chromium: split the sandbox into a separate output

Related to #17460 and 66d5edf
Triggers a rebuild of Chromium

2 files changed, 8 insertions, 4 deletions

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 119a8c16f15c..7f6eb328ee1c 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -224,6 +224,13 @@ let
       commands = map buildCommand targets;
     in concatStringsSep "\n" commands;
 
+    outputs = ["out" "sandbox"];
+
+    postInstall = ''
+      mkdir -p "$sandbox/bin"
+      mv -v "$out/libexec/chromium/chrome-sandbox" "$sandbox/bin/${sandboxExecutableName}"
+    '';
+
     passthru = { inherit sandboxExecutableName; };
   };
 
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 8b4cb00a7786..82143f206370 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -73,7 +73,6 @@ in stdenv.mkDerivation {
   buildCommand = let
     browserBinary = "${chromium.browser}/libexec/chromium/chromium";
     getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
-    sandboxExecutableSourcePath = "${chromium.browser}/libexec/chromium/chrome-sandbox";
     launchScript = writeScript "chromium" ''
       #! ${stdenv.shell}
 
@@ -100,9 +99,7 @@ in stdenv.mkDerivation {
     substituteInPlace $out/bin/chromium --replace @out@ $out --replace @sandbox@ $sandbox
     chmod 755 "$out/bin/chromium"
 
-    mkdir -p "$sandbox/bin"
-    [ -x "${sandboxExecutableSourcePath}" ] || exit 1
-    ln -sv "${sandboxExecutableSourcePath}" "$sandbox/bin/${sandboxExecutableName}"
+    ln -sv "${chromium.browser.sandbox}" "$sandbox"
 
     ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
     ln -s "${chromium.browser}/share/icons" "$out/share/icons"