various: yet more ld64 hardening workarounds (#538151)

pkgs/by-name/gl/glfw3/package.nix

@@ -20,6 +20,9 @@
   libxkbcommon,
   libdecor,
   withMinecraftPatch ? false,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   version = "3.4";
@@ -58,7 +61,11 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -86,6 +93,9 @@ stdenv.mkDerivation {
   cmakeFlags = [
     # Static linking isn't supported
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {

pkgs/by-name/qe/qemu/package.nix

@@ -123,6 +123,9 @@
   minimal ? toolsOnly || userOnly,
   gitUpdater,
   qemu-utils, # for tests attribute
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -180,6 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals hexagonSupport [ glib ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.sigtool
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ]
   ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -425,6 +431,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
     tests = lib.optionalAttrs (!toolsOnly) {

pkgs/by-name/wx/wxwidgets_3_1/package.nix

@@ -23,6 +23,9 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_1,
   libpng,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./0002-support-webkitgtk-41.patch
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -89,12 +96,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     substituteInPlace configure --replace \

pkgs/by-name/wx/wxwidgets_3_2/package.nix

@@ -29,6 +29,9 @@
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   catch = fetchFromGitHub {
@@ -56,7 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mYMUW3FnFkKHDQXb/k9UosSiWCPW7OQn+/orwq4Q95k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -114,12 +121,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     cp -r ${catch}/* 3rdparty/catch/

pkgs/by-name/wx/wxwidgets_3_3/package.nix

@@ -30,6 +30,9 @@
   withEGL ? true,
   withPrivateFonts ? false,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -44,7 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UL1NuByKFGMQ/dhjuWRdnWTgdy4+1cD9pSls3e1mur8=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -103,12 +110,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   postInstall = "
     pushd $out/include

pkgs/development/libraries/qt-6/modules/qtbase/default.nix

@@ -89,6 +89,9 @@
   # options
   qttranslations ? null,
   fetchpatch,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -197,7 +200,11 @@ stdenv.mkDerivation {
     cmake
     ninja
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    moveBuildTree
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ];
 
   propagatedNativeBuildInputs = [
     lndir
@@ -312,6 +319,8 @@ stdenv.mkDerivation {
     # When this variable is not set, cmake tries to execute xcodebuild
     # to query the version.
     "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    # TODO: Clean up on `staging`.
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ]
   ++ lib.optionals isCrossBuild [
     "-DQT_HOST_PATH=${pkgsBuildBuild.qt6.qtbase}"

pkgs/development/python-modules/matplotlib/default.nix

@@ -62,6 +62,9 @@
 
   # Reverse dependency
   sage,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -104,7 +107,12 @@ buildPythonPackage (finalAttrs: {
         --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals enableGtk3 [ gobject-introspection ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     ffmpeg-headless
@@ -160,6 +168,11 @@ buildPythonPackage (finalAttrs: {
     b_lto = false;
   };
 
+  # TODO: Clean up on `staging`.
+  env.${if stdenv.hostPlatform.isDarwin then "CC_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "CXX_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "OBJC_LD" else null} = "lld";
+
   passthru.tests = {
     inherit sage;
   };

pkgs/development/python-modules/pyobjc-core/default.nix

@@ -4,6 +4,9 @@
   fetchFromGitHub,
   lib,
   setuptools,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 buildPythonPackage rec {
@@ -28,6 +31,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     darwin.DarwinTools # sw_vers
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "-Wno-error=unused-command-line-argument"
   ];
 
+  # TODO: Clean up on `staging`.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   pythonImportsCheck = [ "objc" ];
 
   meta = {