apple-sdk: init at 10.12.2 and 11.3

This is a new packaging of the Darwin SDK. Instead of splitting
libraries and frameworks into separate packages, it provides a single
package for the whole SDK.

# Features

- Vendored files are removed from the SDK. There are 50+ different
packages that are vendored by upstream (depending on the version);
- Components that are built in nixpkgs (either from upstream or from the
source releases) are also removed. If they need to be included by
default, they are propagated;
- A single SDK pattern is used to package all SDKs, and scripts are
provided to aid updating the SDK version and its source release
versions. This makes adding new SDKs much easier;
- SDK overrides are handled by adding the SDK version you require. If
multiple SDKs are present, only the newest is used. It is possible to
have different SDKs for each of build, host, and target platforms;
- Private headers are no longer provided by default unless you use the
SDK’s `privateFrameworksHook` to add them. It does the right thing
when multiple SDKs are in your inputs;
- Source releases for the SDK version are available via a passthru
`sourceRelease` function. This is mostly useful for getting private
headers for building source releases in the darwin attrset; and
- The same versions of propagated components are used on both platforms
(e.g., the same libresult, libiconv, etc).

See `pkgs/by-name/ap/apple-sdk/README.md` for details on how the SDK
derivation is structured and how to update it.

pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+}:
+
+let
+  CoreSymbolication = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "CoreSymbolication";
+    version = "0-unstable-2018-06-17";
+
+    src = fetchFromGitHub {
+      repo = "CoreSymbolication";
+      owner = "matthewbauer";
+      rev = "24c87c23664b3ee05dc7a5a87d647ae476a680e4";
+      hash = "sha256-PzvLq94eNhP0+rLwGMKcMzxuD6MlrNI7iT/eV0obtSE=";
+    };
+
+    patches = [
+      # Add missing symbol definitions needed to build `zlog` in system_cmds.
+      # https://github.com/matthewbauer/CoreSymbolication/pull/2
+      ../patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
+      ../patches/0002-Add-CF_EXPORT-To-const-symbols.patch
+    ];
+
+    dontBuild = true;
+
+    installPhase = ''
+      mkdir -p "$out/include"
+      cp *.h "$out/include"
+    '';
+
+    meta = {
+      description = "Reverse engineered headers for Apple's CoreSymbolication framework";
+      homepage = "https://github.com/matthewbauer/CoreSymbolication";
+      license = lib.licenses.mit;
+      maintainers = lib.teams.darwin.members;
+      platforms = lib.platforms.darwin;
+    };
+  });
+in
+self: super: {
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      mkdir -p System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+      ln -s A System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/Current
+      ln -s Versions/Current/Headers System/Library/PrivateFrameworks/CoreSymbolication.framework/Headers
+      cp '${CoreSymbolication}/include/'*.h System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/derivation-options.nix

···
+{ lib, config }:
+
+self: super: {
+  preBuild =
+    super.preBuild or ""
+    + ''
+      platformPath=$out/Platforms/MacOSX.platform
+      sdkpath=$platformPath/Developer/SDKs
+    '';
+
+  preInstall =
+    super.preInstall or ""
+    + ''
+      platformPath=$out/Platforms/MacOSX.platform
+      sdkpath=$platformPath/Developer/SDKs
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/fetch-sdk.nix

···
+{
+  lib,
+  fetchurl,
+  cpio,
+  pbzx,
+}:
+
+{
+  url,
+  version,
+  hash,
+}:
+
+fetchurl {
+  pname = "macOS-SDK";
+  inherit version url hash;
+
+  recursiveHash = true;
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  postFetch = ''
+    renamed=$(mktemp -d)/sdk.xar
+    mv "$downloadedFile" "$renamed"
+    pbzx "$renamed" | cpio -idm
+
+    # SDKs are inconsistent about whether MacOSX.sdk or MacOSX<version>.sdk is a symlink.
+    src=Library/Developer/CommandLineTools/SDKs/MacOSX${lib.versions.majorMinor version}.sdk
+    if [ ! -d $src ]; then
+      src=Library/Developer/CommandLineTools/SDKs/MacOSX.sdk
+    fi
+
+    # Remove unwanted binaries, man pages, and folders from the SDK.
+    rm -rf $src/usr/bin $src/usr/share $src/System/Library/Perl
+
+    mkdir -p "$out"
+    cp -rd $src/* "$out"
+  '';
+}

pkgs/by-name/ap/apple-sdk/common/passthru-private-frameworks.nix

···
+{ makeSetupHook, sdkVersion }:
+
+self: super: {
+  passthru = super.passthru or { } // {
+    privateFrameworksHook = makeSetupHook {
+      name = "apple-sdk-private-frameworks-hook";
+    } ../setup-hooks/add-private-frameworks.sh;
+  };
+}

pkgs/by-name/ap/apple-sdk/common/passthru-source-release-files.nix

···
+let
+  lockfile = builtins.fromJSON (builtins.readFile ../metadata/apple-oss-lockfile.json);
+in
+
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  sdkVersion,
+}:
+
+let
+  sdkinfo = lockfile.${sdkVersion};
+in
+self: super: {
+  passthru = super.passthru or { } // {
+    # Returns the raw source from apple-oss-distributions repo.
+    # This is mostly useful for copying private headers needed to build other source releases.
+    #
+    # Note: The source releases are mostly not used to build the SDK. Unless they can be used to build binaries,
+    # they’re not used.
+    sourceRelease =
+      name:
+      let
+        lockinfo = sdkinfo.${name};
+      in
+      fetchFromGitHub {
+        owner = "apple-oss-distributions";
+        repo = name;
+        rev = lockinfo.rev or "${name}-${lockinfo.version}";
+        inherit (lockinfo) hash;
+      }
+      // {
+        inherit (lockinfo) version;
+      };
+  };
+}

pkgs/by-name/ap/apple-sdk/common/plists.nix

···
+{
+  lib,
+  stdenvNoCC,
+  xcodePlatform,
+}:
+
+let
+  inherit (lib.generators) toPlist;
+
+  Info = {
+    CFBundleIdentifier = "com.apple.platform.${lib.toLower xcodePlatform}";
+    Type = "Platform";
+    Name = lib.toLower xcodePlatform;
+  };
+
+  # These files are all based off of Xcode spec files found in
+  # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
+
+  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
+  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  Architectures = [
+    {
+      Identifier = "Standard";
+      Type = "Architecture";
+      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD";
+    }
+    {
+      Identifier = "Universal";
+      Type = "Architecture";
+      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
+    }
+    {
+      Identifier = "Native";
+      Type = "Architecture";
+      Name = "Native Architecture of Build Machine";
+      ArchitectureSetting = "NATIVE_ARCH_ACTUAL";
+    }
+    {
+      Identifier = "Standard64bit";
+      Type = "Architecture";
+      Name = "Apple Silicon, 64-bit Intel";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
+    }
+    {
+      Identifier = stdenvNoCC.hostPlatform.darwinArch;
+      Type = "Architecture";
+      Name = "Apple Silicon or Intel 64-bit";
+    }
+    {
+      Identifier = "Standard_Including_64_bit";
+      Type = "Architecture";
+      Name = "Standard Architectures (including 64-bit)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
+    }
+  ];
+
+  # Based off of the "MacOSX Package Types.xcspec" file. Only keep the
+  # bare minimum needed.
+  PackageTypes = [
+    {
+      Identifier = "com.apple.package-type.mach-o-executable";
+      Type = "PackageType";
+      Name = "Mach-O Executable";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.executable";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-objfile";
+      Type = "PackageType";
+      Name = "Mach-O Object File";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.objfile";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-dylib";
+      Type = "PackageType";
+      Name = "Mach-O Dynamic Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.dylib";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.static-library";
+      Type = "PackageType";
+      Name = "Mach-O Static Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".a";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "archive.ar";
+        Name = "$(EXECUTABLE_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper";
+      Type = "PackageType";
+      Name = "Wrapper";
+      DefaultBuildSettings = {
+        WRAPPER_SUFFIX = ".bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        CONTENTS_FOLDER_PATH = "$(WRAPPER_NAME)/Contents";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/MacOS";
+        EXECUTABLE_PATH = "$(EXECUTABLE_FOLDER_PATH)/$(EXECUTABLE_NAME)";
+        INFOPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/Info.plist";
+        INFOSTRINGS_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/InfoPlist.strings";
+        PKGINFO_PATH = "$(CONTENTS_FOLDER_PATH)/PkgInfo";
+        PBDEVELOPMENTPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/pbdevelopment.plist";
+        VERSIONPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/version.plist";
+        PUBLIC_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Headers";
+        PRIVATE_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PrivateHeaders";
+        EXECUTABLES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Executables";
+        FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Frameworks";
+        SHARED_FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedFrameworks";
+        SHARED_SUPPORT_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedSupport";
+        UNLOCALIZED_RESOURCES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Resources";
+        LOCALIZED_RESOURCES_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/$(DEVELOPMENT_LANGUAGE).lproj";
+        DOCUMENTATION_FOLDER_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/Documentation";
+        PLUGINS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PlugIns";
+        SCRIPTS_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/Scripts";
+      };
+      ProductReference = {
+        FileType = "wrapper.cfbundle";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper.application";
+      Type = "PackageType";
+      BasedOn = "com.apple.package-type.wrapper";
+      Name = "Application Wrapper";
+      DefaultBuildSettings = {
+        GENERATE_PKGINFO_FILE = "YES";
+      };
+      ProductReference = {
+        FileType = "wrapper.application";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "YES";
+      };
+    }
+  ];
+
+  # Based off of the "MacOSX Product Types.xcspec" file. All
+  # bundles/wrapper are removed, because we prefer dynamic products in
+  # NixPkgs.
+  ProductTypes = [
+    {
+      Identifier = "com.apple.product-type.tool";
+      Type = "ProductType";
+      Name = "Command-line Tool";
+      PackageTypes = [ "com.apple.package-type.mach-o-executable" ];
+    }
+    {
+      Identifier = "com.apple.product-type.objfile";
+      Type = "ProductType";
+      Name = "Object File";
+      PackageTypes = [ "com.apple.package-type.mach-o-objfile" ];
+    }
+    {
+      Identifier = "com.apple.product-type.library.dynamic";
+      Type = "ProductType";
+      Name = "Dynamic Library";
+      PackageTypes = [ "com.apple.package-type.mach-o-dylib" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "mh_dylib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "dylib";
+        DYLIB_COMPATIBILITY_VERSION = "1";
+        DYLIB_CURRENT_VERSION = "1";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        GCC_INLINES_ARE_PRIVATE_EXTERN = "YES";
+        CODE_SIGNING_ALLOWED = "YES";
+        CODE_SIGNING_REQUIRED = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.product-type.library.static";
+      Type = "ProductType";
+      Name = "Static Library";
+      PackageTypes = [ "com.apple.package-type.static-library" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "staticlib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "a";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        SEPARATE_STRIP = "YES";
+        CLANG_ENABLE_MODULE_DEBUGGING = "NO";
+      };
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.bundle";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+    {
+      Identifier = "com.apple.product-type.application";
+      Type = "ProductType";
+      BasedOn = "com.apple.product-type.bundle";
+      Name = "Application";
+      DefaultBuildProperties = {
+        MACH_O_TYPE = "mh_execute";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "app";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper.application" ];
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.framework";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+  ];
+
+  ToolchainInfo = {
+    Identifier = "com.apple.dt.toolchain.XcodeDefault";
+  };
+in
+{
+  "Info.plist" = builtins.toFile "Info.plist" (toPlist { } Info);
+  "ToolchainInfo.plist" = builtins.toFile "ToolchainInfo.plist" (toPlist { } ToolchainInfo);
+  "Architectures.xcspec" = builtins.toFile "Architectures.xcspec" (toPlist { } Architectures);
+  "PackageTypes.xcspec" = builtins.toFile "PackageTypes.xcspec" (toPlist { } PackageTypes);
+  "ProductTypes.xcspec" = builtins.toFile "ProductTypes.xcspec" (toPlist { } ProductTypes);
+}

pkgs/by-name/ap/apple-sdk/common/process-stubs.nix

···
+let
+  removedDylibs = [
+    # corecrypto is available under a very restrictive license (effectively: non-free, can’t use).
+    # Without the headers and not being able to use corecrypto due to its license, it’s not very useful.
+    # Stubs are included in the SDK for all dylibs, including corecrypto. They should be removed.
+    "/usr/lib/system/libcorecrypto.dylib"
+  ];
+in
+
+{
+  lib,
+  jq,
+  libtapi,
+}:
+
+self: super: {
+  nativeBuildInputs = super.nativeBuildInputs or [ ] ++ [
+    jq
+    libtapi
+  ];
+
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      echo "Removing the following dylibs from the libSystem reexported libraries list: ${lib.escapeShellArg (lib.concatStringsSep ", " removedDylibs)}"
+      for libSystem in libSystem.B.tbd libSystem.B_asan.tbd; do
+        test ! -e usr/lib/$libSystem && continue # TODO: remove once the minimum SDK is 10.14 or newer.
+        tapi stubify --filetype=tbd-v5 usr/lib/$libSystem -o usr/lib/$libSystem # tbd-v5 is a JSON-based format.
+        jq --argjson libs ${lib.escapeShellArg (builtins.toJSON removedDylibs)} '
+          if .libraries then
+            .libraries[] |= select(.install_names[] | any([.] | inside($libs)) | not)
+          else
+            .
+          end
+          | .main_library.reexported_libraries[].names[] |= select([.] | inside($libs) | not)
+        ' usr/lib/$libSystem > usr/lib/$libSystem~
+        mv usr/lib/$libSystem~ usr/lib/$libSystem
+      done
+
+      # Rewrite the text-based stubs to v4 using `tapi`. This ensures a consistent format between SDK versions.
+      # tbd-v4 also drops certain elements that are no longer necessary (such as GUID lists).
+      find . -name '*.tbd' -type f \
+        -exec echo "Converting {} to tbd-v4" \; \
+        -exec tapi stubify --filetype=tbd-v4 {} -o {} \;
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix

···
+{
+  lib,
+  cups,
+  darwin,
+  db,
+  libiconv,
+  ncurses,
+  stdenv,
+  stdenvNoCC,
+  xcbuild,
+}:
+
+let
+  # CUPS has too many dependencies to build as part of the Darwin bootstrap. It’s also typically taken as an explicit
+  # dependency by other packages, so building only the headers (to satisfy other SDK headers) should be okay.
+  cupsHeaders = darwin.bootstrapStdenv.mkDerivation {
+    pname = "${lib.getName cups}-headers";
+    version = lib.getVersion cups;
+
+    inherit (cups) src;
+
+    patches = cups.patches or [ ];
+
+    strictDeps = true;
+
+    dontBuild = true;
+
+    buildInputs = [ darwin.libresolv ]; # The `configure` script requires libresolv headers.
+
+    # CUPS’s configure script fails to find `ar` when cross-compiling.
+    configureFlags = [ "ac_cv_path_AR=${stdenv.cc.targetPrefix}ar" ];
+
+    installTargets = [ "install-headers" ];
+
+    __structuredAttrs = true;
+
+    meta = {
+      inherit (cups.meta)
+        homepage
+        description
+        license
+        maintainers
+        platforms
+        ;
+    };
+  };
+in
+self: super: {
+  # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
+  # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
+  propagatedBuildInputs =
+    super.propagatedBuildInputs or [ ]
+    ++ [
+      libiconv
+      darwin.libresolv
+      darwin.libsbuf
+      # Required by some SDK headers
+      cupsHeaders
+    ]
+    # x86_64-darwin links the object files from Csu when targeting very old releases
+    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+
+  # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'*; do
+        ln -s "$header" "usr/include/$(basename "$header")"
+      done
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix

···
+{
+  lib,
+  pkgsBuildHost,
+  stdenv,
+  stdenvNoCC,
+}:
+
+let
+  plists = import ./plists.nix {
+    inherit lib stdenvNoCC;
+    xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
+  };
+  inherit (pkgsBuildHost) darwin cctools xcbuild;
+in
+self: super: {
+  propagatedNativeBuildInputs = super.propagatedNativeBuildInputs or [ ] ++ [ xcbuild.xcrun ];
+
+  postInstall =
+    super.postInstall or ""
+    + ''
+      specspath=$out/Library/Xcode/Specifications
+      toolchainsPath=$out/Toolchains/XcodeDefault.xctoolchain
+      mkdir -p "$specspath" "$toolchainsPath"
+
+      # xcbuild expects to find things relative to the plist locations. If these are linked instead of copied,
+      # it won’t find any platforms or SDKs.
+      cp '${plists."Info.plist"}' "$platformPath/Info.plist"
+      cp '${plists."ToolchainInfo.plist"}' "$toolchainsPath/ToolchainInfo.plist"
+
+      for spec in '${xcbuild}/Library/Xcode/Specifications/'*; do
+        ln -s "$spec" "$specspath/$(basename "$spec")"
+      done
+      cp '${plists."Architectures.xcspec"}' "$specspath/Architectures.xcspec"
+      cp '${plists."PackageTypes.xcspec"}' "$specspath/PackageTypes.xcspec"
+      cp '${plists."ProductTypes.xcspec"}' "$specspath/ProductTypes.xcspec"
+
+      mkdir -p "$out/usr/bin"
+      ln -s '${xcbuild.xcrun}/bin/xcrun' "$out/usr/bin/xcrun"
+
+      # Include `libtool` in the toolchain, so `xcrun -find libtool` can find it without requiring `cctools.libtool`
+      # as a `nativeBuildInput`.
+      mkdir -p "$toolchainsPath/usr/bin"
+      ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+
+      # Include additional binutils required by some packages (such as Chromium).
+      for tool in lipo nm otool size strip; do
+        ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      done
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/remove-disallowed-packages.nix

···
+let
+  # This can be made unconditional once jq is available in the bootstrap tools. If corecrypto is  not removed from
+  # the umbrella framework, linking will fail in stage 1 because it can’t find the tbd.
+  disallowedPackages' = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+in
+
+{
+  lib,
+  jq,
+  stdenv,
+}:
+
+let
+  disallowedPackages =
+    if jq == null then
+      lib.filter (p: p.package != "corecrypto") disallowedPackages'
+    else
+      disallowedPackages';
+in
+self: super: {
+  # Remove headers and stubs for packages that are available in nixpkgs.
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      ${lib.concatMapStringsSep "\n" (
+        pkg:
+        lib.concatLines (
+          [ ''echo "Removing headers and libraries from ${pkg.package}"'' ]
+          ++ (map (header: "rm -rf -- usr/include/${header}") pkg.headers or [ ])
+          ++ (map (framework: "rm -rf -- System/Library/Frameworks/${framework}") pkg.frameworks or [ ])
+          ++ (map (library: "rm -rf -- usr/lib/${library}") pkg.libraries or [ ])
+        )
+      ) disallowedPackages}
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/rewrite-sdk-paths.nix

···
+{ lib, sdkVersion }:
+
+let
+  name = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+in
+self: super: {
+  # Rewrite the stubs to point to dylibs in the SDK instead of at system locations. This is needed for umbrella
+  # frameworks in older SDKs, which don’t also embed their stubs.
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      echo "Rewriting stubs to reference the SDK location in the store"
+      find . -name '*.tbd' -type f -exec sed -E \
+        -e "/^install-name/n; s|( \\|'\\|\"\\|\\[)/usr/|\1$sdkpath/${name}/usr/|g" \
+        -e "/^install-name/n; s|( \\|'\\|\"\\|\\[)/System/|\1$sdkpath/${name}/System/|g" \
+        -i {} \;
+    '';
+}

pkgs/by-name/ap/apple-sdk/common/run-build-phase-hooks.nix

···
+{ }:
+
+self: super: {
+  buildPhase = ''
+    runHook preBuild
+    ${super.buildPhase or ""}
+    runHook postBuild
+  '';
+}

pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json

···
+{
+  "10.12.2": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-1mCJjZLBMIftcsKC7Ihhzi6LRS3u7kJzh9/dy6MY1Hg=",
+      "version": "60092.30.2"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-5t3D44H/h0cUZqAjMi56BTbJD4o+R0xVdHJ1sZLYgNM=",
+      "version": "205.11"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-4NpWcqfkp3UxhKKAwomDK3zxQ9DagyYFUVoUcrHo1Rg=",
+      "version": "18"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-XOwdBFunLbwyasnTKQC6MRlXxGns07JvcAQc6AQ1Zt4=",
+      "version": "56"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-bbGzqJnenEL9hRyKMBif/381/ETO+yNYHhlnXXWLne0=",
+      "version": "41.1"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-rhZdjNoZ3OuHVLClhe9tMQU6qJs3IOHEqJ5TaNRJRnM=",
+      "version": "424"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-adOI5uhd6QL4zpo4MK4ttmS1lcKseqmr68C1D/juGo0=",
+      "version": "465"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-5UWldDuSyAnRYjgIKllY4VNbxtAUawrlRS46+8FnbPs=",
+      "version": "427"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-a/xnnR2dUSWVMyTlkxJPa7cWk20RHl0Zh2Ot2pSEkF0=",
+      "version": "252"
+    },
+    "IOGraphics": {
+      "hash": "sha256-63XDVmEHu+KUdr06S7+RPi1BgLcAl4GZZRy+K96CvA0=",
+      "version": "513.1"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-BUDj89w4DrnsIxJZNIx3ZJ85c22HMchIVhJI7xREWTM=",
+      "version": "870.31.1"
+    },
+    "IOKitUser": {
+      "hash": "sha256-XJnOp5AtStXUim19GLev8MSM8iS5U8rRSnm7cNp/B80=",
+      "version": "1324.30.13"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-dL1wSu72uzAAoMdgSjitXgHviioVIGdkDXqwY6HT5/g=",
+      "version": "116.1.1"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-ZcZ5F+a4u2AHThO5WyLn3/o42DR+YDBZKTy4P2EhHhk=",
+      "version": "91"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-IjsG/lgdtW04WH/5rb1QAT563Oy4O5fUrTGuA1kBrkY=",
+      "version": "210.30.1"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-wyt5CJnNzk0MPC6pg2JAdiwIPxWFJsO9Yqa83vY+hLc=",
+      "version": "1158.30.7"
+    },
+    "Libinfo": {
+      "hash": "sha256-3Mu9lOkaQx5gmNPXzr67FnZvKWmQhryIPsN6k95TU18=",
+      "version": "503.30.1"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-msGtbR53SHXjYN8i74gmkYWGkmqg+TcRO7TY/23XSFQ=",
+      "version": "165.20.1"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
+      "version": "26"
+    },
+    "Libsystem": {
+      "hash": "sha256-FwI2aD3wSwES/sKkr014BdFLfsKeEefgS0Pne1FGOp0=",
+      "version": "1238"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-Ya+ZO3bHNhQ+vZZx/lE7x+uMROHYWYKvm2ZZ1vClu3Q=",
+      "version": "57740.31.2"
+    },
+    "architecture": {
+      "hash": "sha256-gHUfKWc1uahI/IATafY1ppPAWnYUghOEXWK2lknAfrQ=",
+      "version": "268"
+    },
+    "configd": {
+      "hash": "sha256-i1UjnU7xBh7jCrGZxWMGrldzDrk2dDvjpthp/kq9OKo=",
+      "version": "888.30.2"
+    },
+    "copyfile": {
+      "hash": "sha256-pth+37uTfuFY94HuA4b/5GleDjidAuXVsBEQBUa3xCE=",
+      "version": "138"
+    },
+    "dtrace": {
+      "hash": "sha256-dK0N3l02241A5S1uvxZhqArHrTxd5Sd4JoAl6RBa8/8=",
+      "version": "209.20.4"
+    },
+    "dyld": {
+      "hash": "sha256-wyVsmqYgKLdMKZsLOHzOLag+mBnH0kNS6XAv4zuNTT4=",
+      "version": "421.2"
+    },
+    "eap8021x": {
+      "hash": "sha256-XSbzuNXyDJAADcnZed4Akmg1SK8P1IGrZitmhV3wzlo=",
+      "version": "246.30.1"
+    },
+    "hfs": {
+      "hash": "sha256-7ByUP59FXmmrxC5yJYUQxrkgt/vY7vZMl5JPQ0HfoS8=",
+      "version": "366.30.3"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-hfXKQDRdgEDVyT+3v/EuQZyXNd0abD2tICYdQNfhtwY=",
+      "version": "67"
+    },
+    "libdispatch": {
+      "hash": "sha256-tj4+6V4FL/XVON13UH71schElTm4/IKtPJH/yoUgRY0=",
+      "version": "703.30.5"
+    },
+    "libmalloc": {
+      "hash": "sha256-q9zcUy8YTsRds6RYJMIUIY/MULQ19uKiNduMXP3D7hA=",
+      "version": "116.30.3"
+    },
+    "libplatform": {
+      "hash": "sha256-k9Pd+TJCrNS7K100og+6bLAZjV/0VUTy8SIOsc+SE6Q=",
+      "version": "126.1.2"
+    },
+    "libpthread": {
+      "hash": "sha256-FJaJO4lXIMAIwEmVF6mHE4ZZZoPI8ZIVuMKLojEsESE=",
+      "version": "218.30.1"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-LYDkkmgyfWKK6AMINXyrXo5kw7+lxUcz+4Ckq9175vA=",
+      "version": "765.30.11"
+    },
+    "objc4": {
+      "hash": "sha256-WfhJo+/KPGr3/OuV5Kg2no48UR7VVVarh9TB3VFSCQ4=",
+      "version": "706"
+    },
+    "ppp": {
+      "hash": "sha256-eW62wL8C1GZ2+5aN0dTPsdoEu6FWf+6XEYv8OiEeMfY=",
+      "version": "838"
+    },
+    "removefile": {
+      "hash": "sha256-EJYU6eHggyRsezClEWkGJmgePIdtyF4rpFD4kSK5Czw=",
+      "version": "45"
+    },
+    "xnu": {
+      "hash": "sha256-pkELzbsWPtm9H31LaRkaVjkQpPDxG9E93TNS+K9nqhE=",
+      "version": "3789.31.2"
+    }
+  },
+  "11.3": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-92v9tuNLqvalwYV4AqQllA8yN9fqGjSpc4MNAmFPrbk=",
+      "version": "60178.100.1"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-dSSbt9ZoL/Tq2xXwvvXsDmD3Xru7igzdK1MxGL1K+Aw=",
+      "version": "300.6.1"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
+      "version": "20.100.1"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-w0YhZ38RBfnxSc74Q8r5UdK+WiWOSAX46r5hahHLnSg=",
+      "version": "59"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+      "version": "43"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-7H3WcZC/HuS9xsTNDWRqt+1JzUNK4ndvd4u2ru0GGRE=",
+      "version": "428"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-2xppN8RJ9cxrHWjPQ4bUIjtupPbzfmrm3rXnT/9QVfc=",
+      "version": "483"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-kfhmZy8veqI3/XHDtOTKmKj6P7s+j0B+BiAbcjhGq0M=",
+      "version": "442"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-WDq2Ak72Jw6gYNIKgZkiexA6LzccrPn1kpSbW5U50ek=",
+      "version": "257.40.1"
+    },
+    "IOGraphics": {
+      "hash": "sha256-kEP4RWIZwu3ZPIq9IAPUKM0gIXHr8xD50SnGNFCQRcI=",
+      "version": "585.1"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-QASfvttke+AUx55In4DD4vsQGzC3nbe+MugQQ4ddXGU=",
+      "version": "1633.100.36"
+    },
+    "IOKitUser": {
+      "hash": "sha256-NQCRrufElx00B7CqqslBi5BTxf5Zs4lcMcJig4Eab0k=",
+      "version": "1845.100.19"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-HqTKzrX75mMFYYbxNKwPdXmI7h7t/QWuO3W1Qo//zIo=",
+      "version": "151.40.1"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+      "version": "93"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-dy6CYz/z6SwPw0YfC6GLZO2u62Xy8otMDUNrZ5JhTDY=",
+      "version": "260.100.1"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-v01g/EtMW/STZQ1neKDMyUGL7sgaCzlwXN0VDaj/Mf0=",
+      "version": "1439.100.3"
+    },
+    "Libinfo": {
+      "hash": "sha256-T7KO6zfswjyTIKSdZJCbvfsdqQfPMLj5nheX9iSIl9o=",
+      "version": "542.40.3"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-vcDjdwB5OiTEUdl8ISezzpoHeFttkdvkulY/YbUOZjk=",
+      "version": "279.40.4"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
+      "version": "26"
+    },
+    "Libsystem": {
+      "hash": "sha256-24T9aD4W71prcpr3MnnaU3pfxIzIwkOz39OyhCwPO/E=",
+      "version": "1292.100.5"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-o5MyyqDpERvNPvbEfXNgqMIq0YpQV0+ju72C9g/9OdI=",
+      "version": "59754.100.106"
+    },
+    "architecture": {
+      "hash": "sha256-pIX9pEXE1Xjll9qwiWrMRwqw6G4g0isto/ALHsmkUSc=",
+      "version": "279"
+    },
+    "configd": {
+      "hash": "sha256-WEorIW5Vl8E9/aB0RBTY2bhkfVOF3tckjNztGDOOueA=",
+      "version": "1109.101.1"
+    },
+    "copyfile": {
+      "hash": "sha256-3BHFM67dvwUpinzF0pSX3QiUbIsqtLo77WzB3tMbTW4=",
+      "version": "173.40.2"
+    },
+    "dtrace": {
+      "hash": "sha256-FfyaYjEMDeL9wGdUyZ4eJdkbkp/WpdTGyBvaorwKSi8=",
+      "version": "370.40.1"
+    },
+    "dyld": {
+      "hash": "sha256-dtDTh6YqubBI4Z+QeytwGgUmU6tutvonIWHqzw6zuxo=",
+      "version": "851.27"
+    },
+    "eap8021x": {
+      "hash": "sha256-Ap7qumn/oKYe424n2NW6QkuivgDyLoJgDfl30Q5O7Jo=",
+      "version": "304.100.1"
+    },
+    "hfs": {
+      "hash": "sha256-MSnc1pB8DcB+mn308snTD1uRQ7Ro4aWyFuLdWjHtAG4=",
+      "version": "556.100.11"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-UgmMnDUosaC2yI7IyQ7mkNwZ6/oft77ay+SmGSoycIw=",
+      "version": "79"
+    },
+    "libdispatch": {
+      "hash": "sha256-K8QL9NfjGsj8c0jbocKegmKBqydimpKu8yRXnQQqdH8=",
+      "version": "1271.100.5"
+    },
+    "libmalloc": {
+      "hash": "sha256-k3dJk7S0Lom3B28vRI9QxIuo0AOkd9OHzWO7MandfUw=",
+      "version": "317.100.9"
+    },
+    "libplatform": {
+      "hash": "sha256-BSIGgKj5B6Dr0KQiIl2LSA3+ZEhzk/snQeCauErcq6k=",
+      "version": "254.80.2"
+    },
+    "libpthread": {
+      "hash": "sha256-cGaDXLTztUYppbMvv41qj5RqONXfhfdHpt9dqY6+5Lc=",
+      "version": "454.100.8"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-eqcv174vIwWYXrIhzph+KO1zG8TdK5jRFVgsaAlV9es=",
+      "version": "1310.100.10"
+    },
+    "objc4": {
+      "hash": "sha256-rqOPyN9S4KbMhCCVvtyEmGxTWzy+tsh0kfu3k47szXo=",
+      "version": "818.2"
+    },
+    "ppp": {
+      "hash": "sha256-pSOlu/yXQhopCHDLnmhUnQeU89MkXhkQB0ZrN9r3qyk=",
+      "version": "877.40.2"
+    },
+    "removefile": {
+      "hash": "sha256-B79A9AQ1/cB+zlmVKWcEXVOJHW6rOrX40S/hrMuWqXU=",
+      "version": "49.101.1"
+    },
+    "xnu": {
+      "hash": "sha256-M1XWippH55VUJu4aosRFX8j9aOm/PONYVjPZOPufD80=",
+      "version": "7195.101.1"
+    }
+  }
+}

pkgs/by-name/ap/apple-sdk/metadata/disallowed-packages.json

···
+[
+  {
+    "package": "apache",
+    "headers": [
+      "apache2"
+    ]
+  },
+  {
+    "package": "apr",
+    "headers": [
+      "apr-1"
+    ],
+    "libraries": [
+      "libapr-1.*",
+      "libaprutil-1.*"
+    ]
+  },
+  {
+    "package": "boringssl",
+    "libraries": [
+      "libboringssl.*"
+    ]
+  },
+  {
+    "package": "bzip2",
+    "headers": [
+      "bzlib.h"
+    ],
+    "libraries": [
+      "libbz2.*"
+    ]
+  },
+  {
+    "package": "corecrypto",
+    "libraries": [
+      "system/libcorecrypto*"
+    ]
+  },
+  {
+    "package": "Csu",
+    "libraries": [
+      "*.o"
+    ]
+  },
+  {
+    "package": "cups",
+    "headers": [
+      "cups"
+    ],
+    "libraries": [
+      "libcups*"
+    ]
+  },
+  {
+    "package": "curl",
+    "headers": [
+      "curl"
+    ],
+    "libraries": [
+      "libcurl.*"
+    ]
+  },
+  {
+    "package": "cyrus_sasl",
+    "headers": [
+      "sasl"
+    ],
+    "libraries": [
+      "libsasl*"
+    ]
+  },
+  {
+    "package": "dtrace",
+    "headers": [
+      "dtrace.h"
+    ],
+    "libraries": [
+      "*dtrace*"
+    ]
+  },
+  {
+    "package": "editline",
+    "headers": [
+      "editline.h",
+      "editline"
+    ],
+    "libraries": [
+      "libedit.*",
+      "libeditline.*"
+    ]
+  },
+  {
+    "package": "html-tidy",
+    "headers": [
+      "tidy*"
+    ],
+    "libraries": [
+      "libtidy.*"
+    ]
+  },
+  {
+    "package": "hunspell",
+    "headers": [
+      "hunspell"
+    ],
+    "libraries": [
+      "libhunspell*"
+    ]
+  },
+  {
+    "package": "icu",
+    "headers": [
+      "unicode"
+    ],
+    "libraries": [
+      "libicucore.*"
+    ]
+  },
+  {
+    "package": "libarchive",
+    "headers": [
+      "archive.h",
+      "archive_entry.h"
+    ],
+    "libraries": [
+      "libarchive.*"
+    ]
+  },
+  {
+    "package": "libc++",
+    "headers": [
+      "c++",
+      "cxxabi.h",
+      "__cxxabi_config.h"
+    ],
+    "libraries": [
+      "libc++*"
+    ]
+  },
+  {
+    "package": "ld64",
+    "libraries": [
+      "libcodedirectory.*",
+      "libcodedirectory_static.*"
+    ]
+  },
+  {
+    "package": "expat",
+    "headers": [
+      "expat.h",
+      "expat_config.h",
+      "expat_external.h"
+    ],
+    "libraries": [
+      "libexpat.*"
+    ]
+  },
+  {
+    "package": "libffi",
+    "headers": [
+      "ffi*"
+    ],
+    "libraries": [
+      "libffi*"
+    ]
+  },
+  {
+    "package": "libgcc",
+    "libraries": [
+      "libgcc*"
+    ]
+  },
+  {
+    "package": "libiconv",
+    "headers": [
+      "iconv.h",
+      "libcharset.h",
+      "localcharset.h"
+    ],
+    "libraries": [
+      "libcharset.*",
+      "libiconv.*",
+      "i18n"
+    ]
+  },
+  {
+    "package": "libiodbc",
+    "libraries": [
+      "libiodbc*"
+    ]
+  },
+  {
+    "package": "libkrb4",
+    "libraries": [
+      "libkrb4.*"
+    ]
+  },
+  {
+    "package": "libkrb5",
+    "headers": [
+      "com_err.h",
+      "gssapi",
+      "gssapi.h",
+      "gssrpc",
+      "kadm5",
+      "kdb.h",
+      "krad.h",
+      "krb5",
+      "krb5.h",
+      "profile.h",
+      "verto-module.h",
+      "verto.h"
+    ],
+    "libraries": [
+      "krb5",
+      "libcom_err.*",
+      "libgssapi_krb5.*",
+      "libgssrpc.*",
+      "libk5crypto.*",
+      "libkadm5clnt.*",
+      "libkadm5clnt_mit.*",
+      "libkadm5srv.*",
+      "libkadm5srv_mit.*",
+      "libkdb5.*",
+      "libkrad.*",
+      "libkrb5*",
+      "libkrb5support.*",
+      "libverto.*"
+    ]
+  },
+  {
+    "package": "libpcap",
+    "headers": [
+      "pcap*"
+    ],
+    "libraries": [
+      "libpcap.*"
+    ]
+  },
+  {
+    "package": "libresolv",
+    "headers": [
+      "arpa/nameser.h",
+      "arpa/nameser_compat.h",
+      "dns.h",
+      "dns_util.h",
+      "nameser.h",
+      "resolv.h"
+    ],
+    "libraries": [
+      "libresolv.*"
+    ]
+  },
+  {
+    "package": "libstdc++",
+    "libraries": [
+      "libstdc++.*"
+    ]
+  },
+  {
+    "package": "libsbuf",
+    "headers": [
+      "usbuf.h"
+    ],
+    "libraries": [
+      "libsbuf.*"
+    ]
+  },
+  {
+    "package": "libtermcap",
+    "headers": [
+      "termcap.h"
+    ],
+    "libraries": [
+      "libtermcap.*"
+    ]
+  },
+  {
+    "package": "libutil",
+    "headers": [
+      "libutil.h"
+    ],
+    "libraries": [
+      "libutil.*",
+      "libutil1.*"
+    ]
+  },
+  {
+    "package": "libxml2",
+    "headers": [
+      "libxml",
+      "libxml2"
+    ],
+    "libraries": [
+      "libxml2.*"
+    ]
+  },
+  {
+    "package": "libxo",
+    "headers": [
+      "libxo"
+    ],
+    "libraries": [
+      "libxo.*"
+    ]
+  },
+  {
+    "package": "libxslt",
+    "headers": [
+      "libexslt",
+      "libxslt"
+    ],
+    "libraries": [
+      "libexslt.*",
+      "libxslt.*"
+    ]
+  },
+  {
+    "package": "liby",
+    "libraries": [
+      "liby.a"
+    ]
+  },
+  {
+    "package": "marisa-trie",
+    "libraries": [
+      "libmarisa.*"
+    ]
+  },
+  {
+    "package": "ncurses",
+    "headers": [
+      "curses*",
+      "cursslk.h",
+      "eti.h",
+      "etip.h",
+      "form.h",
+      "menu.h",
+      "nc_tparm.h",
+      "ncurses*",
+      "panel.h",
+      "term.h",
+      "term_entry.h",
+      "termcap.h",
+      "tic.h",
+      "unctrl.h"
+    ],
+    "libraries": [
+      "libcurses.*",
+      "libform.*",
+      "libformw.*",
+      "libmenu.*",
+      "libmenuw.*",
+      "libncurses.*",
+      "libncursesw.*",
+      "libpanel.*",
+      "libpanelw.*",
+      "libtinfo.*"
+    ]
+  },
+  {
+    "package": "net-snmp",
+    "headers": [
+      "net-snmp"
+    ],
+    "libraries": [
+      "libnetsnmp*"
+    ]
+  },
+  {
+    "package": "nghttp",
+    "libraries": [
+      "lib*nghttp2.*"
+    ]
+  },
+  {
+    "package": "openblas",
+    "headers": [
+      "cblas.h",
+      "f77blas.h",
+      "lapack.h",
+      "lapacke.h",
+      "lapacke_config.h",
+      "lapacke_mangling.h",
+      "lapacke_utils.h",
+      "openblas_config.h"
+    ],
+    "libraries": [
+      "libblas.*",
+      "libcblas.*",
+      "libclapack.*",
+      "libf77lapack.*",
+      "liblapack.*",
+      "liblapacke.*",
+      "libopenblas.*",
+      "libopenblas.*",
+      "libopenblasp*"
+    ]
+  },
+  {
+    "package": "openldap",
+    "headers": [
+      "lber.h",
+      "lber_types.h",
+      "ldap.h",
+      "ldap_cdefs.h",
+      "ldap_features.h",
+      "ldap_schema.h",
+      "ldap_utf8.h",
+      "ldif.h",
+      "openldap.h",
+      "slapi-plugin.h"
+    ],
+    "libraries": [
+      "liblber.*",
+      "liblber_r.*",
+      "libldap.*",
+      "libldap_r.*"
+    ]
+  },
+  {
+    "package": "openpam",
+    "headers": [
+      "security"
+    ],
+    "libraries": [
+      "libpam.*",
+      "pam_*"
+    ]
+  },
+  {
+    "package": "pcre",
+    "headers": [
+      "pcre.h",
+      "pcreposix.h"
+    ],
+    "libraries": [
+      "libpcre.*",
+      "libpcre2*",
+      "libpcreposix.*"
+    ]
+  },
+  {
+    "package": "php",
+    "headers": [
+      "php"
+    ],
+    "libraries": [
+      "php"
+    ]
+  },
+  {
+    "package": "postgresql",
+    "libraries": [
+      "libecpg*",
+      "libpg*",
+      "libpq*"
+    ]
+  },
+  {
+    "package": "python",
+    "headers": [
+      "python*"
+    ],
+    "frameworks": [
+      "Python.framework"
+    ],
+    "libraries": [
+      "libpython*",
+      "python*"
+    ]
+  },
+  {
+    "package": "readline",
+    "headers": [
+      "readline"
+    ],
+    "libraries": [
+      "libhistory.*",
+      "libreadline.*"
+    ]
+  },
+  {
+    "package": "ruby",
+    "frameworks": [
+      "Ruby.framework"
+    ],
+    "libraries": [
+      "libruby.*",
+      "ruby"
+    ]
+  },
+  {
+    "package": "sqlite3",
+    "headers": [
+      "sqlite3.h",
+      "sqlite3ext.h"
+    ],
+    "libraries": [
+      "libsqlite3.*"
+    ]
+  },
+  {
+    "package": "swift",
+    "libraries": [
+      "swift/shims"
+    ]
+  },
+  {
+    "package": "tcl",
+    "headers": [
+      "tcl*",
+      "tk*"
+    ],
+    "frameworks": [
+      "Tcl.framework",
+      "Tk.framework"
+    ],
+    "libraries": [
+      "libtcl*",
+      "libtk*",
+      "tclConfig.sh",
+      "tkConfig.sh"
+    ]
+  },
+  {
+    "package": "xar",
+    "headers": [
+      "xar"
+    ],
+    "libraries": [
+      "libxar.*"
+    ]
+  },
+  {
+    "package": "xz",
+    "headers": [
+      "lzma*"
+    ],
+    "libraries": [
+      "liblzma.*"
+    ]
+  },
+  {
+    "package": "zlib",
+    "headers": [
+      "zconf.h",
+      "zlib.h"
+    ],
+    "libraries": [
+      "libz.*"
+    ]
+  }
+]

pkgs/by-name/ap/apple-sdk/metadata/versions.json

···
+{
+  "10.12": {
+    "url": "http://swcdn.apple.com/content/downloads/22/62/041-88607/wg8avdk0jo75k9a13gentz9stwqgrqmcv6/CLTools_SDK_OSX1012.pkg",
+    "version": "10.12.2",
+    "hash": "sha256-Jf2WIB9bY/rPwe0AOW3YWJY/6EqVe41yhezdTGOO3M8="
+  },
+  "11": {
+    "url": "https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg",
+    "version": "11.3",
+    "hash": "sha256-/go8utcx3jprf6c8V/DUbXwsmNYSFchOAai1OaJs3Bg="
+  }
+}

pkgs/by-name/ap/apple-sdk/package.nix

···
+let
+  sdkVersions = builtins.fromJSON (builtins.readFile ./metadata/versions.json);
+in
+
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  substitute,
+
+  # Specifies the major version used for the SDK. Uses `hostPlatform.darwinSdkVersion` by default.
+  darwinSdkMajorVersion ? (
+    if lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11" then
+      lib.versions.majorMinor stdenv.hostPlatform.darwinSdkVersion
+    else
+      lib.versions.major stdenv.hostPlatform.darwinSdkVersion
+  ),
+  # Enabling bootstrap disables propagation. Defaults to `false` (meaning to propagate certain packages and `xcrun`)
+  # except in stage0 of the Darwin stdenv bootstrap.
+  enableBootstrap ? stdenv.name == "bootstrap-stage0-stdenv-darwin",
+
+  # Required by various phases
+  callPackage,
+  jq,
+}:
+
+let
+  sdkInfo =
+    sdkVersions.${darwinSdkMajorVersion}
+      or (lib.throw "Unsupported SDK major version: ${darwinSdkMajorVersion}");
+  sdkVersion = sdkInfo.version;
+
+  fetchSDK = callPackage ./common/fetch-sdk.nix { };
+
+  phases = lib.composeManyExtensions (
+    [
+      (callPackage ./common/add-core-symbolication.nix { })
+      (callPackage ./common/derivation-options.nix { })
+      (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
+      (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
+      (callPackage ./common/remove-disallowed-packages.nix { })
+    ]
+    # Only process stubs and convert them to tbd-v4 if jq is available. This can be made unconditional once
+    # the bootstrap tools have jq and libtapi.
+    ++ lib.optional (jq != null) (callPackage ./common/process-stubs.nix { })
+    # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
+    ++ lib.optionals (!enableBootstrap) [
+      (callPackage ./common/propagate-inputs.nix { })
+      (callPackage ./common/propagate-xcrun.nix { })
+    ]
+    ++ [
+      # These have to happen last.
+      (callPackage ./common/rewrite-sdk-paths.nix { inherit sdkVersion; })
+      (callPackage ./common/run-build-phase-hooks.nix { })
+    ]
+  );
+in
+stdenvNoCC.mkDerivation (
+  lib.extends phases (finalAttrs: {
+    pname = "apple-sdk";
+    inherit (sdkInfo) version;
+
+    src = fetchSDK sdkInfo;
+
+    dontConfigure = true;
+
+    strictDeps = true;
+
+    setupHooks = [
+      # `role.bash` is copied from `../build-support/setup-hooks/role.bash` due to the requirements not to reference
+      # paths outside the package when it is in `by-name`.  It needs to be kept in sync, but it fortunately does not
+      # change often. Once `build-support` is available as a package (or some other mechanism), it should be changed
+      # to whatever that replacement is.
+      ./setup-hooks/role.bash
+      (substitute {
+        src = ./setup-hooks/sdk-hook.sh;
+        substitutions = [
+          "--subst-var-by"
+          "sdkVersion"
+          (lib.escapeShellArgs (lib.splitVersion sdkVersion))
+        ];
+      })
+    ];
+
+    installPhase =
+      let
+        sdkName = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+        sdkMajor = lib.versions.major sdkVersion;
+      in
+      ''
+        runHook preInstall
+
+        mkdir -p "$sdkpath"
+
+        cp -rd . "$sdkpath/${sdkName}"
+        ${lib.optionalString (lib.versionAtLeast finalAttrs.version "11.0") ''
+          ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
+        ''}
+        ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
+
+        runHook postInstall
+      '';
+
+    passthru = {
+      sdkroot = finalAttrs.finalPackage + "/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
+    };
+
+    __structuredAttrs = true;
+
+    meta = {
+      description = "Frameworks and libraries required for building packages on Darwin";
+      homepage = "https://developer.apple.com";
+      maintainers = lib.teams.darwin.members;
+      platforms = lib.platforms.darwin;
+      badPlatforms =
+        lib.optionals (lib.versionAtLeast sdkVersion "10.15") [ lib.systems.inspect.patterns.is32bit ]
+        ++ lib.optionals (lib.versionOlder sdkVersion "11.0") [ lib.systems.inspect.patterns.isAarch ];
+    };
+  })
+)

pkgs/by-name/ap/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch

···
+From 6531da946949a94643e6d8424236174ae64fe0ca Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <[e-mail]>
+Date: Sat, 30 Sep 2023 18:02:39 -0400
+Subject: [PATCH 1/2] Add function definitions needed to build zlog in
+ system_cmds
+
+---
+ CoreSymbolication.h | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index a413860..f3cf63f 100644
+--- a/CoreSymbolication.h
++++ b/CoreSymbolication.h
+@@ -324,7 +324,9 @@ CSSymbolOwnerEditRelocations
+ CSSymbolOwnerForeachRegion
+ CSSymbolOwnerForeachRegionWithName
+ CSSymbolOwnerForeachSection
+-CSSymbolOwnerForeachSegment
++*/
++void CSSymbolOwnerForeachSegment(CSSymbolOwnerRef owner, void (^block)(CSSegmentRef));
++/*
+ CSSymbolOwnerForeachSourceInfo
+ CSSymbolOwnerForeachSymbol
+  */
+@@ -333,7 +335,9 @@ void CSSymbolOwnerForeachSymbolWithName(CSSymbolOwnerRef owner,  const char *sna
+ /*
+ CSSymbolOwnerGetArchitecture
+ CSSymbolOwnerGetBaseAddress
+-CSSymbolOwnerGetCFUUIDBytes
++*/
++const CFUUIDBytes* CSSymbolOwnerGetCFUUIDBytes(CSSymbolOwnerRef owner);
++/*
+ CSSymbolOwnerGetCompatibilityVersion
+ CSSymbolOwnerGetCurrentVersion
+ CSSymbolOwnerGetDataFlags
+@@ -390,7 +394,7 @@ CSSymbolOwnerSetLoadTimestamp
+ CSSymbolOwnerSetPath
+ CSSymbolOwnerSetRelocationCount
+  */
+-CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
++void CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
+  /*
+ CSSymbolOwnerSetUnloadTimestamp
+ */
+-- 
+2.44.1
+

pkgs/by-name/ap/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch

···
+From ae7ac6a7043dbae8e63d6ce5e63dfaf02b5977fe Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <[e-mail]>
+Date: Sat, 30 Sep 2023 18:37:18 -0400
+Subject: [PATCH 2/2] Add CF_EXPORT To const symbols
+
+---
+ CoreSymbolication.h | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index f3cf63f..4124a54 100644
+--- a/CoreSymbolication.h
++++ b/CoreSymbolication.h
+@@ -49,6 +49,7 @@
+ 
+ 
+ #include <CoreFoundation/CoreFoundation.h>
++#include <CoreFoundation/CFBase.h>
+ #include <mach/mach.h>
+ 
+ 
+@@ -139,13 +140,13 @@ typedef void (^CSSegmentIterator)(CSSegmentRef segment);
+  * External symbols
+  */
+ 
+-const char* kCSRegionMachHeaderName;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
+-const CSSetCallBacks kCSTypeSetCallBacks;
+-const CSSetCallBacks kCSTypeSetWeakCallBacks;
++CF_EXPORT const char* kCSRegionMachHeaderName;
++CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
++CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
++CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
++CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
++CF_EXPORT const CSSetCallBacks kCSTypeSetCallBacks;
++CF_EXPORT const CSSetCallBacks kCSTypeSetWeakCallBacks;
+ 
+ 
+ /*
+-- 
+2.44.1
+

pkgs/by-name/ap/apple-sdk/scripts/get-sdks-from-catalog.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl file gzip jq xcbuild yq
+
+set -eu -o pipefail
+
+catalog=${1-}
+
+if [ -z "$catalog" ]; then
+    echo "usage: get-sdks-from-catalog.sh <catalog>"
+    echo " <catalog>   Apple software update catalog (may be gzipped)" >&2
+    exit 1
+fi
+
+scratch=$(mktemp)
+trap 'rm -f -- "$scratch"' EXIT
+
+if [[ "$(file "$catalog")" =~ gzip ]]; then
+    gzcat "$catalog" > "$scratch"
+else
+    cp --reflink=auto "$catalog" "$scratch"
+fi
+
+# Grab all SDK packages from the catalog
+filter='.Products[].Packages[] | select(.URL | test(".*CLTools_macOSNMOS_SDK.pkg")) | "\(.URL)|\(.MetadataURL)"'
+
+declare -A package_list
+for package in $(plutil -convert json -o - "$scratch" | jq -r "$filter"); do
+    package_list[${package%%|*}]=${package#*|}
+done
+
+truncate --size 0 "$scratch"
+for pkg in "${!package_list[@]}"; do
+    ver=$(curl --silent "${package_list[$pkg]}" | xq -r '."pkg-info"."@version"')
+    echo "{\"url\": \"$pkg\", \"version\": \"$(cut -d. -f1-3 <<< "$ver")\", \"long_version\": \"$ver\"}" >> "$scratch"
+done
+
+jq -r --slurp '
+    group_by(.version | split(".")[0])
+    | map(max_by(.version))
+    | sort_by(.version)[]
+    | "Package URL: \(.url)\n  Xcode Ver: \(.version) (\(.long_version))\n"' "$scratch"

pkgs/by-name/ap/apple-sdk/scripts/lock-sdk-deps.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl git gnutar jq moreutils nix
+
+set -eu -o pipefail
+
+if [ ! -v 2 ]; then
+    echo "usage: lock-sdk-deps.sh <SDK version> <Packages>" >&2
+    echo " <SDK version>   Decimal-separated version number." >&2
+    echo "                 Must correspond to a tag in https://github.com/apple-oss-distributions/distribution-macOS" >&2
+    echo " <Packages>      List of packages from the distributions-macOS repository." >&2
+    echo "                 Packages not in the repository at the tag for <SDK version> will be ignored."
+    exit 1
+fi
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+lockfile=$pkgdir/metadata/apple-oss-lockfile.json
+if [ ! -e "$lockfile" ]; then
+    touch "$lockfile"
+fi
+
+workdir=$(mktemp -d)
+trap 'rm -rf -- "$workdir"' EXIT
+
+sdkVersion=$1; shift
+tag="macos-${sdkVersion//.}"
+
+declare -a packages=("$@")
+
+echo "Locking versions for macOS $sdkVersion using tag '$tag'..."
+
+pushd "$workdir" > /dev/null
+
+git clone --branch "$tag" https://github.com/apple-oss-distributions/distribution-macOS.git &> /dev/null
+cd distribution-macOS
+
+for package in "${packages[@]}"; do
+    # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from Github.
+    packageTag=$(jq -r --arg package "$package" '.projects[] | select(.project == $package) | .tag' release.json)
+    packageCommit=$(git ls-tree -d HEAD "$package" | awk '{print $3}')
+
+    if [ ! -d "$package" ]; then
+        packageCommit=HEAD
+    fi
+
+    # However, sometimes it doesn’t exist. In that case, fall back to cloning the repo and check manually
+    # which tag corresponds to the commit from the submodule.
+    if [ -z "$packageTag" ]; then
+        git clone --no-checkout "https://github.com/apple-oss-distributions/$package.git" ../source &> /dev/null
+        pushd ../source > /dev/null
+        packageTag=$(git tag --points-at "$packageCommit")
+        popd > /dev/null
+        rm -rf ../source
+    fi
+
+    packageVersion=${packageTag##"$package"-}
+
+    curl -OL "https://github.com/apple-oss-distributions/$package/archive/$packageTag.tar.gz" &> /dev/null
+    tar axf "$packageTag.tar.gz"
+
+    packageHash=$(nix --extra-experimental-features nix-command hash path "$package-$packageTag")
+
+    pkgsjson="{\"$package\": {\"version\": \"$packageVersion\", \"hash\": \"$packageHash\"}}"
+
+    echo "   - Locking $package to version $packageVersion with hash '$packageHash'"
+    jq --argjson pkg "$pkgsjson" -S '. * $pkg' "$lockfile" | sponge "$lockfile"
+done
+
+popd > /dev/null

pkgs/by-name/ap/apple-sdk/scripts/regenerate-lockfile.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils jq
+
+set -eu -o pipefail
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+echo '{}' > "$pkgdir/metadata/apple-oss-lockfile.json"
+
+declare -a versions
+readarray -t versions < <(jq -r '.[].version' "$pkgdir/metadata/versions.json")
+
+declare -a packages=(
+    CarbonHeaders
+    CommonCrypto
+    IOAudioFamily
+    IOFireWireFamily
+    IOFWDVComponents
+    IOFireWireAVC
+    IOFireWireSBP2
+    IOFireWireSerialBusProtocolTransport
+    IOGraphics
+    IOHIDFamily
+    IONetworkingFamily
+    IOSerialFamily
+    IOStorageFamily
+    IOBDStorageFamily
+    IOCDStorageFamily
+    IODVDStorageFamily
+    IOUSBFamily
+    IOKitUser
+    Libc
+    Libinfo
+    Libm
+    Libnotify
+    Librpcsvc
+    Libsystem
+    OpenDirectory
+    Security
+    architecture
+    configd
+    copyfile
+    dtrace
+    dyld
+    eap8021x
+    hfs
+    launchd
+    libclosure
+    libdispatch
+    libmalloc
+    libplatform
+    libpthread
+    mDNSResponder
+    objc4
+    ppp
+    removefile
+    xnu
+)
+
+for version in "${versions[@]}"; do
+    "$pkgdir/scripts/lock-sdk-deps.sh" "$version" "${packages[@]}"
+done

pkgs/by-name/ap/apple-sdk/setup-hooks/add-private-frameworks.sh

···
+function enablePrivateFrameworks() {
+    export NIX_CFLAGS_COMPILE+=" -iframework $DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+    export NIX_LDFLAGS+=" -F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+}
+
+preConfigureHooks+=(enablePrivateFrameworks)

pkgs/by-name/ap/apple-sdk/setup-hooks/role.bash

···
+# Since the same derivation can be depended on in multiple ways, we need to
+# accumulate *each* role (i.e. host and target platforms relative the depending
+# derivation) in which the derivation is used.
+#
+# The role is intended to be used as part of other variables names like
+#  - $NIX_SOMETHING${role_post}
+
+function getRole() {
+    case $1 in
+        -1)
+            role_post='_FOR_BUILD'
+            ;;
+        0)
+            role_post=''
+            ;;
+        1)
+            role_post='_FOR_TARGET'
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}
+
+# `hostOffset` describes how the host platform of the package is slid relative
+# to the depending package. `targetOffset` likewise describes the target
+# platform of the package. Both are brought into scope of the setup hook defined
+# for dependency whose setup hook is being processed relative to the package
+# being built.
+
+function getHostRole()   {
+    getRole "$hostOffset"
+}
+function getTargetRole() {
+    getRole "$targetOffset"
+}
+
+# `depHostOffset` describes how the host platform of the dependencies are slid
+# relative to the depending package. `depTargetOffset` likewise describes the
+# target platform of dependenices. Both are brought into scope of the
+# environment hook defined for the dependency being applied relative to the
+# package being built.
+
+function getHostRoleEnvHook()   {
+    getRole "$depHostOffset"
+}
+function getTargetRoleEnvHook() {
+    getRole "$depTargetOffset"
+}
+
+# This variant is intended specifically for code-producing tool wrapper scripts
+# `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
+# env var so can't use fancier data structures).
+function getTargetRoleWrapper() {
+    case $targetOffset in
+        -1)
+            export NIX_@wrapperName@_TARGET_BUILD_@suffixSalt@=1
+            ;;
+        0)
+            export NIX_@wrapperName@_TARGET_HOST_@suffixSalt@=1
+            ;;
+        1)
+            export NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@=1
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}

pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh

···
+local role_post
+getHostRole
+
+local sdkVersionVar=NIX_APPLE_SDK_VERSION${role_post}
+local developerDirVar=DEVELOPER_DIR${role_post}
+
+local sdkVersionArr=(@sdkVersion@)
+local sdkVersion
+sdkVersion=$(printf "%02d%02d%02d" "${sdkVersionArr[0]-0}" "${sdkVersionArr[1]-0}" "${sdkVersionArr[2]-0}")
+
+if [ "$sdkVersion" -gt "${!sdkVersionVar-000000}" ]; then
+    export "$developerDirVar"='@out@'
+    export "$sdkVersionVar"="$sdkVersion"
+    export "SDKROOT${role_post}"="${!developerDirVar}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+fi
+
+unset -v role_post developerDirVar sdkVersion sdkVersionArr sdkVersionVar

pkgs/top-level/all-packages.nix

···
 
   ### DEVELOPMENT / LIBRARIES / DARWIN SDKS
 
+  apple-sdk_10_12 = callPackage ../by-name/ap/apple-sdk/package.nix { darwinSdkMajorVersion = "10.12"; };
+  apple-sdk_11 = callPackage ../by-name/ap/apple-sdk/package.nix { darwinSdkMajorVersion = "11"; };
+
   darwinMinVersionHook =
     deploymentTarget:
     makeSetupHook {