Why would nix-build fail but nix-shell --pure succeed?

I’m having an issue right now where a package is failing to build, and I can’t figure out why. It fails with nix-build, but using nix-shell --pure followed by genericBuild succeeds.


nix-shell --pure doesn’t enable sandboxing like nix-build would, so there could still be some interference with your running system.
What exactly is your error?

I don’t have sandboxing enabled globally (running on macOS here).

The error in question is really weird and has to do with Xcode. The package is macvim, and I was getting a codesigning error (not really sure why I’m getting it now but not before; I tried reinstalling Xcode 10.3 and still got it, but maybe there’s something I’m missing). So I patched the project file to disable code signing. This worked perfectly fine in my manual testing of a separate macvim checkout, and it worked in nix-shell, but in nix-build it still failed with the codesign error every time. I even used --keep-failed and verified that the project file was successfully patched, so I have no explanation whatsoever for why it was still trying to codesign despite it being disabled in the project.

Besides sandboxing, what else is different? I even tried nix-shell --pure --run … to ensure interactive vs non-interactive shell wasn’t an issue.