4 ms·
Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?
by throw0101c 8mo ago
Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?
- cwicklein 8mo agoI’ve written a personal system in Common Lisp for building third-party software on macOS (coincidentally somewhat similar to GUIX), and I use sandbox-exec to isolate execution so that only intended requisites affect the build process and so that installation is strictly confined to the configured destination directory, no scribbling outside the lines. I think Bazel uses sandbox-exec on macOS.
- woodruffw 8mo agoHomebrew uses sandbox-exec during builds and installs, yeah. To my memory we’ve used it for at least 6 or 7 years, probably longer.
- pingiun 8mo agoNix uses the underlying libsandbox function for builds: https://github.com/NixOS/nix/blob/614072adcb56202f0a09532971b38efbed039cd1/src/libstore/unix/build/darwin-derivation-builder.cc#L13 https://github.com/NixOS/nix/blob/614072adcb56202f0a09532971...