Requesting feedback on possibly making macOS sandbox setup failure non-fatal

[lf-]

Hi!

It can occur that the macOS sandbox_init() call can fail if the process is already running inside a sandboxed context, which occurs in practice in Nix builds (and possibly Bazel? I am not sure), which always run in a (comparatively loose) sandbox. Currently lowdown fails to execute in such an instance with sandbox initialization failed: Operation not permitted if it is built with the sandbox enabled.

Currently nixpkgs builds both with the sandbox enabled and with it disabled here, and the correct one is selected by package authors depending on whether it will be used in the sandbox or not: NixOS/nixpkgs#346945

However, it is possible that sandbox setup failure being fatal is an oversight from it normally not having any reason to fail. If so, the behaviour could possibly be relaxed.

Do you have any thoughts on this idea?