sandbox too strict on macos

[hannesm]

The sandbox script on macos denies to properly run various commands in the test phase, as an example security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain does not output the trust anchors as expected -- observed in https://travis-ci.org/github/ocaml/opam-repository/jobs/734785206

How to reproduce: on a macos system, opam pin -n ca-certs https://github.com/mirage/ca-certs.git#v0.1.2 && opam install -t ca-certs. The expected result is that all tests are passing (which is the case if you execute dune runtest from the above repository). The observed result are failures since the above mentioned command executed successfully (exit status = 0), but did not produce any output.

[kit-ty-kate]

To reproduce more easily: ~/.opam/opam-init/hooks/sandbox.sh build security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain

[rjbou]

I don't a have a macos to test. What is failing, network or denial access to part of the system where are stored certificates ?