ld64: disable hardening again (#536365)

pkgs/applications/editors/emacs/make-emacs.nix

@@ -116,8 +116,6 @@
 
   # test
   callPackage,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -254,11 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
 
   buildInputs = [
     gnutls
@@ -424,15 +418,10 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      # workaround for ld64 hardening issue
-      #
-      # TODO: Clean up on `staging`
-      NIX_CFLAGS_COMPILE =
-        "-fuse-ld=lld"
-        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-        # See https://github.com/NixOS/nixpkgs/issues/127902
-        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs (variant == "macport") {
+      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+      # See https://github.com/NixOS/nixpkgs/issues/127902
+      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/default.nix

@@ -14,8 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -39,10 +37,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -50,13 +44,6 @@ stdenv.mkDerivation {
     gawk
   ];
 
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
-  };
-
   strictDeps = true;
 
   configureFlags = [

pkgs/applications/editors/vim/full.nix

@@ -48,9 +48,6 @@
   darwinSupport ? config.vim.darwin or false, # Enable Darwin support
   ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
   sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
-
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -172,9 +169,7 @@ stdenv.mkDerivation {
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner
-  # TODO: Clean up on `staging`
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optional waylandSupport wayland-scanner;
 
   buildInputs = [
     ncurses
@@ -201,10 +196,7 @@ stdenv.mkDerivation {
   ++ lib.optional sodiumSupport libsodium;
 
   # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";
 
   preConfigure = lib.optionalString ftNixSupport ''
     cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim

pkgs/applications/editors/vim/macvim.nix

@@ -17,8 +17,6 @@
   # This can be set to one of the `darwin.xcode_*` packages as well.
   # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
   withXcodePath ? null,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 # Try to match MacVim's documented script interface compatibility
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
   buildInputs = [
     # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -192,8 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
   hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
 
   # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
   # it's not clear what system-level components it may require, so for now we'll just allow full

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -34,7 +34,6 @@
   libjxl,
   libicns,
   apple-sdk_15,
-  llvmPackages,
   nix-update-script,
 }:
 
@@ -68,11 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     # to build bundled libdispatch
     clang
     gobject-introspection
-  ]
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -108,12 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapQtApps = true;
 
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   cmakeFlags = [
     # We're allowed to used the API ID of the Snap package:
     (lib.cmakeFeature "TDESKTOP_API_ID" "611335")

pkgs/applications/science/math/R/default.nix

@@ -27,7 +27,6 @@
   pkg-config,
   bison,
   which,
-  llvmPackages,
   jdk,
   blas,
   lapack,
@@ -69,10 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     tzdata
     which
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
-
+  ];
   buildInputs = [
     bzip2
     gfortran
@@ -130,11 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontDisableStatic = static;
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   preConfigure = ''
     configureFlagsArray=(
       --disable-lto

pkgs/by-name/bl/blueutil/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  llvmPackages,
   testers,
   nix-update-script,
 }:
@@ -18,12 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Qw5c9dp7wpuOcQSLsg1pfJ+NbrEtme2o6nKD3Ba3A3M=";
   };
 
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  nativeBuildInputs = [ llvmPackages.lld ];
-
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  env.NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ca/caffeine/package.nix

@@ -5,7 +5,6 @@
   apple-sdk,
   darwin,
   xcbuildHook,
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,8 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     xcbuildHook
     darwin.autoSignDarwinBinariesHook
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -45,9 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-configuration Release"
   ];
 
-  # TODO: Remove once #536365 reaches this branch
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/da/darktable/package.nix

@@ -103,8 +103,7 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook3
     saxon # Use Saxon instead of libxslt to fix XSLT generate-id() consistency issues
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  ];
 
   buildInputs = [
     SDL2
@@ -185,12 +184,6 @@ stdenv.mkDerivation rec {
     "-DUSE_KWALLET=OFF"
   ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   # darktable changed its rpath handling in commit
   # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
   # binaries can't find libdarktable.so, so change LD_LIBRARY_PATH in

pkgs/by-name/fl/fltk_1_3/package.nix

@@ -35,8 +35,6 @@
   withShared ? true,
 
   nix-update-script,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -70,10 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs =
@@ -145,12 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
-  ]
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   preBuild = lib.optionalString (withCairo && withShared && stdenv.hostPlatform.isDarwin) ''

pkgs/by-name/fl/fltk_1_4/package.nix

@@ -46,8 +46,6 @@
   withExamples ? (stdenv.buildPlatform == stdenv.hostPlatform),
 
   nix-update-script,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 # pango support depends on Xft
@@ -86,10 +84,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs =
@@ -175,12 +169,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
-  ]
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   postBuild = lib.optionalString withDocs ''

pkgs/by-name/gf/gfxstream/package.nix

@@ -13,8 +13,6 @@
   vulkan-headers,
   vulkan-loader,
   libx11,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,10 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
   buildInputs = [
     aemu
@@ -66,8 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-framework QuartzCore"
       "-needed-lvulkan"
     ];
-    # TODO: Clean up on `staging`.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
   };
 
   # dlopens libvulkan.

pkgs/by-name/gl/glfw3/package.nix

@@ -20,9 +20,6 @@
   libxkbcommon,
   libdecor,
   withMinecraftPatch ? false,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 let
   version = "3.4";
@@ -61,11 +58,7 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    fixDarwinDylibNames
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
-  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -93,9 +86,6 @@ stdenv.mkDerivation {
   cmakeFlags = [
     # Static linking isn't supported
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {

pkgs/by-name/gl/glib/package.nix

@@ -24,8 +24,6 @@
   gi-docgen,
   # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
   util-linuxMinimal ? null,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
   buildPackages,
 
   # this is just for tests (not in the closure of any regular package)
@@ -209,10 +207,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals withDtrace [
     systemtap' # for dtrace
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   propagatedBuildInputs = [
@@ -256,13 +250,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-DG_DISABLE_CAST_CHECKS"
     ];
     DETERMINISTIC_BUILD = 1;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64 hardening issue.
-    #
-    # TODO: Clean up on `staging`.
-    CC_LD = "lld";
-    OBJC_LD = "lld";
   };
 
   postPatch = ''

pkgs/by-name/gt/gtk-mac-integration/package.nix

@@ -9,8 +9,6 @@
   gtk ? gtk3,
   gtk3,
   gobject-introspection,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,8 +28,6 @@ stdenv.mkDerivation rec {
     pkg-config
     gtk-doc
     gobject-introspection
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
   buildInputs = [ glib ];
   propagatedBuildInputs = [ gtk ];
@@ -40,13 +36,6 @@ stdenv.mkDerivation rec {
     gtkdocize
   '';
 
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   meta = {
     description = "Provides integration for GTK applications into the Mac desktop";
     license = lib.licenses.lgpl21;

pkgs/by-name/gt/gtk2/package.nix

@@ -27,8 +27,6 @@
   gdktarget ? if stdenv.hostPlatform.isDarwin then "quartz" else "x11",
   cupsSupport ? config.gtk2.cups or stdenv.hostPlatform.isLinux,
   xineramaSupport ? stdenv.hostPlatform.isLinux,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -58,19 +56,13 @@ stdenv.mkDerivation (finalAttrs: {
     gtkCleanImmodulesCache
   ];
 
-  nativeBuildInputs =
-    finalAttrs.setupHooks
-    ++ [
-      gdk-pixbuf
-      gettext
-      gobject-introspection
-      perl
-      pkg-config
-    ]
-    # TODO: Clean up on `staging`
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      llvmPackages.lld
-    ];
+  nativeBuildInputs = finalAttrs.setupHooks ++ [
+    gdk-pixbuf
+    gettext
+    gobject-introspection
+    perl
+    pkg-config
+  ];
 
   patches = [
     ./patches/2.0-immodules.cache.patch
@@ -128,19 +120,12 @@ stdenv.mkDerivation (finalAttrs: {
     "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
   ];
 
-  env =
-    lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = toString [
-        "-Wno-error=implicit-int"
-        "-Wno-error=incompatible-pointer-types"
-      ];
-    }
-    # Fix for ld64 hardening issue
-    #
-    # TODO: Clean up on `staging`
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_CFLAGS_LINK = "-fuse-ld=lld";
-    };
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-int"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
 
   enableParallelBuilding = true;
 

pkgs/by-name/gt/gtk3/package.nix

@@ -58,8 +58,6 @@
   broadwaySupport ? true,
   wayland-scanner,
   testers,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -144,10 +142,6 @@ stdenv.mkDerivation (finalAttrs: {
       ]
   ++ lib.optionals waylandSupport [
     wayland-scanner
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs =
@@ -219,17 +213,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  env = {
-    NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # workaround for ld64 hardening issue
-    #
-    # TODO: Clean up on `staging`
-
-    CC_LD = "lld";
-    OBJC_LD = "lld";
-  };
+  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     # See https://github.com/NixOS/nixpkgs/issues/132259

pkgs/by-name/gt/gtk4/package.nix

@@ -60,7 +60,6 @@
   compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages,
   cups,
   libexecinfo,
-  llvmPackages,
   broadwaySupport ? true,
   testers,
   darwinMinVersionHook,
@@ -131,10 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals vulkanSupport [
     shaderc # for glslc
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    llvmPackages.lld
-  ]
   ++ finalAttrs.setupHooks;
 
   buildInputs = [
@@ -226,10 +221,6 @@ stdenv.mkDerivation (finalAttrs: {
   }
   // lib.optionalAttrs stdenv.hostPlatform.isMusl {
     NIX_LDFLAGS = "-lexecinfo";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
   };
 
   postPatch = ''

pkgs/by-name/ia/iamb/package.nix

@@ -6,8 +6,6 @@
   writableTmpDirAsHomeHook,
   versionCheckHook,
   nix-update-script,
-  llvmPackages,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -29,17 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     installShellFiles
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
   ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   postInstall = ''
     installManPage $src/docs/iamb.{1,5}
     install -D $src/docs/iamb.svg -t $out/share/icons/hicolor/scalable/apps

pkgs/by-name/im/imhex/package.nix

@@ -23,7 +23,6 @@
   nix-update-script,
   autoPatchelfHook,
   makeWrapper,
-  llvmPackages,
 }:
 
 let
@@ -62,9 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     makeWrapper
   ]
-  ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   buildInputs = [
     capstone
@@ -106,13 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_INSTALL_NAME_DIR" "@executable_path/../Frameworks")
   ];
 
-  env = {
-    NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   # Comment out fixup_bundle in PostprocessBundle.cmake as we are not building a standalone application
   postPatch = ''

pkgs/by-name/ki/kitty/package.nix

@@ -45,8 +45,6 @@
   makeBinaryWrapper,
   darwin,
   cairo,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 with python3Packages;
@@ -119,8 +117,6 @@ buildPythonApplication rec {
     imagemagick
     libicns # For the png2icns tool.
     darwin.autoSignDarwinBinariesHook
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland-scanner
@@ -157,10 +153,6 @@ buildPythonApplication rec {
     CGO_ENABLED = 0;
     GOFLAGS = "-trimpath";
     GOTOOLCHAIN = "local";
-  }
-  # TODO: Clean up on `staging`.
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
   };
 
   configurePhase = ''

pkgs/by-name/ld/ld64/package.nix

@@ -138,6 +138,9 @@ stdenv.mkDerivation (finalAttrs: {
     xar
   ];
 
+  # ld built with this fails to link glib's gio
+  hardeningDisable = [ "libcxxhardeningfast" ];
+
   dontUseCmakeConfigure = true; # CMake is only needed because it’s used by Meson to find LLVM.
 
   # Note for overrides: ld64 cannot be built as a debug build because of UB in its iteration implementations,

pkgs/by-name/li/lima/package.nix

@@ -11,7 +11,6 @@
   apple-sdk_15,
   withAdditionalGuestAgents ? false,
   lima-additional-guestagents,
-  llvmPackages,
   writableTmpDirAsHomeHook,
   versionCheckHook,
   testers,
@@ -36,16 +35,7 @@ buildGoModule (finalAttrs: {
     # For checkPhase, and installPhase(required to build completion)
     writableTmpDirAsHomeHook
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.sigtool
-    # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-    llvmPackages.lld
-  ];
-
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' llvmPackages.lld "ld64.lld"}";
-  };
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];
 

pkgs/by-name/li/livekit-libwebrtc/package.nix

@@ -7,8 +7,6 @@
   fetchurl,
   fetchpatch,
   xcbuild,
-  lld,
-  llvm,
   python3,
   ninja,
   git,
@@ -184,13 +182,7 @@ stdenv.mkDerivation {
     ln -sf ${lib.getExe gn} buildtools/mac/gn
     chmod +x build/toolchain/apple/linker_driver.py
     patchShebangs build/toolchain/apple/linker_driver.py
-
-    # When 'use_lld=true' is set, llvm-ar is used instead of ar.
-    # The build config expects llvm-ar to be inside the provided clang base path,
-    # but this is not the case in nixpkgs.
-    substituteInPlace build/toolchain/apple/toolchain.gni \
-      --replace-fail "/bin/cp -Rc" "cp -a" \
-      --replace-fail '${"$"}{prefix}llvm-ar' '${lib.getExe' llvm "llvm-ar"}'
+    substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a"
 
     # nixpkgs calls the target "darwin" instead of "macos", and passing a different target
     # results in warnings by the nixpkgs compiler wrapper
@@ -218,10 +210,7 @@ stdenv.mkDerivation {
       cpio
       pkg-config
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xcbuild
-      lld
-    ];
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
 
   buildInputs = [
     nasm
@@ -290,8 +279,7 @@ stdenv.mkDerivation {
     "rtc_enable_objc_symbol_export=true"
     "rtc_include_dav1d_in_internal_decoder_factory=true"
     "clang_use_chrome_plugins=false"
-    # ld64 traps on linking because of C++ hardening
-    "use_lld=true"
+    "use_lld=false"
     ''clang_base_path="${clang}"''
   ]);
 
@@ -309,12 +297,6 @@ stdenv.mkDerivation {
     "desktop_capture_objc"
   ];
 
-  env = {
-    # ensure install_name_tool has enough space in binary headers
-    # to replace rpaths with very long nix store paths
-    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-headerpad_max_install_names";
-  };
-
   postBuild =
     lib.optionalString stdenv.hostPlatform.isLinux ''
       objcopy --redefine-syms="${boringSslSymbols}" "libwebrtc.so"

pkgs/by-name/ma/mactop/package.nix

@@ -2,7 +2,6 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  llvmPackages,
   versionCheckHook,
   nix-update-script,
 }:
@@ -22,14 +21,6 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  nativeBuildInputs = [ llvmPackages.lld ];
-
-  env = {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/mo/moltenvk/package.nix

@@ -17,8 +17,6 @@
   # but that’s not really a concern for nixpkgs, so use them by default.
   # See: https://github.com/KhronosGroup/MoltenVK/blob/main/README.md#metal_private_api
   enablePrivateAPIUsage ? true,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -37,11 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-headers
   ];
 
-  nativeBuildInputs = [
-    xcbuildHook
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  nativeBuildInputs = [ xcbuildHook ];
 
   outputs = [
     "out"
@@ -120,11 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional enablePrivateAPIUsage "-DMVK_USE_METAL_PRIVATE_API=1"
   );
 
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   env.NIX_LDFLAGS = toString [
     "-lglslang"
     "-lSPIRV"

pkgs/by-name/mp/mpv-unwrapped/package.nix

@@ -61,7 +61,6 @@
   wayland-protocols,
   wayland-scanner,
   zimg,
-  llvmPackages,
 
   # Boolean
   alsaSupport ? stdenv.hostPlatform.isLinux,
@@ -164,8 +163,6 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.darwin.sigtool
     swift
     makeBinaryWrapper
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
   ]
   ++ lib.optionals waylandSupport [ wayland-scanner ];
 
@@ -236,9 +233,6 @@ stdenv.mkDerivation (finalAttrs: {
   # ./osdep/mac/swift.h:270:9: fatal error: '.../app_bridge_objc-1.pch' file not found
   env = lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
     NIX_SWIFTFLAGS_COMPILE = "-disable-bridging-pch";
-
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
   };
 
   postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/by-name/no/noti/package.nix

@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromCodeberg,
-  llvmPackages,
   installShellFiles,
 }:
 
@@ -20,19 +18,10 @@ buildGoModule (finalAttrs: {
 
   vendorHash = null;
 
-  nativeBuildInputs = [
-    installShellFiles
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ installShellFiles ];
 
   subPackages = [ "cmd/noti" ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/pi/picocrypt-ng/package.nix

@@ -12,7 +12,6 @@
   pkg-config,
   wrapGAppsHook3,
   writableTmpDirAsHomeHook,
-  llvmPackages,
 }:
 
 buildGoModule (finalAttrs: {
@@ -50,9 +49,7 @@ buildGoModule (finalAttrs: {
     pkg-config
     wrapGAppsHook3
     writableTmpDirAsHomeHook
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ];
 
   # git ls-files doesn't work as source is not a git repo
   checkFlags =
@@ -64,13 +61,7 @@ buildGoModule (finalAttrs: {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
-  env = {
-    CGO_ENABLED = 1;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+  env.CGO_ENABLED = 1;
 
   postInstall = ''
     mv $out/bin/picocrypt $out/bin/picocrypt-ng-gui

pkgs/by-name/pi/picocrypt/package.nix

@@ -11,7 +11,6 @@
   gtk3,
   pkg-config,
   wrapGAppsHook3,
-  llvmPackages,
 }:
 
 buildGoModule (finalAttrs: {
@@ -47,17 +46,9 @@ buildGoModule (finalAttrs: {
     copyDesktopItems
     pkg-config
     wrapGAppsHook3
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ];
 
-  env = {
-    CGO_ENABLED = 1;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+  env.CGO_ENABLED = 1;
 
   postInstall = ''
     mv $out/bin/Picocrypt $out/bin/picocrypt-gui

pkgs/by-name/qb/qbittorrent/package.nix

@@ -17,7 +17,6 @@
   wrapGAppsHook3,
   zlib,
   nixosTests,
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -36,10 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     wrapGAppsHook3
     qt6.wrapQtAppsHook
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -65,11 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!webuiSupport) [ "-DWEBUI=OFF" ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   qtWrapperArgs = lib.optionals trackerSearch [ "--prefix PATH : ${lib.makeBinPath [ python3 ]}" ];
 
   dontWrapGApps = true;

pkgs/by-name/qe/qemu/package.nix

@@ -123,9 +123,6 @@
   minimal ? toolsOnly || userOnly,
   gitUpdater,
   qemu-utils, # for tests attribute
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -183,9 +180,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals hexagonSupport [ glib ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.sigtool
-
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
   ]
   ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -431,10 +425,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
     tests = lib.optionalAttrs (!toolsOnly) {

pkgs/by-name/re/rectangle/package.nix

@@ -5,8 +5,6 @@
   darwin,
   actool,
   ibtool,
-  # TODO: Clean up on `staging`
-  llvmPackages,
   makeWrapper,
   nix-update-script,
 }:
@@ -151,8 +149,6 @@ stdenv.mkDerivation (finalAttrs: {
     ibtool
     darwin.autoSignDarwinBinariesHook
     makeWrapper
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
 
   dontConfigure = true;
@@ -165,8 +161,6 @@ stdenv.mkDerivation (finalAttrs: {
     commonSwiftFlags=(
       -O -disable-bridging-pch
       -Xlinker -platform_version -Xlinker macos -Xlinker 14.0 -Xlinker 26.0
-      # TODO: Clean up on `staging`
-      -use-ld=lld
     )
 
     nixLog "building Sparkle stub framework"
@@ -199,12 +193,9 @@ stdenv.mkDerivation (finalAttrs: {
     ) masShortcutSources}
 
     nixLog "linking MASShortcut dylib"
-    # `-fuse-ld=lld`: fix for ld64 hardening issue
-    # TODO: Clean up on `staging`
     clang -dynamiclib "''${masObjFiles[@]}" \
       -framework AppKit -framework Carbon -framework Foundation \
       -install_name "@rpath/MASShortcut.framework/MASShortcut" \
-      -fuse-ld=lld \
       -o "$buildDir/libMASShortcut.dylib"
 
     rectSwiftFiles=()

pkgs/by-name/sd/sdl3/package.nix

@@ -61,9 +61,6 @@
   vulkanSupport ? true,
   waylandSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
   x11Support ? !stdenv.hostPlatform.isAndroid && !stdenv.hostPlatform.isWindows,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -130,8 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     validatePkgConfig
   ]
-  ++ lib.optional waylandSupport wayland-scanner
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optional waylandSupport wayland-scanner;
 
   buildInputs =
     lib.optionals libusbSupport [
@@ -211,10 +207,6 @@ stdenv.mkDerivation (finalAttrs: {
       && !(stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAndroid)
       && !(x11Support || waylandSupport)
     ))
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   doCheck = true;

pkgs/by-name/st/starship/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  llvmPackages,
   installShellFiles,
   writableTmpDirAsHomeHook,
   gitMinimal,
@@ -23,24 +22,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-pStNE8SMMVavL3ld6RO+5QQRJPXpqlU3asccS2tUoMQ=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     writableTmpDirAsHomeHook
   ];
 
-  env = {
-    TZDIR = "${tzdata}/share/zoneinfo";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    #
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+  env.TZDIR = "${tzdata}/share/zoneinfo";
 
   postInstall = ''
     presetdir=$out/share/starship/presets/

pkgs/by-name/st/stats/package.nix

@@ -3,8 +3,6 @@
   swiftPackages,
   fetchFromGitHub,
   leveldb,
-  # TODO: Clean up on `staging`.
-  llvmPackages,
   perl,
   actool,
   makeWrapper,
@@ -90,8 +88,6 @@ stdenv.mkDerivation (finalAttrs: {
     actool
     makeWrapper
     rcodesign
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
   ];
 
   buildInputs = [ leveldb ];
@@ -130,8 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
       # The Swift compiler in nixpkgs uses SDK 14 headers (which compile fine), but without
       # this flag the linker records SDK 14 and macOS withholds it (Liquid Glass)
       -Xlinker -platform_version -Xlinker macos -Xlinker 14.0 -Xlinker 26.0
-      # TODO: Clean up on `staging`
-      -use-ld=lld
     )
 
     buildFramework() {

pkgs/by-name/te/terminal-notifier/package.nix

@@ -3,7 +3,6 @@
   fetchFromGitHub,
   ibtool,
   lib,
-  llvmPackages,
   makeBinaryWrapper,
   stdenv,
   xcbuildHook,
@@ -24,8 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
     ibtool
     makeBinaryWrapper
     xcbuildHook
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -39,9 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     "Release"
   ];
 
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/to/topgrade/package.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   rustPlatform,
   installShellFiles,
-  llvmPackages,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -22,18 +21,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     installShellFiles
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.hostPlatform.isDarwin [
       "-framework"
       "AppKit"
-    ];
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
+    ]
+  );
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd topgrade \

pkgs/by-name/wx/wxwidgets_3_1/package.nix

@@ -23,9 +23,6 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_1,
   libpng,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -48,11 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0002-support-webkitgtk-41.patch
   ];
 
-  nativeBuildInputs = [
-    pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -96,17 +89,12 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env =
-    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-      SEARCH_LIB = toString [
-        "${libGLU.out}/lib"
-        "${libGL.out}/lib"
-      ];
-    }
-    # TODO: Clean up on `staging`.
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_CFLAGS_LINK = "-fuse-ld=lld";
-    };
+  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+    SEARCH_LIB = toString [
+      "${libGLU.out}/lib"
+      "${libGL.out}/lib"
+    ];
+  };
 
   preConfigure = ''
     substituteInPlace configure --replace \

pkgs/by-name/wx/wxwidgets_3_2/package.nix

@@ -29,9 +29,6 @@
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
   webkitgtk_4_1,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 let
   catch = fetchFromGitHub {
@@ -59,11 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-YaQrPJSlTpJKwjXLdRsGB04f7wKJCWfHjXWkB45qyEg=";
   };
 
-  nativeBuildInputs = [
-    pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -121,17 +114,12 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env =
-    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-      SEARCH_LIB = toString [
-        "${libGLU.out}/lib"
-        "${libGL.out}/lib"
-      ];
-    }
-    # TODO: Clean up on `staging`.
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_CFLAGS_LINK = "-fuse-ld=lld";
-    };
+  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+    SEARCH_LIB = toString [
+      "${libGLU.out}/lib"
+      "${libGL.out}/lib"
+    ];
+  };
 
   preConfigure = ''
     cp -r ${catch}/* 3rdparty/catch/

pkgs/by-name/wx/wxwidgets_3_3/package.nix

@@ -30,9 +30,6 @@
   withEGL ? true,
   withPrivateFonts ? false,
   webkitgtk_4_1,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -47,11 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-gB+mEk8rHpB4z1m8RWJSV+upKzLt7pZtlviS2g03EHY=";
   };
 
-  nativeBuildInputs = [
-    pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -110,17 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env =
-    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-      SEARCH_LIB = toString [
-        "${libGLU.out}/lib"
-        "${libGL.out}/lib"
-      ];
-    }
-    # TODO: Clean up on `staging`.
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_CFLAGS_LINK = "-fuse-ld=lld";
-    };
+  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+    SEARCH_LIB = toString [
+      "${libGLU.out}/lib"
+      "${libGL.out}/lib"
+    ];
+  };
 
   postInstall = "
     pushd $out/include

pkgs/by-name/ya/yabai/package.nix

@@ -28,17 +28,12 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     installShellFiles
     xxd
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
   ];
 
   buildInputs = [
     apple-sdk_15
   ];
 
-  # TODO: Clean up on `staging`.
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   # Upstream Makefile races clean-build against linking under parallel make.
   enableParallelBuilding = false;
 

pkgs/development/compilers/swift/compiler/default.nix

@@ -37,8 +37,6 @@
   DarwinTools,
   apple-sdk_14,
   darwinMinVersionHook,
-  # TODO: Clean up on `staging`
-  lld,
 }:
 
 let
@@ -254,8 +252,6 @@ stdenv.mkDerivation {
     DarwinTools # sw_vers
     fixDarwinDylibNames
     cctools.libtool
-    # TODO: Clean up on `staging`
-    lld
   ];
 
   buildInputs = [
@@ -566,12 +562,6 @@ stdenv.mkDerivation {
     #   Fixed in: https://github.com/apple/swift/commit/84083afef1de5931904d5c815d53856cdb3fb232
     cmakeFlags="
       -GNinja
-      ${
-        # Fix for ld64 hardening issue
-        #
-        # TODO: Clean up on staging
-        lib.optionalString stdenv.hostPlatform.isDarwin "-DCMAKE_LINKER_TYPE=LLD"
-      }
       -DBOOTSTRAPPING_MODE=BOOTSTRAPPING${lib.optionalString stdenv.hostPlatform.isDarwin "-WITH-HOSTLIBS"}
       -DSWIFT_ENABLE_EXPERIMENTAL_DIFFERENTIABLE_PROGRAMMING=ON
       -DSWIFT_ENABLE_EXPERIMENTAL_CONCURRENCY=ON

pkgs/development/compilers/swift/default.nix

@@ -15,8 +15,7 @@ let
     inherit stdenv;
 
     swift-unwrapped = callPackage ./compiler {
-      # TODO: Clean up on `staging`
-      inherit (llvmPackages) stdenv lld;
+      inherit (llvmPackages) stdenv;
       inherit (darwin) DarwinTools sigtool;
     };
 

pkgs/development/compilers/swift/swiftpm/default.nix

@@ -135,11 +135,6 @@ let
           # so we don't have to account for that scenario.
           "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
         ];
-
-        # TODO: Clean up on `staging`.
-        env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-          NIX_LDFLAGS = "-headerpad_max_install_names";
-        };
       }
     );
 

pkgs/development/compilers/swift/wrapper/default.nix

@@ -5,10 +5,6 @@
   useSwiftDriver ? true,
   swift-driver,
   clang,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
-  writeShellScriptBin,
 }:
 
 stdenv.mkDerivation (
@@ -94,15 +90,6 @@ stdenv.mkDerivation (
           cp "$input" "$out/nix-support/$(basename "$input")"
         done
       fi
-    ''
-    # TODO: Clean up on `staging`.
-    + lib.optionalString stdenv.targetPlatform.isDarwin ''
-      printf "NIX_SWIFTFLAGS_COMPILE+=' -use-ld=lld -tools-directory %s'\n" \
-        ${writeShellScriptBin "ld" ''
-          exec ${lib.getExe' llvmPackages.lld "ld64.lld"} "$@"
-        ''}/bin \
-        >> $out/nix-support/setup-hook
-      printf '%s\n' ${lib.getBin llvmPackages.lld} >> $out/nix-support/propagated-build-inputs
     '';
 
     passthru = {

pkgs/development/libraries/ffmpeg/generic.nix

@@ -366,9 +366,6 @@
   libnpp,
   # Testing
   testers,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 /*
@@ -837,9 +834,7 @@ stdenv.mkDerivation (
     ++ optionals stdenv.hostPlatform.isx86 [ nasm ]
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ optionals (lib.versionAtLeast version "6") [ texinfo ]
-    ++ optionals withCudaNVCC [ cuda_nvcc ]
-    # TODO: Clean up on `staging`.
-    ++ optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+    ++ optionals withCudaNVCC [ cuda_nvcc ];
 
     buildInputs =
       [ ]
@@ -983,17 +978,12 @@ stdenv.mkDerivation (
 
     buildFlags = [ "all" ] ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
 
-    env =
-      lib.optionalAttrs stdenv.cc.isGNU {
-        NIX_CFLAGS_COMPILE = toString [
-          "-Wno-error=incompatible-pointer-types"
-          "-Wno-error=int-conversion"
-        ];
-      }
-      # TODO: Clean up on `staging`.
-      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-        NIX_CFLAGS_LINK = "-fuse-ld=lld";
-      };
+    env = lib.optionalAttrs stdenv.cc.isGNU {
+      NIX_CFLAGS_COMPILE = toString [
+        "-Wno-error=incompatible-pointer-types"
+        "-Wno-error=int-conversion"
+      ];
+    };
 
     # tests linking broken with shaderc after https://github.com/NixOS/nixpkgs/pull/477464/changes/5a47b12dfcd1b909ba35778a866394430054319a
     doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform && !withShaderc;

pkgs/development/libraries/gstreamer/base/default.nix

@@ -46,8 +46,6 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -89,10 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableWayland [
     wayland-scanner
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -165,14 +159,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
   ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
 
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    CC_LD = "lld";
-    OBJC_LD = "lld";
-  };
-
   postPatch = ''
     patchShebangs \
       scripts/meson-pkg-config-file-fixup.py \

pkgs/development/libraries/gstreamer/core/default.nix

@@ -33,8 +33,6 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -86,10 +84,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableDocumentation [
     hotdoc
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -123,14 +117,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "libdw" (withLibunwind && hasElfutils))
   ];
 
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    CC_LD = "lld";
-    OBJC_LD = "lld";
-  };
-
   postPatch = ''
     patchShebangs \
       gst/parse/get_flex_version.py \

pkgs/development/libraries/gstreamer/good/default.nix

@@ -66,8 +66,6 @@
   gst-plugins-good,
   directoryListingUpdater,
   apple-sdk_gstreamer,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -139,10 +137,6 @@ stdenv.mkDerivation (finalAttrs: {
   )
   ++ lib.optionals enableWayland [
     wayland-protocols
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -271,13 +265,6 @@ stdenv.mkDerivation (finalAttrs: {
       # linking error on Darwin
       # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
       "-lncurses";
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Fix for ld64 hardening issue
-    #
-    # TODO: Clean up on `staging`
-    CC_LD = "lld";
-    OBJC_LD = "lld";
   };
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"

pkgs/development/libraries/opencv/4.x.nix

@@ -91,9 +91,6 @@
 
   bzip2,
   callPackage,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }@inputs:
 
 let
@@ -478,10 +475,6 @@ effectiveStdenv.mkDerivation {
   )
   ++ optionals enableCuda [
     cudaPackages.cuda_nvcc
-  ]
-  # TODO: Clean up on `staging`.
-  ++ optionals effectiveStdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   env = {
@@ -572,10 +565,6 @@ effectiveStdenv.mkDerivation {
   ]
   ++ optionals (enabledModules != [ ]) [
     (cmakeFeature "BUILD_LIST" (concatStringsSep "," enabledModules))
-  ]
-  # TODO: Clean up on `staging`.
-  ++ optionals effectiveStdenv.hostPlatform.isDarwin [
-    (cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   postBuild = optionalString enableDocs ''

pkgs/development/libraries/qt-5/modules/qtbase.nix

@@ -20,8 +20,6 @@
   which,
   # darwin support
   xcbuild,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 
   dbus,
   fontconfig,
@@ -194,8 +192,6 @@ stdenv.mkDerivation (
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         xcbuild
-        # TODO: Clean up on `staging`
-        llvmPackages.lld
       ];
 
     }
@@ -377,12 +373,6 @@ stdenv.mkDerivation (
         # if dependency paths contain the string "pq", which can occur in the hash.
         # To prevent these failures, we need to override PostgreSQL detection.
         PSQL_LIBS = "-L${libpq}/lib -lpq";
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-        # Fix for ld64 hardening issue
-        #
-        # TODO: Clean up on `staging`
-        NIX_CFLAGS_LINK = "-fuse-ld=lld";
       };
 
       prefixKey = "-prefix ";

pkgs/development/libraries/qt-6/modules/qtbase/default.nix

@@ -89,9 +89,6 @@
   # options
   qttranslations ? null,
   fetchpatch,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 let
@@ -200,11 +197,7 @@ stdenv.mkDerivation {
     cmake
     ninja
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    moveBuildTree
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
 
   propagatedNativeBuildInputs = [
     lndir
@@ -319,8 +312,6 @@ stdenv.mkDerivation {
     # When this variable is not set, cmake tries to execute xcodebuild
     # to query the version.
     "-DQT_INTERNAL_XCODE_VERSION=0.1"
-    # TODO: Clean up on `staging`.
-    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ]
   ++ lib.optionals isCrossBuild [
     "-DQT_HOST_PATH=${pkgsBuildBuild.qt6.qtbase}"

pkgs/development/libraries/qt-6/modules/qtspeech.nix

@@ -2,7 +2,6 @@
   qtModule,
   lib,
   stdenv,
-  llvmPackages,
   qtbase,
   qtmultimedia,
   pkg-config,
@@ -13,10 +12,7 @@
 
 qtModule {
   pname = "qtspeech";
-  nativeBuildInputs = [
-    pkg-config
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     flite
     alsa-lib
@@ -26,9 +22,4 @@ qtModule {
     qtbase
     qtmultimedia
   ];
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
 }

pkgs/development/python-modules/matplotlib/default.nix

@@ -62,9 +62,6 @@
 
   # Reverse dependency
   sage,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 let
@@ -107,12 +104,7 @@ buildPythonPackage (finalAttrs: {
         --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
-  nativeBuildInputs = [
-    pkg-config
-  ]
-  ++ lib.optionals enableGtk3 [ gobject-introspection ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
 
   buildInputs = [
     ffmpeg-headless
@@ -168,11 +160,6 @@ buildPythonPackage (finalAttrs: {
     b_lto = false;
   };
 
-  # TODO: Clean up on `staging`.
-  env.${if stdenv.hostPlatform.isDarwin then "CC_LD" else null} = "lld";
-  env.${if stdenv.hostPlatform.isDarwin then "CXX_LD" else null} = "lld";
-  env.${if stdenv.hostPlatform.isDarwin then "OBJC_LD" else null} = "lld";
-
   passthru.tests = {
     inherit sage;
   };

pkgs/development/python-modules/pyobjc-core/default.nix

@@ -4,9 +4,6 @@
   fetchFromGitHub,
   lib,
   setuptools,
-
-  # TODO: Clean up on `staging`.
-  llvmPackages,
 }:
 
 buildPythonPackage rec {
@@ -31,9 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     darwin.DarwinTools # sw_vers
-
-    # TODO: Clean up on `staging`.
-    llvmPackages.lld
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -42,9 +36,6 @@ buildPythonPackage rec {
     "-Wno-error=unused-command-line-argument"
   ];
 
-  # TODO: Clean up on `staging`.
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   pythonImportsCheck = [ "objc" ];
 
   meta = {

pkgs/development/tools/godot/common.nix

@@ -38,7 +38,6 @@
   libxkbcommon,
   libxrandr,
   libxrender,
-  llvmPackages,
   makeWrapper,
   mbedtls,
   miniupnpc,
@@ -399,8 +398,6 @@ let
             "-I${lib.getDev harfbuzz-icu}/include/harfbuzz"
             "-I${lib.getDev recastnavigation}/include/recastnavigation"
           ];
-          # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-          NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
         };
 
         preConfigure = lib.optionalString (editor && withMono) ''
@@ -646,8 +643,6 @@ let
         ++ lib.optionals stdenv.hostPlatform.isDarwin (
           [
             darwin.sigtool
-            # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-            llvmPackages.lld
           ]
           ++ lib.optionals (!editor) [
             strip-nondeterminism

pkgs/tools/security/pinentry/mac.nix

@@ -10,8 +10,6 @@
   common-updater-scripts,
   writers,
   re-plistbuddy,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -49,8 +47,6 @@ stdenv.mkDerivation rec {
     makeBinaryWrapper
     texinfo
     re-plistbuddy
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
 
   configureFlags = [
@@ -60,11 +56,6 @@ stdenv.mkDerivation rec {
     "--with-libassuan-prefix=${libassuan.dev}"
   ];
 
-  # Fix for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   installPhase = ''
     mkdir -p $out/Applications $out/bin
     mv macosx/pinentry-mac.app $out/Applications