pkgs/stdenv/darwin: bootstrap Darwin using update tools (#384254)

pkgs/by-name/ap/apple-sdk/common/remove-disallowed-packages.nix

···
 let
-  # This can be made unconditional once jq is available in the bootstrap tools. If corecrypto is  not removed from
-  # the umbrella framework, linking will fail in stage 1 because it can’t find the tbd.
-  disallowedPackages' = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+  disallowedPackages = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
 in
 
 {
···
   stdenv,
 }:
 
-let
-  disallowedPackages =
-    if jq == null then
-      lib.filter (p: p.package != "corecrypto") disallowedPackages'
-    else
-      disallowedPackages';
-in
 self: super: {
   # Remove headers and stubs for packages that are available in nixpkgs.
   buildPhase =

pkgs/by-name/ap/apple-sdk/package.nix

···
       (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
       (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
       (callPackage ./common/remove-disallowed-packages.nix { })
+      (callPackage ./common/process-stubs.nix { })
     ]
-    # Only process stubs and convert them to tbd-v4 if jq is available. This can be made unconditional once
-    # the bootstrap tools have jq and llvm-readtapi.
-    ++ lib.optional (jq != null && lib.getName llvm != "bootstrap-stage0-llvm") (
-      callPackage ./common/process-stubs.nix { }
-    )
     # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
     ++ lib.optionals (!enableBootstrap) [
       (callPackage ./common/propagate-inputs.nix { })

pkgs/by-name/ld/ld64/package.nix

···
 }:
 
 let
-  # ld64 uses `#embed` to embed `compile_stubs`, which is only implemented in Clang 19.
-  # This can be done unconditionally once the bootstrap tools have been updated.
-  hasEmbed = lib.versionAtLeast (lib.getVersion stdenv.cc) "19";
-
   # Copy the files from their original sources instead of using patches to reduce the size of the patch set in nixpkgs.
   otherSrcs = {
     # The last version of ld64 to have dyldinfo
···
     hash = "sha256-CVIyL2J9ISZnI4+r+wp4QtOb3+3Tmz2z2Z7/qeRqHS0=";
   };
 
-  patches =
-    [
-      # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
-      # See their comments for more on what they do.
-      ./patches/0001-Always-use-write-instead-of-mmap.patch
-      ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
-      ./patches/0004-Removed-unused-Blob-clone-method.patch
-      ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
-      ./patches/0006-Add-Meson-build-system.patch
-      ./patches/0007-Add-CrashReporterClient-header.patch
-      ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
-      ./patches/0009-Support-LTO-in-nixpkgs.patch
-      ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
-      ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
-      ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
-      ./patches/0013-Set-the-version-string-in-the-build.patch
-      ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
-      ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
-      ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
-      ./patches/0017-Fix-dyldinfo-build.patch
-      ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
-    ]
-    ++ lib.optionals (hasEmbed) [
-      ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
-    ];
+  patches = [
+    # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
+    # See their comments for more on what they do.
+    ./patches/0001-Always-use-write-instead-of-mmap.patch
+    ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
+    ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
+    ./patches/0004-Removed-unused-Blob-clone-method.patch
+    ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
+    ./patches/0006-Add-Meson-build-system.patch
+    ./patches/0007-Add-CrashReporterClient-header.patch
+    ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
+    ./patches/0009-Support-LTO-in-nixpkgs.patch
+    ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
+    ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
+    ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
+    ./patches/0013-Set-the-version-string-in-the-build.patch
+    ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
+    ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
+    ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
+    ./patches/0017-Fix-dyldinfo-build.patch
+    ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
+  ];
 
   prePatch = ''
     # Copy dyldinfo source files
···
     for header in "''${tapiHeaders[@]}"; do
       cp ${libtapisrc}/include/tapi/$header subprojects/libtapi/tapi/$header
     done
-  '';
-
-  # Clang 16 doesn’t support C23, but the patchset expects a compiler that supports it. Only `#embed` is used, so stub
-  # out its usage and request an older C standard version. This can be dropped once the bootstrap tools are updated.
-  postPatch = lib.optionalString (!hasEmbed) ''
-    for meson_build in meson.build subprojects/libcodedirectory/meson.build subprojects/libtapi/meson.build; do
-      substituteInPlace $meson_build --replace-fail c23 c2x
-    done
-    echo '#pragma once' > src/ld/compile_stubs.h
-    echo 'static const char compile_stubs[] = "";' >> src/ld/compile_stubs.h
   '';
 
   xcodeHash = "sha256-qip/1eiGn8PdLThonhPq3oq2veN4E1zOiamDPBfTeNE=";

pkgs/os-specific/darwin/apple-source-releases/copyfile/package.nix

···
         --replace-fail '__ptrcheck_abi_assume_single()' "" \
         --replace-fail '__unsafe_indexable' ""
     done
-
-    # clang 16 does not support C23 empty initializers. This can be removed once the bootstrap tools are updated.
-    substituteInPlace copyfile.c \
-      --replace-fail 'filesec_t fsec_tmp = {};' 'filesec_t fsec_tmp = {0};'
   '';
 
   env.NIX_CFLAGS_COMPILE = "-I${privateHeaders}/include";

pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix

···
-{
-  writeTextFile,
-  cctools,
-  sigtool,
-}:
-
-writeTextFile {
-  name = "post-link-sign-hook";
-  executable = true;
-
-  text = ''
-    if [ "$linkerOutput" != "/dev/null" ]; then
-      CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate \
-        ${sigtool}/bin/codesign -f -s - "$linkerOutput"
-    fi
-  '';
-}

pkgs/stdenv/darwin/bootstrap-files/aarch64-apple-darwin.nix

···
 # $ ./refresh-tarballs.bash --targets=aarch64-apple-darwin
 #
 # Metadata:
-# - nixpkgs revision: d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f
+# - nixpkgs revision: d8657587c0c1ce2191b4b489299c386b5b7148c6
 # - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.aarch64-apple-darwin.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/255282138
-# - instantiated derivation: /nix/store/cahnprnkg9z2aij3hj4rkbkc4l8190mf-stdenv-bootstrap-tools.drv
-# - output directory: /nix/store/zxxcz7sza5ypy061rsg7cmr7h0a96hbb-stdenv-bootstrap-tools
-# - build time: Wed, 03 Apr 2024 07:59:44 +0000
+# - resolved hydra build: https://hydra.nixos.org/build/290554342
+# - instantiated derivation: /nix/store/g4x0vd6rfvr124sbxqfphkf8l06sy4pc-stdenv-bootstrap-tools.drv
+# - output directory: /nix/store/8wbnh6accpx3fcf20jvbnapcalvm1cmd-stdenv-bootstrap-tools
+# - build time: Thu, 20 Feb 2025 12:38:34 +0000
 {
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/bootstrap-tools.tar.xz";
-    hash = "sha256-a37OgMdTHjFyKs4UTxoD7zx6Te3A7zsSjhbFHzbNxQ8=";
+    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/bootstrap-tools.tar.xz";
+    hash = "sha256-i+KwTIY6P3dKfNmE42BWC9+qUomoDxazO50uvrzNlpE=";
   };
   unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/unpack.nar.xz";
-    hash = "sha256-XCVy6TMDJ1DKFnhIT1NHzdQUjY/TPKLV67Zi/ANIpms=";
+    url = "http://tarballs.nixos.org/stdenv/aarch64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/unpack.nar.xz";
+    hash = "sha256-mzql+dmvqtn663HvzWZORA8f9d9RPShwPJNIk9VGEvU=";
     name = "unpack";
     unpack = true;
   };

pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix

···
 # $ ./refresh-tarballs.bash --targets=x86_64-apple-darwin
 #
 # Metadata:
-# - nixpkgs revision: d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f
+# - nixpkgs revision: d8657587c0c1ce2191b4b489299c386b5b7148c6
 # - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.x86_64-apple-darwin.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/255281731
-# - instantiated derivation: /nix/store/44wnr0ikrbcxkakfqhhm2cz6gsh6wjni-stdenv-bootstrap-tools.drv
-# - output directory: /nix/store/lsl9rl3zj9nr318w471vvmlvxzj21b2k-stdenv-bootstrap-tools
-# - build time: Wed, 03 Apr 2024 07:56:15 +0000
+# - resolved hydra build: https://hydra.nixos.org/build/290554343
+# - instantiated derivation: /nix/store/38sk9c8s4zyhjrifcr9cd3a8d9hyi4zj-stdenv-bootstrap-tools.drv
+# - output directory: /nix/store/y617yisg19x2pj34hzxg9zcm3wlsfj29-stdenv-bootstrap-tools
+# - build time: Thu, 20 Feb 2025 12:38:34 +0000
 {
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/bootstrap-tools.tar.xz";
-    hash = "sha256-3OBigzlbu/Z6g8r7hsOWg95HTv7IJw9Nvbamwvw+88w=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/bootstrap-tools.tar.xz";
+    hash = "sha256-gtkeaUaV8ZXY8JxEkyd7ZeB75MESpsBPjaux0B2c0lE=";
   };
   unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d03a4482228d4d6dbd2d4b425b6dfcd49ebe765f/unpack.nar.xz";
-    hash = "sha256-93GK8LjjgUBknxsylfGVr0DG4AbWVIQEIWrwxhDW07k=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/unpack.nar.xz";
+    hash = "sha256-vgfZGKo6I565ORLZ/AGKh6SUpgLhgaanFuhYk897+zw=";
     name = "unpack";
     unpack = true;
   };

pkgs/stdenv/darwin/default.nix

···
                 ln -s "${compiler-rt.out}/lib"   "$rsrc/lib"
                 ln -s "${compiler-rt.out}/share" "$rsrc/share"
                 echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-              ''
-              + lib.optionalString (isFromBootstrapFiles prevStage.llvmPackages.clang-unwrapped) ''
-                # Work around the `-nostdlibinc` patch in the bootstrap tools.
-                # TODO: Remove after the bootstrap tools have been updated.
-                substituteAll ${builtins.toFile "add-flags-extra.sh" ''
-                  if [ "@darwinMinVersion@" ]; then
-                    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -idirafter $SDKROOT/usr/include"
-                    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -iframework $SDKROOT/System/Library/Frameworks"
-                  fi
-                ''} add-flags-extra.sh
-                cat add-flags-extra.sh >> $out/nix-support/add-flags.sh
               '';
 
             cc = prevStage.llvmPackages.clang-unwrapped;
···
       libxml2
       libxo
       ncurses
-      openbsm
       openpam
       xcbuild
       zlib
···
         gnugrep = bootstrapTools;
         pbzx = bootstrapTools;
 
-        jq = null;
+        jq = bootstrapTools;
 
         cctools = bootstrapTools // {
           libtool = bootstrapTools;
···
               runtimeShell = self.stdenvNoCC.shell;
 
               bintools = selfDarwin.binutils-unwrapped;
-
-              # Bootstrap tools cctools needs the hook and wrappers to make sure things are signed properly,
-              # and additional linker flags to work around a since‐removed patch.
-              # This can be dropped once the bootstrap tools cctools has been updated to 1010.6.
-              extraBuildCommands = ''
-                printf %s ${lib.escapeShellArg ''
-                  extraBefore+=("-F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks")
-                  extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib")
-                ''} >> $out/nix-support/add-local-ldflags-before.sh
-
-                echo 'source ${selfDarwin.postLinkSignHook}' >> $out/nix-support/post-link-hook
-
-                export signingUtils=${selfDarwin.signingUtils}
-
-                wrap \
-                  install_name_tool ${../../build-support/bintools-wrapper/darwin-install_name_tool-wrapper.sh} \
-                  "${selfDarwin.binutils-unwrapped}/bin/install_name_tool"
-
-                wrap \
-                  strip ${../../build-support/bintools-wrapper/darwin-strip-wrapper.sh} \
-                  "${selfDarwin.binutils-unwrapped}/bin/strip"
-              '';
             };
 
             binutils-unwrapped =
···
                         fi
                       done
                       ln -s ${bootstrapTools}/bin/dsymutil $out/bin/dsymutil
+                      ln -s ${bootstrapTools}/bin/llvm-readtapi $out/bin/llvm-readtapi
                       ln -s ${bootstrapTools}/lib/libLLVM* $out/lib
                     '';
                     passthru.isFromBootstrapFiles = true;
···
           selfDarwin: superDarwin: {
             signingUtils = prevStage.darwin.signingUtils.override { inherit (selfDarwin) sigtool; };
 
-            postLinkSignHook = prevStage.darwin.postLinkSignHook.override { inherit (selfDarwin) sigtool; };
-
             # Rewrap binutils with the real libSystem
             binutils = superDarwin.binutils.override {
               inherit (self) coreutils;
               bintools = selfDarwin.binutils-unwrapped;
               libc = selfDarwin.libSystem;
-
-              # Bootstrap tools cctools needs the hook and wrappers to make sure things are signed properly.
-              # This can be dropped once the bootstrap tools cctools has been updated to 1010.6.
-              extraBuildCommands = ''
-                printf %s ${lib.escapeShellArg ''
-                  extraBefore+=("-F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks")
-                  extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib")
-                ''} >> $out/nix-support/add-local-ldflags-before.sh
-
-                echo 'source ${selfDarwin.postLinkSignHook}' >> $out/nix-support/post-link-hook
-
-                export signingUtils=${selfDarwin.signingUtils}
-
-                wrap \
-                  install_name_tool ${../../build-support/bintools-wrapper/darwin-install_name_tool-wrapper.sh} \
-                  "${selfDarwin.binutils-unwrapped}/bin/install_name_tool"
-
-                wrap \
-                  strip ${../../build-support/bintools-wrapper/darwin-strip-wrapper.sh} \
-                  "${selfDarwin.binutils-unwrapped}/bin/strip"
-              '';
             };
 
             # Avoid building unnecessary Python dependencies due to building LLVM manpages.
···
               # Rebuild darwin.binutils with the new LLVM, so only inherit libSystem from the previous stage.
               // {
                 inherit (prevStage.darwin) libSystem;
+
+                # Disable building the documentation due to the dependency on llvm-manpages,
+                # which brings in a bunch of Python dependencies.
+                binutils-unwrapped = superDarwin.binutils-unwrapped.override {
+                  inherit (self) cctools ld64;
+                  enableManpages = false;
+                };
               }
             );
 
             llvmPackages =
               let
-                tools = super.llvmPackages.tools.extend (
-                  _: superTools: {
-                    # darwin.binutils-unwrapped needs to build the LLVM man pages, which requires a lot of Python stuff
-                    # that ultimately ends up depending on git. Fortunately, the git dependency is only for check
-                    # inputs. The following set of overrides allow the LLVM documentation to be built without
-                    # pulling curl (and other packages like ffmpeg) into the stdenv bootstrap.
-                    #
-                    # However, even without darwin.binutils-unwrapped, this has to be overridden in the LLVM package set
-                    # because otherwise llvmPackages.llvm-manpages on its own is broken.
-                    llvm-manpages = superTools.llvm-manpages.override {
-                      python3Packages = self.python3.pkgs.overrideScope (
-                        _: superPython: {
-                          hatch-vcs = superPython.hatch-vcs.overrideAttrs { doInstallCheck = false; };
-                          markdown-it-py = superPython.markdown-it-py.overrideAttrs { doInstallCheck = false; };
-                          mdit-py-plugins = superPython.mdit-py-plugins.overrideAttrs { doInstallCheck = false; };
-                          myst-parser = superPython.myst-parser.overrideAttrs { doInstallCheck = false; };
-                        }
-                      );
-                    };
-                  }
-                );
                 libraries = super.llvmPackages.libraries.extend (_: _: llvmLibrariesPackages prevStage);
               in
-              super.llvmPackages // { inherit tools libraries; } // tools // libraries;
+              super.llvmPackages // { inherit libraries; } // libraries;
           }
         ];
 
···
               ncurses.dev
               ncurses.man
               ncurses.out
-              openbsm
               openpam
               openssl.out
               patch
···
                 patch
                 ;
 
-              # TODO: Simplify when dropping support for macOS < 11.
-              "apple-sdk_${builtins.replaceStrings [ "." ] [ "_" ] sdkMajorVersion}" = self.apple-sdk;
+              "apple-sdk_${sdkMajorVersion}" = self.apple-sdk;
 
               darwin = super.darwin.overrideScope (
                 _: _:
···
                   libraries = super."llvmPackages_${llvmVersion}".libraries.extend (
                     _: _:
                     llvmLibrariesPackages prevStage
+                    # Avoid depending on llvm-manpages from the bootstrap, which brings a bunch of Python dependencies
+                    # into the bootstrap. This means that there are no man pages in darwin.binutils, but they are still
+                    # available from llvm-manpages, ld64, and cctools.
+                    // {
+                      inherit (super."llvmPackages_${llvmVersion}") llvm-manpages;
+                    }
                     // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
                       inherit (prevStage.llvmPackages) clang;
                     }

pkgs/top-level/darwin-aliases.nix

···
   ### O ###
 
   opencflite = pkgs.opencflite; # added 2024-05-02
+
+  ### P ###
+  postLinkSignHook = throw "'darwin.postLinkSignHook' has been removed because it is obsolete"; # added 2025-02-23
 })

pkgs/top-level/darwin-packages.nix

···
 
       signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
-      postLinkSignHook = callPackage ../os-specific/darwin/signing-utils/post-link-sign-hook.nix { };
-
       autoSignDarwinBinariesHook = pkgs.makeSetupHook {
         name = "auto-sign-darwin-binaries-hook";
         propagatedBuildInputs = [ self.signingUtils ];