macOS build fails on Sequoia beta 2 and later (verified in public beta 3 as well) hosts during COPY step with the following failure:

% et build -c host_debug_unopt_arm64
[2024-08-06T17:42:50.496][macos/host_debug_unopt_arm64: GN]: OK
[macos/host_debug_unopt_arm64: ninja] 63.3% (6254/9882) CX...Transforms/Scalar/swiftshader_llvm_transforms_scalar.SROA.o[2024-08-06 17:50:55.606257][macos/host_debug_unopt_arm64: ninja]: FAILED
COMMAND:
/Users/chris/Developer/flutter/engine/src/flutter/third_party/ninja/ninja -C /Users/chris/Developer/flutter/engine/src/out/host_debug_unopt_arm64
STDOUT:
ninja: Entering directory `/Users/chris/Developer/flutter/engine/src/out/host_debug_unopt_arm64'
FAILED: gen/flutter/third_party/txt/assets/Apple Color Emoji.ttc
ln -f '/System/Library/Fonts/Apple Color Emoji.ttc' 'gen/flutter/third_party/txt/assets/Apple Color Emoji.ttc' 2>/dev/null || (rm -rf 'gen/flutter/third_party/txt/assets/Apple Color Emoji.ttc' && cp -af '/System/Library/Fonts/Apple Color Emoji.ttc' 'gen/flutter/third_party/txt/assets/Apple Color Emoji.ttc')
cp: chflags: gen/flutter/third_party/txt/assets/Apple Color Emoji.ttc: Operation not permitted
ninja: build stopped: subcommand failed.

STDERR:

This appears to be due to the fact that our copy tool, defined in build/toolchain/mac/BUILD.gn, uses the -a option:

     tool("copy") {
       command = "ln -f {{source}} {{output}} 2>/dev/null || (rm -rf {{output}} && cp -af {{source}} {{output}})"
       description = "COPY {{source}} {{output}}"
     }

The -a (Archive) option is an alias for -RpP:

• -R for recursive.
• -p for preserve attributes.
• -P for do not follow symbolic links (which is the default when -R is specified`.

Specifically, the problem appears to be the -p option which attempts to also set Access Control Lists and Extended Attributes. /System/Library/Fonts/Apple Color Emoji.ttc has the restricted extended attribute set, which is enforced by SIP. This file was also SIP-protected on macOS 14 (Sonoma), but the cp command copied the file and wrote the output without the restricted attribute without failing. The copy now appears to fail (as can be tested via cp -a /bin/ls ., which also fails. It's worth noting that the restricted extended attribute cannot be set (even by root) when SIP is enabled.

There are a couple workarounds:

• Change cp -af to cp -Rf. This succeeds but file metadata such as creation time, modification time, etc. are not preserved.
• Use rsync -arl. rsync's -a flag also copies metadata but on a best-efforts basis and doesn't error out when it fails to set the restricted attribute.

Of the two rsync seems like the better option as it more closely approximates what we have today.

Reference

Apple's open source implementation of cp lives in apple-oss-distributions/file_cmds/cp. The chflags call happens in int setfile(struct stat *fs, int fd) in utils.c which is called from int copy_file(const FTSENT *entp, int dne).

The most recent drop in the commit log was from 2024-03-26, but doesn't look related and only affects invocations where the -c flag was specified. I'd imagine we'll need to wait until the final macOS 15 release is out the door to get the changes introduced in Sequoia.