYPES

when users launch an app that uses Rosetta 2, there will be a popup letting them know that the app will no longer work when support for Rosetta 2 ends.

what will happen on headless? (do we ever run .apps during builds?)