fix: fetchgitpatch on darwin

Builds effected by this bug might have seen messages like: `couldn't
open temporary file /nix/store/sedoypWC9: Operation not permitted`

.github/workflows/darwin.yml

@@ -0,0 +1,13 @@
+name: "Build packages on darwin"
+on:
+  pull_request:
+  push:
+    branches:
+      - 'master'
+jobs:
+  build:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/[email protected]
+    - uses: cachix/install-nix-action@v30
+    - run: nix build -L .#nix2container-bin .#skopeo-nix2container 

default.nix

@@ -35,12 +35,15 @@ let
       # These lines may include revisions of differing length, based on how Github generates them.
       # fetchpatch2 does not filter out, but probably should    
       fetchgitpatch = args: pkgs.fetchpatch2 (args // {
+	# On darwin, using sed with --in-place here fails as it tries to create
+	# temporary files at `/nix/store/<tempfilename>`.
         postFetch = (args.postFetch or "") + ''
-          sed -i \
+          sed \
             -e '/^index /d' \
             -e '/^similarity index /d' \
             -e '/^dissimilarity index /d' \
-            $out
+            $out > $tmpfile
+          mv $tmpfile $out
         '';
       });
       patch = fetchgitpatch {