All existing attempts fell short.
So we fall back to plain old copying applications over.
Problems with alternatives:
- Symlinking: Spotlight doesn't index symlinks. Therefore one cannot use
Spotlight to find or open the apps. Also they don't show up in
LaunchPad.
- Trampolines: Apples Security & Privacy doesn't get the concept and
shows them with the wrong name. Having an app open during an update will
also make it show up twice in the Dock.
- Aliasses: Require either AppleScript (a permission we don't want to
have, as it easily bypasses Apples TCC) or extra tools (that would be
ok), but also Aliasses are not categorized as 'Application' by
SpotLight.
- Directory Hardlinks are not supported by APFS - but also wouldn't work
cross volume.
- clonefile also doesn't work cross-volume.
Which all leads us back to Don Copine and Pastone. *sigh*
This backs out commit 3b738c765d.
Setting a `umask` made the parent directory have too conservative of
permissions making it so `_github-runner` couldn't access the child
directories.
A patch that replaced the original file with a symlink to nix store was
reverted because MacOS Network framework doesn't support symlinks for
the file.
The revert leaves the system without any /etc/hosts file at all though.
To fix this, an activation step is added to restore the original file
from .before-nix-darwin backup, if it exists.
Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
When `nix.enable` is off, we don’t necessarily have an active
Nix installation, so there won’t necessarily be an active
`/nix/var/nix/gcroots` directory to link things into. NixOS just skips
this unconditionally when `nix.enable` is off, but that doesn’t
work well with a context in which we usually expect `nix.enable`
to be coupled with an unmanaged system installation of Nix.
When we’re not managing the Nix installation, these defaults
aren’t used out of the box and won’t accurately represent the
state of any unmanaged Nix or the desired Nix package, so reading
the option defaults is a bug.
This was previously a warning for `nix.package` and a silent failure
for all the others. Now that all the problematic accesses in nix-darwin
have been appropriately conditionalized, and since a throw gives a
backtrace where a warning doesn’t, give throwing defaults to all the
`nix.*` options that don’t reflect reality and that that modules
shouldn’t be reading when `nix.enable` is off.
I’m not in love with the implementation strategy here… ideally
we’d think of something better than this and then upstream it to
NixOS. `nix.nrBuildUsers` growing a fake default that is never used
is particularly unfortunate. But this should hopefully catch mistakes
in module code reasonably reliably.
