temporal-cli: Fix Darwin builds with sandbox enabled

[amarshall]

Description of changes

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[SuperSandro2000]

What is the actual error that is printed in the logs?

[tjni]

The tctl derivation seems to only need:

__darwinAllowLocalNetworking = true;

but the tctl-next derivation fails because a test tries to access /etc/protocols:

running tests
ok      github.com/temporalio/tctl/cli  0.657s
ok      github.com/temporalio/tctl/cli/headers  0.012s
ok      github.com/temporalio/tctl/cli/stringify        0.016s
ok      github.com/temporalio/tctl/cli/trace    0.012s
panic: open /etc/protocols: operation not permitted

goroutine 1 [running]:
modernc.org/libc/honnef.co/go/netdb.init.0()
        /private/tmp/nix-build-tctl-next-0.9.0.drv-1/source/vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go:700 +0x784
FAIL    github.com/temporalio/cli/app   0.043s
FAIL

[amarshall]

@tjni TIL about __darwinAllowLocalNetworking, thanks! Are there any downsides to that i.e. why is it not enabled by default?

Indeed, the /etc/protocols (and then hiding behind that will also be /etc/services) is occurring within a dependency; it’s possible to patch it but it’s quite cumbersome with the way the monolithic buildGoModule works.

[amarshall]

@tjni I cannot reproduce either succeeding with only __darwinAllowLocalNetworking = true, they both have the same dep that causes the /etc/protocols access failure.

[tjni]

TIL about __darwinAllowLocalNetworking, thanks! Are there any downsides to that i.e. why is it not enabled by default?

We can see from the code that it also enables access to some other things as well, but I don't know why it isn't enabled by default :)

Indeed, the /etc/protocols (and then hiding behind that will also be /etc/services) is occurring within a dependency; it’s possible to patch it but it’s quite cumbersome with the way the monolithic buildGoModule works.

Yes, I don't know how to move past this yet aside from disabling the test (and I don't even know how to do that properly in buildGoModule).

[tjni]

I cannot reproduce either succeeding with only __darwinAllowLocalNetworking = true, they both have the same dep that causes the /etc/protocols access failure.

You're right, I just checked again. Adding __darwinAllowLocalNetworking does remove this log message:

Upserted cluster localhost:7233
current-env: tctl-test-env
--- FAIL: Test_fetchCACertFromUrl (0.00s)
panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted [recovered]
        panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted

but still runs into the same error. I jumped the gun there, sorry for the noise!

[amarshall]

@tjni Go tests may be skipped with e.g. checkFlags = [ "-skip=TestFoo" ];

---

So I felt more ambitious today, have pushed a version that does not disable tests and instead patches the dependency in the go-modules drv (along with opening a PR upstream) and applied the local net exception. The builds are now succeeding.

[tjni]

Result of nixpkgs-review pr 242721 run on aarch64-darwin 1

1 package built:

• temporal-cli

Built with sandbox enabled.

[tjni]

LGTM!

[github-actions]

Successfully created backport PR for release-23.05:

• [Backport release-23.05] temporal-cli: Fix Darwin builds with sandbox enabled #245110