Fix type errors in Sandbox.

Library/Homebrew/os.rb

@@ -5,9 +5,12 @@
 #
 # @api private
 module OS
+  extend T::Sig
+
   # Check if the operating system is macOS.
   #
   # @api public
+  sig { returns(T::Boolean) }
   def self.mac?
     return false if ENV["HOMEBREW_TEST_GENERIC_OS"]
 
@@ -17,6 +20,7 @@ module OS
   # Check if the operating system is Linux.
   #
   # @api public
+  sig { returns(T::Boolean) }
   def self.linux?
     return false if ENV["HOMEBREW_TEST_GENERIC_OS"]
 
@@ -26,6 +30,7 @@ module OS
   # Get the kernel version.
   #
   # @api public
+  sig { returns(Version) }
   def self.kernel_version
     @kernel_version ||= Version.new(Utils.safe_popen_read("uname", "-r").chomp)
   end

Library/Homebrew/sandbox.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "erb"
@@ -56,12 +56,12 @@ class Sandbox
   end
 
   def allow_cvs
-    allow_write_path "#{Dir.home(ENV["USER"])}/.cvspass"
+    allow_write_path "#{Dir.home(ENV.fetch("USER"))}/.cvspass"
   end
 
   def allow_fossil
-    allow_write_path "#{Dir.home(ENV["USER"])}/.fossil"
-    allow_write_path "#{Dir.home(ENV["USER"])}/.fossil-journal"
+    allow_write_path "#{Dir.home(ENV.fetch("USER"))}/.fossil"
+    allow_write_path "#{Dir.home(ENV.fetch("USER"))}/.fossil-journal"
   end
 
   def allow_write_cellar(formula)
@@ -72,7 +72,7 @@ class Sandbox
 
   # Xcode projects expect access to certain cache/archive dirs.
   def allow_write_xcode
-    allow_write_path "#{Dir.home(ENV["USER"])}/Library/Developer"
+    allow_write_path "#{Dir.home(ENV.fetch("USER"))}/Library/Developer"
   end
 
   def allow_write_log(formula)
@@ -94,7 +94,9 @@ class Sandbox
     seatbelt.write(@profile.dump)
     seatbelt.close
     @start = Time.now
-    safe_system SANDBOX_EXEC, "-f", seatbelt.path, *args
+
+    begin
+      T.unsafe(self).safe_system SANDBOX_EXEC, "-f", seatbelt.path, *args
     rescue
       @failed = true
       raise
@@ -131,6 +133,7 @@ class Sandbox
         end
       end
     end
+  end
 
   private