nano: unbreak on darwin

[ryand56]

#417495

Fixes an issue with format string is not a string literal breaking nano on Darwin.
https://hydra.nixos.org/build/300187289/nixlog/1

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 24.11 and 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 24.11 and 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[ryand56]

cc @ngn999 @trofi

[Aleksanaa]

isDarwin or isClang

[Aleksanaa]

No, I mean whether this should be isDarwin or isClang

[ryand56]

Oh, my bad. This should be isDarwin as the failures happen specifically on those platforms. Though, I haven't tested clang

[Aleksanaa]

This should be isDarwin as the failures happen specifically on those platforms.

It's not enough. We have some packages that need to be built with clang, and some attempts are using clang as the default compiler. I hope we can always try to find the root cause instead of just turning off the error check when it appears.

[Aleksanaa]

https://fossies.org/diffs/gettext/0.23_vs_0.23.1/gettext-tools/gnulib-lib/openat-die.c-diff.html

This is probably fixing the issue. As a workaround, hardeningDisable should be turned on unconditionally.

[ryand56]

I've turned on hardeningDisable unconditionally for now. Hopefully, this will be good as a temporary workaround.
Edit: gettext has an update in #405793

[Aleksanaa]

Still don't know why this is popping up.

Since 25.05,

• Default clang version on macOS hasn't changed
• nano hasn't been updated or modified
• gettext hasn't been updated

Why nano builds succeeded on 25.05?

[ryand56]

What really confuses me is why it broke now, it worked fine a week ago..
Edit: Oh wait, nano was updated recently 🤦‍♂️

[Aleksanaa]

And last staging-next PR #412425 hasn't been merged yet

[trofi]

My guess would be that nano itself updated it's bundled gnulib version and that is not very compatible with darwin and format hardening.

[Aleksanaa]

--------- Report for 'aarch64-darwin' ---------
1 package marked as broken and skipped:
debian-devscripts

15 packages built:
cabal2nix cvs cvs-fast-export cvs2svn cvs2svn.dist cvsps cvsq luarocks-packages-updater luarocks-packages-updater.dist nano nano.info nix-prefetch-cvs nix-prefetch-scripts nix-update-source nix-update-source.dist

[Aleksanaa]

Yes, it's bundled. nano-8.4/lib/openat-die.c