From c1cc6ff0c0680ae6d8228953ebba93c131e04775 Mon Sep 17 00:00:00 2001
From: DavHau <hsngrmpf+github@gmail.com>
Date: Fri, 6 Jun 2025 14:39:17 +0700
Subject: [PATCH] patch-shebangs.sh: fix for macos sandbox

fixes https://github.com/NixOS/nixpkgs/issues/343576
---
 .../build-support/setup-hooks/patch-shebangs.sh | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index a7b2b110f23f..316803dd4dd0 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -68,6 +68,18 @@ patchShebangs() {
         return 0
     fi
 
+    # like sponge from moreutils but in pure bash
+    _sponge() {
+        local content
+        local target
+        content=""
+        target="$1"
+        while IFS= read -r line || [[ -n "$line" ]]; do
+            content+="$line"$'\n'
+        done
+        printf '%s' "$content" > "$target"
+    }
+
     local f
     while IFS= read -r -d $'\0' f; do
         isScript "$f" || continue
@@ -126,11 +138,14 @@ patchShebangs() {
 
                 # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
                 timestamp=$(stat --printf "%y" "$f")
-                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+                sed -e "1 s|.*|#\!$escapedInterpreterLine|" "$f" | _sponge "$f"
+
                 touch --date "$timestamp" "$f"
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
+
+    unset -f _sponge
 }
 
 patchShebangsAuto () {