edk2-uefi-shell: fix build when sandboxing is disabled on x86_64-darwin

[reckenrode]

Description of changes

The build still fails on Hydra because sandboxing is disabled. This is due to the build system’s trying to use the system-provided Python 3, which requires Xcode. Specify the path to the nixpkg Python 3, so that doesn’t happen.

ZHF: #199919

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.11 Release Notes (or backporting 22.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[LunNova]

Result of nixpkgs-review pr 201095 run on x86_64-linux 1

1 package built:

• edk2-uefi-shell

[LunNova]

Still working on linux, can't test darwin change but it makes sense.

[LunNova]

@ofborg build edk2-uefi-shell

[reckenrode]

I ran nix store gc to make sure no builds were still present, disabled the sandbox, then ran nixpkgs-review.

• system: "aarch64-darwin"
• host os: Darwin 22.1.0, macOS 13.0.1
• multi-user?: yes
• sandbox: no
• version: nix-env (Nix) 2.8.1
• channels(root): "nixpkgs"
• nixpkgs: /etc/nix/inputs/nixpkgs

Result of nixpkgs-review pr 201095 run on x86_64-darwin 1

1 package built:

• edk2-uefi-shell

[SuperSandro2000]

x86_64-darwin:

patching sources
'BaseTools' -> '/nix/store/q0g0yi53xcq55l1hnfjjl0hcb279j819-edk2-202205/BaseTools'
configuring
Using EDK2 in-source Basetools
WORKSPACE: /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source
EDK_TOOLS_PATH: /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source/BaseTools
CONF_PATH: /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source/Conf
Copying $EDK_TOOLS_PATH/Conf/build_rule.template
     to /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source/Conf/build_rule.txt
Copying $EDK_TOOLS_PATH/Conf/tools_def.template
     to /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source/Conf/tools_def.txt
Copying $EDK_TOOLS_PATH/Conf/target.template
     to /private/tmp/nix-build-edk2-uefi-shell-202205.drv-0/source/Conf/target.txt
building
xcode-select: error: no developer tools were found at '/Applications/Xcode.app', and no install could be requested (perhaps no UI is present), please install manually from 'developer.apple.com'.
error: builder for '/nix/store/1b9bvfihmbrwn38vl218gx6svf2j8v4y-edk2-uefi-shell-202205.drv' failed with exit code 1;

[reckenrode]

I’m not able to reproduce the failure on either my aarch64-darwin machine under Rosetta 2 or on a native x86_64-darwin machine. I even deleted Xcode from the other machine to make sure it wasn’t being picked up accidentally when sandboxing is disabled. OfBorg shows both a failing build and a succeeding one.

[reckenrode]

@ofborg build edk2-uefi-shell

[LunNova]

I'm definitely out of my depth here but would it make sense to merge this as is and see what happens on hydra, in case the ofborg fails are not going to happen there?

[reckenrode]

I'm definitely out of my depth here but would it make sense to merge this as is and see what happens on hydra, in case the ofborg fails are not going to happen there?

I wish I understood why OfBorg was failing in one case but not the other. I’m fine with merging and seeing what happens, though I suppose that’s not exactly a great practice.

[vcunat]

This sounds like an improvement to purity at least (when sandboxing is off).

[vcunat]

... and fixed on Hydra: https://hydra.nixos.org/job/nixpkgs/trunk/edk2-uefi-shell.x86_64-darwin/all