I will probably push my Wine cleanups later today, but here are a couple of fixes I needed along the way:

• https://github.com/NixOS/nixpkgs/pull/531959
• https://github.com/NixOS/nixpkgs/pull/531960

this is just a sandbox on darwin issue, right?

(from nixpkgs-review-gha)

2026-06-15T12:06:34.1835410Z stalwart> thread 'smtp::inbound::basic::basic_commands' (400423) panicked at tests/src/lib.rs:49:13:
2026-06-15T12:06:34.1836360Z stalwart> Errors: [
2026-06-15T12:06:34.1836770Z stalwart>     Build {
2026-06-15T12:06:34.1837220Z stalwart>         object_id: ObjectId {
2026-06-15T12:06:34.1837780Z stalwart>             object: DnsResolver,
2026-06-15T12:06:34.1838340Z stalwart>             id: Id(
2026-06-15T12:06:34.1838820Z stalwart>                 20080258862541,
2026-06-15T12:06:34.1839370Z stalwart>             ),
2026-06-15T12:06:34.1839810Z stalwart>         },
2026-06-15T12:06:34.1842000Z stalwart>         message: "Failed to read system DNS config: failed to access System Configuration dynamic store",
2026-06-15T12:06:34.1843420Z stalwart>     },
2026-06-15T12:06:34.1843820Z stalwart> ]

hexa: i assume we don't want to bring a new apple sdk to this near-eol branch?

we can revert the patch that adopted 26.4 sdk to enable some specific yubikey web auth path. Since it was broken in 151, no regression expected.

does anybody have a sane process of debugging which policies need to be added to sandboxProfile? I have tried using this while the build is running:

/usr/bin/log stream --info --debug --predicate '(process == "sandboxd") && (subsystem == "com.apple.sandbox.reporting")'

and then proceeded to whitelist all matching policies. But on a subsequent rebuild, the tests continue to fail in the sandbox despite adding them to sandboxProfile

I have even tried working backwards by tracing the log statement back to the underlying library:

https://github.com/hickory-dns/hickory-dns/blob/f09321075b1f97902b7bc4ca4ffda7816fcf2971/crates/resolver/src/system_conf/apple.rs#L20-L21

But I can't make heads or tails on how to white list "State:/Network/Global/DNS" in sandboxProfile. I can't find any halfway decent documentation on sandboxd or sandbox-exec

okay - will this query catch it?

/usr/bin/log stream --info --debug --predicate '(process == "sandboxd") && (subsystem == "com.apple.sandbox.reporting")'

seems it doesn't allow me to use (allow (with report)) by itself have to use:

(allow mach-lookup (global-name "com.apple.logd")(with report))

(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration"))
(allow file-read* (literal "/private/etc/hosts"))

Would this be enough?

thanks, trying one last time with this and a more generic filter query:

/usr/bin/log stream --info --debug --predicate '(process == "sandboxd")'

I tried the (allow ... (with report)) to find what was initially being denied but in the end those events were not logged for some reason.

I have darwin-log-sandbox-violations = true in nix.conf, but still the same result. I even added multiple (allow file*|file-read*|... (with report)) to sandboxProfile in hopes of catching something, but in the end it was treated as a general allow and those events were not even logged :/. It did allow the build and tests to succeed though