A second switch of macOS 5.5.0~alpha fails to install: create temp file for here document

[jrfondren]

The initial switch creation went fine. On Linux, a second switch created with the same constraints also went fine.

Shell session:

% opam switch create 5.5.0~alpha1

<><> Installing new switch packages <><><><><><><><><><><><><><><><><><><><>  🐫
Switch invariant: ["ocaml-base-compiler" {= "5.5.0~alpha1"}]

<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><>  🐫
∗ installed base-bigarray.base
∗ installed base-threads.base
∗ installed base-unix.base
∗ installed compiler-cloning.enabled
∗ installed ocaml-options-vanilla.1
⬇ retrieved ocaml.5.5.0  (https://opam.ocaml.org/cache)
⬇ retrieved ocaml-compiler.5.5.0~alpha1  (https://opam.ocaml.org/cache)
∗ installed ocaml-compiler.5.5.0~alpha1
∗ installed ocaml-base-compiler.5.5.0~alpha1
∗ installed ocaml.5.5.0
∗ installed base-domains.base
∗ installed base-effects.base
∗ installed base-nnp.base
Done.

<><> ocaml-compiler.5.5.0~alpha1 installed successfully <><><><><><><><><><>  🐫
=> This switch had to be compiled from sources, but future switches with the 🐌
   same compiler version and configuration should assemble instantly.

% opam switch create alpha 5.5.0~alpha1

<><> Installing new switch packages <><><><><><><><><><><><><><><><><><><><>  🐫
Switch invariant: ["ocaml-base-compiler" {= "5.5.0~alpha1"}]

<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><>  🐫
⬇ retrieved ocaml.5.5.0  (cached)
∗ installed base-bigarray.base
∗ installed base-threads.base
∗ installed base-unix.base
∗ installed compiler-cloning.enabled
∗ installed ocaml-options-vanilla.1
⬇ retrieved ocaml-compiler.5.5.0~alpha1  (cached)
[ERROR] The installation of ocaml-compiler failed at "sh tools/opam/process.sh make install 65d867a63d8bed97c673232e9e5332961167c656151c0adfa1944aded112088e ocaml-compiler
        /Users/jfondren/.opam/alpha".

#=== ERROR while installing ocaml-compiler.5.5.0~alpha1 =======================#
# context     2.5.0 | macos/arm64 |  | https://opam.ocaml.org#1483e466345261c73484d7214ab336dacc22d6f4
# path        ~/.opam/alpha/.opam-switch/build/ocaml-compiler.5.5.0~alpha1
# command     ~/.opam/opam-init/hooks/sandbox.sh install sh tools/opam/process.sh make install 65d867a63d8bed97c673232e9e5332961167c656151c0adfa1944aded112088e ocaml-compiler /Users/jfondren/.opam/alpha
# exit-code   1
# env-file    ~/.opam/log/ocaml-compiler-75250-ca222b.env
# output-file ~/.opam/log/ocaml-compiler-75250-ca222b.out
### output ###
# 📦 Installing the compiler to /Users/jfondren/.opam/alpha
# 🪄 Duplicating /Users/jfondren/.opam/5.5.0~alpha1
# ./share/ocaml/clone: line 23: cannot create temp file for here document: Operation not permitted



<><> Error report <><><><><><><><><><><><><><><><><><><><><><><><><><><><><>  🐫
┌─ The following actions failed
│ ∗ install ocaml-compiler 5.5.0~alpha1
└─
┌─ The following changes have been performed (the rest was aborted)
│ ∗ install base-bigarray         base
│ ∗ install base-threads          base
│ ∗ install base-unix             base
│ ∗ install compiler-cloning      enabled
│ ∗ install ocaml-options-vanilla 1
└─
Switch initialisation failed: clean up? ('n' will leave the switch partially installed) [Y/n]

I noticed this as I followed the exact instructions from the announcement, and then realized that this created a long switch name, when I'd prefer a shorter one.

The same failure's observed if I set TMPDIR to $HOME/tmp , or to $HOME/.opam/alpha/tmp to try and avoid sandboxing problems.

Line 23 of /Users/jfondren/.opam/5.5.0~alpha1/share/ocaml/clone is the first HERE doc:

dest="$1"'/bin' xargs sh "$1/clone-files" <<'EOF'

[kit-ty-kate]

cc @dra27

[dra27]

Is this ocaml/opam#5634 rearing its head again? I haven't got easy access to a Mac right now, but are you able to check whether your sandbox script resembles the one in that opam PR?