diff --git a/pkgs/by-name/ap/apple-sdk/README.md b/pkgs/by-name/ap/apple-sdk/README.md
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
new file mode 100644
index 000000000000..7bb655a1863b
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+}:
+
+let
+  CoreSymbolication = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "CoreSymbolication";
+    version = "0-unstable-2018-06-17";
+
+    src = fetchFromGitHub {
+      repo = "CoreSymbolication";
+      owner = "matthewbauer";
+      rev = "24c87c23664b3ee05dc7a5a87d647ae476a680e4";
+      hash = "sha256-PzvLq94eNhP0+rLwGMKcMzxuD6MlrNI7iT/eV0obtSE=";
+    };
+
+    patches = [
+      # Add missing symbol definitions needed to build `zlog` in system_cmds.
+      # https://github.com/matthewbauer/CoreSymbolication/pull/2
+      ../patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
+      ../patches/0002-Add-CF_EXPORT-To-const-symbols.patch
+    ];
+
+    dontBuild = true;
+
+    installPhase = ''
+      mkdir -p "$out/include"
+      cp *.h "$out/include"
+    '';
+
+    meta = {
+      description = "Reverse engineered headers for Apple's CoreSymbolication framework";
+      homepage = "https://github.com/matthewbauer/CoreSymbolication";
+      license = lib.licenses.mit;
+      maintainers = lib.teams.darwin.members;
+      platforms = lib.platforms.darwin;
+    };
+  });
+in
+self: super: {
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      mkdir -p System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+      ln -s A System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/Current
+      ln -s Versions/Current/Headers System/Library/PrivateFrameworks/CoreSymbolication.framework/Headers
+      cp '${CoreSymbolication}/include/'*.h System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix b/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix
new file mode 100644
index 000000000000..361e8df0f8d1
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix
@@ -0,0 +1,17 @@
+{ lib, config }:
+
+self: super: {
+  preBuild =
+    super.preBuild or ""
+    + ''
+      platformPath=$out/Platforms/MacOSX.platform
+      sdkpath=$platformPath/Developer/SDKs
+    '';
+
+  preInstall =
+    super.preInstall or ""
+    + ''
+      platformPath=$out/Platforms/MacOSX.platform
+      sdkpath=$platformPath/Developer/SDKs
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/fetch-sdk.nix b/pkgs/by-name/ap/apple-sdk/common/fetch-sdk.nix
new file mode 100644
index 000000000000..d96c27509dda
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/fetch-sdk.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchurl,
+  cpio,
+  pbzx,
+}:
+
+{
+  url,
+  version,
+  hash,
+}:
+
+fetchurl {
+  pname = "macOS-SDK";
+  inherit version url hash;
+
+  recursiveHash = true;
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  postFetch = ''
+    renamed=$(mktemp -d)/sdk.xar
+    mv "$downloadedFile" "$renamed"
+    pbzx "$renamed" | cpio -idm
+
+    # SDKs are inconsistent about whether MacOSX.sdk or MacOSX<version>.sdk is a symlink.
+    src=Library/Developer/CommandLineTools/SDKs/MacOSX${lib.versions.majorMinor version}.sdk
+    if [ ! -d $src ]; then
+      src=Library/Developer/CommandLineTools/SDKs/MacOSX.sdk
+    fi
+
+    # Remove unwanted binaries, man pages, and folders from the SDK.
+    rm -rf $src/usr/bin $src/usr/share $src/System/Library/Perl
+
+    mkdir -p "$out"
+    cp -rd $src/* "$out"
+  '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/passthru-private-frameworks.nix b/pkgs/by-name/ap/apple-sdk/common/passthru-private-frameworks.nix
new file mode 100644
index 000000000000..7d3897dc1dcc
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/passthru-private-frameworks.nix
@@ -0,0 +1,9 @@
+{ makeSetupHook, sdkVersion }:
+
+self: super: {
+  passthru = super.passthru or { } // {
+    privateFrameworksHook = makeSetupHook {
+      name = "apple-sdk-private-frameworks-hook";
+    } ../setup-hooks/add-private-frameworks.sh;
+  };
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/passthru-source-release-files.nix b/pkgs/by-name/ap/apple-sdk/common/passthru-source-release-files.nix
new file mode 100644
index 000000000000..cf23ea7214bc
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/passthru-source-release-files.nix
@@ -0,0 +1,37 @@
+let
+  lockfile = builtins.fromJSON (builtins.readFile ../metadata/apple-oss-lockfile.json);
+in
+
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  sdkVersion,
+}:
+
+let
+  sdkinfo = lockfile.${sdkVersion};
+in
+self: super: {
+  passthru = super.passthru or { } // {
+    # Returns the raw source from apple-oss-distributions repo.
+    # This is mostly useful for copying private headers needed to build other source releases.
+    #
+    # Note: The source releases are mostly not used to build the SDK. Unless they can be used to build binaries,
+    # they’re not used.
+    sourceRelease =
+      name:
+      let
+        lockinfo = sdkinfo.${name};
+      in
+      fetchFromGitHub {
+        owner = "apple-oss-distributions";
+        repo = name;
+        rev = lockinfo.rev or "${name}-${lockinfo.version}";
+        inherit (lockinfo) hash;
+      }
+      // {
+        inherit (lockinfo) version;
+      };
+  };
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/plists.nix b/pkgs/by-name/ap/apple-sdk/common/plists.nix
new file mode 100644
index 000000000000..581635694a76
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/plists.nix
@@ -0,0 +1,307 @@
+{
+  lib,
+  stdenvNoCC,
+  xcodePlatform,
+}:
+
+let
+  inherit (lib.generators) toPlist;
+
+  Info = {
+    CFBundleIdentifier = "com.apple.platform.${lib.toLower xcodePlatform}";
+    Type = "Platform";
+    Name = lib.toLower xcodePlatform;
+  };
+
+  # These files are all based off of Xcode spec files found in
+  # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
+
+  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
+  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  Architectures = [
+    {
+      Identifier = "Standard";
+      Type = "Architecture";
+      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD";
+    }
+    {
+      Identifier = "Universal";
+      Type = "Architecture";
+      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
+    }
+    {
+      Identifier = "Native";
+      Type = "Architecture";
+      Name = "Native Architecture of Build Machine";
+      ArchitectureSetting = "NATIVE_ARCH_ACTUAL";
+    }
+    {
+      Identifier = "Standard64bit";
+      Type = "Architecture";
+      Name = "Apple Silicon, 64-bit Intel";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
+    }
+    {
+      Identifier = stdenvNoCC.hostPlatform.darwinArch;
+      Type = "Architecture";
+      Name = "Apple Silicon or Intel 64-bit";
+    }
+    {
+      Identifier = "Standard_Including_64_bit";
+      Type = "Architecture";
+      Name = "Standard Architectures (including 64-bit)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
+    }
+  ];
+
+  # Based off of the "MacOSX Package Types.xcspec" file. Only keep the
+  # bare minimum needed.
+  PackageTypes = [
+    {
+      Identifier = "com.apple.package-type.mach-o-executable";
+      Type = "PackageType";
+      Name = "Mach-O Executable";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.executable";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-objfile";
+      Type = "PackageType";
+      Name = "Mach-O Object File";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.objfile";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-dylib";
+      Type = "PackageType";
+      Name = "Mach-O Dynamic Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.dylib";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.static-library";
+      Type = "PackageType";
+      Name = "Mach-O Static Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".a";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "archive.ar";
+        Name = "$(EXECUTABLE_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper";
+      Type = "PackageType";
+      Name = "Wrapper";
+      DefaultBuildSettings = {
+        WRAPPER_SUFFIX = ".bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        CONTENTS_FOLDER_PATH = "$(WRAPPER_NAME)/Contents";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/MacOS";
+        EXECUTABLE_PATH = "$(EXECUTABLE_FOLDER_PATH)/$(EXECUTABLE_NAME)";
+        INFOPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/Info.plist";
+        INFOSTRINGS_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/InfoPlist.strings";
+        PKGINFO_PATH = "$(CONTENTS_FOLDER_PATH)/PkgInfo";
+        PBDEVELOPMENTPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/pbdevelopment.plist";
+        VERSIONPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/version.plist";
+        PUBLIC_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Headers";
+        PRIVATE_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PrivateHeaders";
+        EXECUTABLES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Executables";
+        FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Frameworks";
+        SHARED_FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedFrameworks";
+        SHARED_SUPPORT_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedSupport";
+        UNLOCALIZED_RESOURCES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Resources";
+        LOCALIZED_RESOURCES_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/$(DEVELOPMENT_LANGUAGE).lproj";
+        DOCUMENTATION_FOLDER_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/Documentation";
+        PLUGINS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PlugIns";
+        SCRIPTS_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/Scripts";
+      };
+      ProductReference = {
+        FileType = "wrapper.cfbundle";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper.application";
+      Type = "PackageType";
+      BasedOn = "com.apple.package-type.wrapper";
+      Name = "Application Wrapper";
+      DefaultBuildSettings = {
+        GENERATE_PKGINFO_FILE = "YES";
+      };
+      ProductReference = {
+        FileType = "wrapper.application";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "YES";
+      };
+    }
+  ];
+
+  # Based off of the "MacOSX Product Types.xcspec" file. All
+  # bundles/wrapper are removed, because we prefer dynamic products in
+  # NixPkgs.
+  ProductTypes = [
+    {
+      Identifier = "com.apple.product-type.tool";
+      Type = "ProductType";
+      Name = "Command-line Tool";
+      PackageTypes = [ "com.apple.package-type.mach-o-executable" ];
+    }
+    {
+      Identifier = "com.apple.product-type.objfile";
+      Type = "ProductType";
+      Name = "Object File";
+      PackageTypes = [ "com.apple.package-type.mach-o-objfile" ];
+    }
+    {
+      Identifier = "com.apple.product-type.library.dynamic";
+      Type = "ProductType";
+      Name = "Dynamic Library";
+      PackageTypes = [ "com.apple.package-type.mach-o-dylib" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "mh_dylib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "dylib";
+        DYLIB_COMPATIBILITY_VERSION = "1";
+        DYLIB_CURRENT_VERSION = "1";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        GCC_INLINES_ARE_PRIVATE_EXTERN = "YES";
+        CODE_SIGNING_ALLOWED = "YES";
+        CODE_SIGNING_REQUIRED = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.product-type.library.static";
+      Type = "ProductType";
+      Name = "Static Library";
+      PackageTypes = [ "com.apple.package-type.static-library" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "staticlib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "a";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        SEPARATE_STRIP = "YES";
+        CLANG_ENABLE_MODULE_DEBUGGING = "NO";
+      };
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.bundle";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+    {
+      Identifier = "com.apple.product-type.application";
+      Type = "ProductType";
+      BasedOn = "com.apple.product-type.bundle";
+      Name = "Application";
+      DefaultBuildProperties = {
+        MACH_O_TYPE = "mh_execute";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "app";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper.application" ];
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.framework";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+  ];
+
+  ToolchainInfo = {
+    Identifier = "com.apple.dt.toolchain.XcodeDefault";
+  };
+in
+{
+  "Info.plist" = builtins.toFile "Info.plist" (toPlist { } Info);
+  "ToolchainInfo.plist" = builtins.toFile "ToolchainInfo.plist" (toPlist { } ToolchainInfo);
+  "Architectures.xcspec" = builtins.toFile "Architectures.xcspec" (toPlist { } Architectures);
+  "PackageTypes.xcspec" = builtins.toFile "PackageTypes.xcspec" (toPlist { } PackageTypes);
+  "ProductTypes.xcspec" = builtins.toFile "ProductTypes.xcspec" (toPlist { } ProductTypes);
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix b/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix
new file mode 100644
index 000000000000..840415d2e3b1
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix
@@ -0,0 +1,46 @@
+let
+  removedDylibs = [
+    # corecrypto is available under a very restrictive license (effectively: non-free, can’t use).
+    # Without the headers and not being able to use corecrypto due to its license, it’s not very useful.
+    # Stubs are included in the SDK for all dylibs, including corecrypto. They should be removed.
+    "/usr/lib/system/libcorecrypto.dylib"
+  ];
+in
+
+{
+  lib,
+  jq,
+  libtapi,
+}:
+
+self: super: {
+  nativeBuildInputs = super.nativeBuildInputs or [ ] ++ [
+    jq
+    libtapi
+  ];
+
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      echo "Removing the following dylibs from the libSystem reexported libraries list: ${lib.escapeShellArg (lib.concatStringsSep ", " removedDylibs)}"
+      for libSystem in libSystem.B.tbd libSystem.B_asan.tbd; do
+        test ! -e usr/lib/$libSystem && continue # TODO: remove once the minimum SDK is 10.14 or newer.
+        tapi stubify --filetype=tbd-v5 usr/lib/$libSystem -o usr/lib/$libSystem # tbd-v5 is a JSON-based format.
+        jq --argjson libs ${lib.escapeShellArg (builtins.toJSON removedDylibs)} '
+          if .libraries then
+            .libraries[] |= select(.install_names[] | any([.] | inside($libs)) | not)
+          else
+            .
+          end
+          | .main_library.reexported_libraries[].names[] |= select([.] | inside($libs) | not)
+        ' usr/lib/$libSystem > usr/lib/$libSystem~
+        mv usr/lib/$libSystem~ usr/lib/$libSystem
+      done
+
+      # Rewrite the text-based stubs to v4 using `tapi`. This ensures a consistent format between SDK versions.
+      # tbd-v4 also drops certain elements that are no longer necessary (such as GUID lists).
+      find . -name '*.tbd' -type f \
+        -exec echo "Converting {} to tbd-v4" \; \
+        -exec tapi stubify --filetype=tbd-v4 {} -o {} \;
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
new file mode 100644
index 000000000000..f4d80eed0b49
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  cups,
+  darwin,
+  db,
+  libiconv,
+  ncurses,
+  stdenv,
+  stdenvNoCC,
+  xcbuild,
+}:
+
+let
+  # CUPS has too many dependencies to build as part of the Darwin bootstrap. It’s also typically taken as an explicit
+  # dependency by other packages, so building only the headers (to satisfy other SDK headers) should be okay.
+  cupsHeaders = darwin.bootstrapStdenv.mkDerivation {
+    pname = "${lib.getName cups}-headers";
+    version = lib.getVersion cups;
+
+    inherit (cups) src;
+
+    patches = cups.patches or [ ];
+
+    strictDeps = true;
+
+    dontBuild = true;
+
+    buildInputs = [ darwin.libresolv ]; # The `configure` script requires libresolv headers.
+
+    # CUPS’s configure script fails to find `ar` when cross-compiling.
+    configureFlags = [ "ac_cv_path_AR=${stdenv.cc.targetPrefix}ar" ];
+
+    installTargets = [ "install-headers" ];
+
+    __structuredAttrs = true;
+
+    meta = {
+      inherit (cups.meta)
+        homepage
+        description
+        license
+        maintainers
+        platforms
+        ;
+    };
+  };
+in
+self: super: {
+  # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
+  # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
+  propagatedBuildInputs =
+    super.propagatedBuildInputs or [ ]
+    ++ [
+      libiconv
+      darwin.libresolv
+      darwin.libsbuf
+      # Required by some SDK headers
+      cupsHeaders
+    ]
+    # x86_64-darwin links the object files from Csu when targeting very old releases
+    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+
+  # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'*; do
+        ln -s "$header" "usr/include/$(basename "$header")"
+      done
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
new file mode 100644
index 000000000000..441b36698688
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  pkgsBuildHost,
+  stdenv,
+  stdenvNoCC,
+}:
+
+let
+  plists = import ./plists.nix {
+    inherit lib stdenvNoCC;
+    xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
+  };
+  inherit (pkgsBuildHost) darwin cctools xcbuild;
+in
+self: super: {
+  propagatedNativeBuildInputs = super.propagatedNativeBuildInputs or [ ] ++ [ xcbuild.xcrun ];
+
+  postInstall =
+    super.postInstall or ""
+    + ''
+      specspath=$out/Library/Xcode/Specifications
+      toolchainsPath=$out/Toolchains/XcodeDefault.xctoolchain
+      mkdir -p "$specspath" "$toolchainsPath"
+
+      # xcbuild expects to find things relative to the plist locations. If these are linked instead of copied,
+      # it won’t find any platforms or SDKs.
+      cp '${plists."Info.plist"}' "$platformPath/Info.plist"
+      cp '${plists."ToolchainInfo.plist"}' "$toolchainsPath/ToolchainInfo.plist"
+
+      for spec in '${xcbuild}/Library/Xcode/Specifications/'*; do
+        ln -s "$spec" "$specspath/$(basename "$spec")"
+      done
+      cp '${plists."Architectures.xcspec"}' "$specspath/Architectures.xcspec"
+      cp '${plists."PackageTypes.xcspec"}' "$specspath/PackageTypes.xcspec"
+      cp '${plists."ProductTypes.xcspec"}' "$specspath/ProductTypes.xcspec"
+
+      mkdir -p "$out/usr/bin"
+      ln -s '${xcbuild.xcrun}/bin/xcrun' "$out/usr/bin/xcrun"
+
+      # Include `libtool` in the toolchain, so `xcrun -find libtool` can find it without requiring `cctools.libtool`
+      # as a `nativeBuildInput`.
+      mkdir -p "$toolchainsPath/usr/bin"
+      ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+
+      # Include additional binutils required by some packages (such as Chromium).
+      for tool in lipo nm otool size strip; do
+        ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      done
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/remove-disallowed-packages.nix b/pkgs/by-name/ap/apple-sdk/common/remove-disallowed-packages.nix
new file mode 100644
index 000000000000..c771b2ccb9f5
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/remove-disallowed-packages.nix
@@ -0,0 +1,35 @@
+let
+  # This can be made unconditional once jq is available in the bootstrap tools. If corecrypto is  not removed from
+  # the umbrella framework, linking will fail in stage 1 because it can’t find the tbd.
+  disallowedPackages' = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+in
+
+{
+  lib,
+  jq,
+  stdenv,
+}:
+
+let
+  disallowedPackages =
+    if jq == null then
+      lib.filter (p: p.package != "corecrypto") disallowedPackages'
+    else
+      disallowedPackages';
+in
+self: super: {
+  # Remove headers and stubs for packages that are available in nixpkgs.
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      ${lib.concatMapStringsSep "\n" (
+        pkg:
+        lib.concatLines (
+          [ ''echo "Removing headers and libraries from ${pkg.package}"'' ]
+          ++ (map (header: "rm -rf -- usr/include/${header}") pkg.headers or [ ])
+          ++ (map (framework: "rm -rf -- System/Library/Frameworks/${framework}") pkg.frameworks or [ ])
+          ++ (map (library: "rm -rf -- usr/lib/${library}") pkg.libraries or [ ])
+        )
+      ) disallowedPackages}
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/rewrite-sdk-paths.nix b/pkgs/by-name/ap/apple-sdk/common/rewrite-sdk-paths.nix
new file mode 100644
index 000000000000..0eca6b8836b3
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/rewrite-sdk-paths.nix
@@ -0,0 +1,18 @@
+{ lib, sdkVersion }:
+
+let
+  name = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+in
+self: super: {
+  # Rewrite the stubs to point to dylibs in the SDK instead of at system locations. This is needed for umbrella
+  # frameworks in older SDKs, which don’t also embed their stubs.
+  buildPhase =
+    super.buildPhase or ""
+    + ''
+      echo "Rewriting stubs to reference the SDK location in the store"
+      find . -name '*.tbd' -type f -exec sed -E \
+        -e "/^install-name/n; s|( \\|'\\|\"\\|\\[)/usr/|\1$sdkpath/${name}/usr/|g" \
+        -e "/^install-name/n; s|( \\|'\\|\"\\|\\[)/System/|\1$sdkpath/${name}/System/|g" \
+        -i {} \;
+    '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/run-build-phase-hooks.nix b/pkgs/by-name/ap/apple-sdk/common/run-build-phase-hooks.nix
new file mode 100644
index 000000000000..9ab00665675d
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/run-build-phase-hooks.nix
@@ -0,0 +1,9 @@
+{ }:
+
+self: super: {
+  buildPhase = ''
+    runHook preBuild
+    ${super.buildPhase or ""}
+    runHook postBuild
+  '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json b/pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json
new file mode 100644
index 000000000000..9340931ca473
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json
@@ -0,0 +1,358 @@
+{
+  "10.12.2": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-1mCJjZLBMIftcsKC7Ihhzi6LRS3u7kJzh9/dy6MY1Hg=",
+      "version": "60092.30.2"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-5t3D44H/h0cUZqAjMi56BTbJD4o+R0xVdHJ1sZLYgNM=",
+      "version": "205.11"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-4NpWcqfkp3UxhKKAwomDK3zxQ9DagyYFUVoUcrHo1Rg=",
+      "version": "18"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-XOwdBFunLbwyasnTKQC6MRlXxGns07JvcAQc6AQ1Zt4=",
+      "version": "56"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-bbGzqJnenEL9hRyKMBif/381/ETO+yNYHhlnXXWLne0=",
+      "version": "41.1"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-rhZdjNoZ3OuHVLClhe9tMQU6qJs3IOHEqJ5TaNRJRnM=",
+      "version": "424"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-adOI5uhd6QL4zpo4MK4ttmS1lcKseqmr68C1D/juGo0=",
+      "version": "465"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-5UWldDuSyAnRYjgIKllY4VNbxtAUawrlRS46+8FnbPs=",
+      "version": "427"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-a/xnnR2dUSWVMyTlkxJPa7cWk20RHl0Zh2Ot2pSEkF0=",
+      "version": "252"
+    },
+    "IOGraphics": {
+      "hash": "sha256-63XDVmEHu+KUdr06S7+RPi1BgLcAl4GZZRy+K96CvA0=",
+      "version": "513.1"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-BUDj89w4DrnsIxJZNIx3ZJ85c22HMchIVhJI7xREWTM=",
+      "version": "870.31.1"
+    },
+    "IOKitUser": {
+      "hash": "sha256-XJnOp5AtStXUim19GLev8MSM8iS5U8rRSnm7cNp/B80=",
+      "version": "1324.30.13"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-dL1wSu72uzAAoMdgSjitXgHviioVIGdkDXqwY6HT5/g=",
+      "version": "116.1.1"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-ZcZ5F+a4u2AHThO5WyLn3/o42DR+YDBZKTy4P2EhHhk=",
+      "version": "91"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-IjsG/lgdtW04WH/5rb1QAT563Oy4O5fUrTGuA1kBrkY=",
+      "version": "210.30.1"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-wyt5CJnNzk0MPC6pg2JAdiwIPxWFJsO9Yqa83vY+hLc=",
+      "version": "1158.30.7"
+    },
+    "Libinfo": {
+      "hash": "sha256-3Mu9lOkaQx5gmNPXzr67FnZvKWmQhryIPsN6k95TU18=",
+      "version": "503.30.1"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-msGtbR53SHXjYN8i74gmkYWGkmqg+TcRO7TY/23XSFQ=",
+      "version": "165.20.1"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
+      "version": "26"
+    },
+    "Libsystem": {
+      "hash": "sha256-FwI2aD3wSwES/sKkr014BdFLfsKeEefgS0Pne1FGOp0=",
+      "version": "1238"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-Ya+ZO3bHNhQ+vZZx/lE7x+uMROHYWYKvm2ZZ1vClu3Q=",
+      "version": "57740.31.2"
+    },
+    "architecture": {
+      "hash": "sha256-gHUfKWc1uahI/IATafY1ppPAWnYUghOEXWK2lknAfrQ=",
+      "version": "268"
+    },
+    "configd": {
+      "hash": "sha256-i1UjnU7xBh7jCrGZxWMGrldzDrk2dDvjpthp/kq9OKo=",
+      "version": "888.30.2"
+    },
+    "copyfile": {
+      "hash": "sha256-pth+37uTfuFY94HuA4b/5GleDjidAuXVsBEQBUa3xCE=",
+      "version": "138"
+    },
+    "dtrace": {
+      "hash": "sha256-dK0N3l02241A5S1uvxZhqArHrTxd5Sd4JoAl6RBa8/8=",
+      "version": "209.20.4"
+    },
+    "dyld": {
+      "hash": "sha256-wyVsmqYgKLdMKZsLOHzOLag+mBnH0kNS6XAv4zuNTT4=",
+      "version": "421.2"
+    },
+    "eap8021x": {
+      "hash": "sha256-XSbzuNXyDJAADcnZed4Akmg1SK8P1IGrZitmhV3wzlo=",
+      "version": "246.30.1"
+    },
+    "hfs": {
+      "hash": "sha256-7ByUP59FXmmrxC5yJYUQxrkgt/vY7vZMl5JPQ0HfoS8=",
+      "version": "366.30.3"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-hfXKQDRdgEDVyT+3v/EuQZyXNd0abD2tICYdQNfhtwY=",
+      "version": "67"
+    },
+    "libdispatch": {
+      "hash": "sha256-tj4+6V4FL/XVON13UH71schElTm4/IKtPJH/yoUgRY0=",
+      "version": "703.30.5"
+    },
+    "libmalloc": {
+      "hash": "sha256-q9zcUy8YTsRds6RYJMIUIY/MULQ19uKiNduMXP3D7hA=",
+      "version": "116.30.3"
+    },
+    "libplatform": {
+      "hash": "sha256-k9Pd+TJCrNS7K100og+6bLAZjV/0VUTy8SIOsc+SE6Q=",
+      "version": "126.1.2"
+    },
+    "libpthread": {
+      "hash": "sha256-FJaJO4lXIMAIwEmVF6mHE4ZZZoPI8ZIVuMKLojEsESE=",
+      "version": "218.30.1"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-LYDkkmgyfWKK6AMINXyrXo5kw7+lxUcz+4Ckq9175vA=",
+      "version": "765.30.11"
+    },
+    "objc4": {
+      "hash": "sha256-WfhJo+/KPGr3/OuV5Kg2no48UR7VVVarh9TB3VFSCQ4=",
+      "version": "706"
+    },
+    "ppp": {
+      "hash": "sha256-eW62wL8C1GZ2+5aN0dTPsdoEu6FWf+6XEYv8OiEeMfY=",
+      "version": "838"
+    },
+    "removefile": {
+      "hash": "sha256-EJYU6eHggyRsezClEWkGJmgePIdtyF4rpFD4kSK5Czw=",
+      "version": "45"
+    },
+    "xnu": {
+      "hash": "sha256-pkELzbsWPtm9H31LaRkaVjkQpPDxG9E93TNS+K9nqhE=",
+      "version": "3789.31.2"
+    }
+  },
+  "11.3": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-92v9tuNLqvalwYV4AqQllA8yN9fqGjSpc4MNAmFPrbk=",
+      "version": "60178.100.1"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-dSSbt9ZoL/Tq2xXwvvXsDmD3Xru7igzdK1MxGL1K+Aw=",
+      "version": "300.6.1"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
+      "version": "20.100.1"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-w0YhZ38RBfnxSc74Q8r5UdK+WiWOSAX46r5hahHLnSg=",
+      "version": "59"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+      "version": "43"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-7H3WcZC/HuS9xsTNDWRqt+1JzUNK4ndvd4u2ru0GGRE=",
+      "version": "428"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-2xppN8RJ9cxrHWjPQ4bUIjtupPbzfmrm3rXnT/9QVfc=",
+      "version": "483"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-kfhmZy8veqI3/XHDtOTKmKj6P7s+j0B+BiAbcjhGq0M=",
+      "version": "442"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-WDq2Ak72Jw6gYNIKgZkiexA6LzccrPn1kpSbW5U50ek=",
+      "version": "257.40.1"
+    },
+    "IOGraphics": {
+      "hash": "sha256-kEP4RWIZwu3ZPIq9IAPUKM0gIXHr8xD50SnGNFCQRcI=",
+      "version": "585.1"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-QASfvttke+AUx55In4DD4vsQGzC3nbe+MugQQ4ddXGU=",
+      "version": "1633.100.36"
+    },
+    "IOKitUser": {
+      "hash": "sha256-NQCRrufElx00B7CqqslBi5BTxf5Zs4lcMcJig4Eab0k=",
+      "version": "1845.100.19"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-HqTKzrX75mMFYYbxNKwPdXmI7h7t/QWuO3W1Qo//zIo=",
+      "version": "151.40.1"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+      "version": "93"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-dy6CYz/z6SwPw0YfC6GLZO2u62Xy8otMDUNrZ5JhTDY=",
+      "version": "260.100.1"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-v01g/EtMW/STZQ1neKDMyUGL7sgaCzlwXN0VDaj/Mf0=",
+      "version": "1439.100.3"
+    },
+    "Libinfo": {
+      "hash": "sha256-T7KO6zfswjyTIKSdZJCbvfsdqQfPMLj5nheX9iSIl9o=",
+      "version": "542.40.3"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-vcDjdwB5OiTEUdl8ISezzpoHeFttkdvkulY/YbUOZjk=",
+      "version": "279.40.4"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
+      "version": "26"
+    },
+    "Libsystem": {
+      "hash": "sha256-24T9aD4W71prcpr3MnnaU3pfxIzIwkOz39OyhCwPO/E=",
+      "version": "1292.100.5"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-o5MyyqDpERvNPvbEfXNgqMIq0YpQV0+ju72C9g/9OdI=",
+      "version": "59754.100.106"
+    },
+    "architecture": {
+      "hash": "sha256-pIX9pEXE1Xjll9qwiWrMRwqw6G4g0isto/ALHsmkUSc=",
+      "version": "279"
+    },
+    "configd": {
+      "hash": "sha256-WEorIW5Vl8E9/aB0RBTY2bhkfVOF3tckjNztGDOOueA=",
+      "version": "1109.101.1"
+    },
+    "copyfile": {
+      "hash": "sha256-3BHFM67dvwUpinzF0pSX3QiUbIsqtLo77WzB3tMbTW4=",
+      "version": "173.40.2"
+    },
+    "dtrace": {
+      "hash": "sha256-FfyaYjEMDeL9wGdUyZ4eJdkbkp/WpdTGyBvaorwKSi8=",
+      "version": "370.40.1"
+    },
+    "dyld": {
+      "hash": "sha256-dtDTh6YqubBI4Z+QeytwGgUmU6tutvonIWHqzw6zuxo=",
+      "version": "851.27"
+    },
+    "eap8021x": {
+      "hash": "sha256-Ap7qumn/oKYe424n2NW6QkuivgDyLoJgDfl30Q5O7Jo=",
+      "version": "304.100.1"
+    },
+    "hfs": {
+      "hash": "sha256-MSnc1pB8DcB+mn308snTD1uRQ7Ro4aWyFuLdWjHtAG4=",
+      "version": "556.100.11"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-UgmMnDUosaC2yI7IyQ7mkNwZ6/oft77ay+SmGSoycIw=",
+      "version": "79"
+    },
+    "libdispatch": {
+      "hash": "sha256-K8QL9NfjGsj8c0jbocKegmKBqydimpKu8yRXnQQqdH8=",
+      "version": "1271.100.5"
+    },
+    "libmalloc": {
+      "hash": "sha256-k3dJk7S0Lom3B28vRI9QxIuo0AOkd9OHzWO7MandfUw=",
+      "version": "317.100.9"
+    },
+    "libplatform": {
+      "hash": "sha256-BSIGgKj5B6Dr0KQiIl2LSA3+ZEhzk/snQeCauErcq6k=",
+      "version": "254.80.2"
+    },
+    "libpthread": {
+      "hash": "sha256-cGaDXLTztUYppbMvv41qj5RqONXfhfdHpt9dqY6+5Lc=",
+      "version": "454.100.8"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-eqcv174vIwWYXrIhzph+KO1zG8TdK5jRFVgsaAlV9es=",
+      "version": "1310.100.10"
+    },
+    "objc4": {
+      "hash": "sha256-rqOPyN9S4KbMhCCVvtyEmGxTWzy+tsh0kfu3k47szXo=",
+      "version": "818.2"
+    },
+    "ppp": {
+      "hash": "sha256-pSOlu/yXQhopCHDLnmhUnQeU89MkXhkQB0ZrN9r3qyk=",
+      "version": "877.40.2"
+    },
+    "removefile": {
+      "hash": "sha256-B79A9AQ1/cB+zlmVKWcEXVOJHW6rOrX40S/hrMuWqXU=",
+      "version": "49.101.1"
+    },
+    "xnu": {
+      "hash": "sha256-M1XWippH55VUJu4aosRFX8j9aOm/PONYVjPZOPufD80=",
+      "version": "7195.101.1"
+    }
+  }
+}
diff --git a/pkgs/by-name/ap/apple-sdk/metadata/disallowed-packages.json b/pkgs/by-name/ap/apple-sdk/metadata/disallowed-packages.json
new file mode 100644
index 000000000000..4c225b9af1d2
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/metadata/disallowed-packages.json
@@ -0,0 +1,554 @@
+[
+  {
+    "package": "apache",
+    "headers": [
+      "apache2"
+    ]
+  },
+  {
+    "package": "apr",
+    "headers": [
+      "apr-1"
+    ],
+    "libraries": [
+      "libapr-1.*",
+      "libaprutil-1.*"
+    ]
+  },
+  {
+    "package": "boringssl",
+    "libraries": [
+      "libboringssl.*"
+    ]
+  },
+  {
+    "package": "bzip2",
+    "headers": [
+      "bzlib.h"
+    ],
+    "libraries": [
+      "libbz2.*"
+    ]
+  },
+  {
+    "package": "corecrypto",
+    "libraries": [
+      "system/libcorecrypto*"
+    ]
+  },
+  {
+    "package": "Csu",
+    "libraries": [
+      "*.o"
+    ]
+  },
+  {
+    "package": "cups",
+    "headers": [
+      "cups"
+    ],
+    "libraries": [
+      "libcups*"
+    ]
+  },
+  {
+    "package": "curl",
+    "headers": [
+      "curl"
+    ],
+    "libraries": [
+      "libcurl.*"
+    ]
+  },
+  {
+    "package": "cyrus_sasl",
+    "headers": [
+      "sasl"
+    ],
+    "libraries": [
+      "libsasl*"
+    ]
+  },
+  {
+    "package": "dtrace",
+    "headers": [
+      "dtrace.h"
+    ],
+    "libraries": [
+      "*dtrace*"
+    ]
+  },
+  {
+    "package": "editline",
+    "headers": [
+      "editline.h",
+      "editline"
+    ],
+    "libraries": [
+      "libedit.*",
+      "libeditline.*"
+    ]
+  },
+  {
+    "package": "html-tidy",
+    "headers": [
+      "tidy*"
+    ],
+    "libraries": [
+      "libtidy.*"
+    ]
+  },
+  {
+    "package": "hunspell",
+    "headers": [
+      "hunspell"
+    ],
+    "libraries": [
+      "libhunspell*"
+    ]
+  },
+  {
+    "package": "icu",
+    "headers": [
+      "unicode"
+    ],
+    "libraries": [
+      "libicucore.*"
+    ]
+  },
+  {
+    "package": "libarchive",
+    "headers": [
+      "archive.h",
+      "archive_entry.h"
+    ],
+    "libraries": [
+      "libarchive.*"
+    ]
+  },
+  {
+    "package": "libc++",
+    "headers": [
+      "c++",
+      "cxxabi.h",
+      "__cxxabi_config.h"
+    ],
+    "libraries": [
+      "libc++*"
+    ]
+  },
+  {
+    "package": "ld64",
+    "libraries": [
+      "libcodedirectory.*",
+      "libcodedirectory_static.*"
+    ]
+  },
+  {
+    "package": "expat",
+    "headers": [
+      "expat.h",
+      "expat_config.h",
+      "expat_external.h"
+    ],
+    "libraries": [
+      "libexpat.*"
+    ]
+  },
+  {
+    "package": "libffi",
+    "headers": [
+      "ffi*"
+    ],
+    "libraries": [
+      "libffi*"
+    ]
+  },
+  {
+    "package": "libgcc",
+    "libraries": [
+      "libgcc*"
+    ]
+  },
+  {
+    "package": "libiconv",
+    "headers": [
+      "iconv.h",
+      "libcharset.h",
+      "localcharset.h"
+    ],
+    "libraries": [
+      "libcharset.*",
+      "libiconv.*",
+      "i18n"
+    ]
+  },
+  {
+    "package": "libiodbc",
+    "libraries": [
+      "libiodbc*"
+    ]
+  },
+  {
+    "package": "libkrb4",
+    "libraries": [
+      "libkrb4.*"
+    ]
+  },
+  {
+    "package": "libkrb5",
+    "headers": [
+      "com_err.h",
+      "gssapi",
+      "gssapi.h",
+      "gssrpc",
+      "kadm5",
+      "kdb.h",
+      "krad.h",
+      "krb5",
+      "krb5.h",
+      "profile.h",
+      "verto-module.h",
+      "verto.h"
+    ],
+    "libraries": [
+      "krb5",
+      "libcom_err.*",
+      "libgssapi_krb5.*",
+      "libgssrpc.*",
+      "libk5crypto.*",
+      "libkadm5clnt.*",
+      "libkadm5clnt_mit.*",
+      "libkadm5srv.*",
+      "libkadm5srv_mit.*",
+      "libkdb5.*",
+      "libkrad.*",
+      "libkrb5*",
+      "libkrb5support.*",
+      "libverto.*"
+    ]
+  },
+  {
+    "package": "libpcap",
+    "headers": [
+      "pcap*"
+    ],
+    "libraries": [
+      "libpcap.*"
+    ]
+  },
+  {
+    "package": "libresolv",
+    "headers": [
+      "arpa/nameser.h",
+      "arpa/nameser_compat.h",
+      "dns.h",
+      "dns_util.h",
+      "nameser.h",
+      "resolv.h"
+    ],
+    "libraries": [
+      "libresolv.*"
+    ]
+  },
+  {
+    "package": "libstdc++",
+    "libraries": [
+      "libstdc++.*"
+    ]
+  },
+  {
+    "package": "libsbuf",
+    "headers": [
+      "usbuf.h"
+    ],
+    "libraries": [
+      "libsbuf.*"
+    ]
+  },
+  {
+    "package": "libtermcap",
+    "headers": [
+      "termcap.h"
+    ],
+    "libraries": [
+      "libtermcap.*"
+    ]
+  },
+  {
+    "package": "libutil",
+    "headers": [
+      "libutil.h"
+    ],
+    "libraries": [
+      "libutil.*",
+      "libutil1.*"
+    ]
+  },
+  {
+    "package": "libxml2",
+    "headers": [
+      "libxml",
+      "libxml2"
+    ],
+    "libraries": [
+      "libxml2.*"
+    ]
+  },
+  {
+    "package": "libxo",
+    "headers": [
+      "libxo"
+    ],
+    "libraries": [
+      "libxo.*"
+    ]
+  },
+  {
+    "package": "libxslt",
+    "headers": [
+      "libexslt",
+      "libxslt"
+    ],
+    "libraries": [
+      "libexslt.*",
+      "libxslt.*"
+    ]
+  },
+  {
+    "package": "liby",
+    "libraries": [
+      "liby.a"
+    ]
+  },
+  {
+    "package": "marisa-trie",
+    "libraries": [
+      "libmarisa.*"
+    ]
+  },
+  {
+    "package": "ncurses",
+    "headers": [
+      "curses*",
+      "cursslk.h",
+      "eti.h",
+      "etip.h",
+      "form.h",
+      "menu.h",
+      "nc_tparm.h",
+      "ncurses*",
+      "panel.h",
+      "term.h",
+      "term_entry.h",
+      "termcap.h",
+      "tic.h",
+      "unctrl.h"
+    ],
+    "libraries": [
+      "libcurses.*",
+      "libform.*",
+      "libformw.*",
+      "libmenu.*",
+      "libmenuw.*",
+      "libncurses.*",
+      "libncursesw.*",
+      "libpanel.*",
+      "libpanelw.*",
+      "libtinfo.*"
+    ]
+  },
+  {
+    "package": "net-snmp",
+    "headers": [
+      "net-snmp"
+    ],
+    "libraries": [
+      "libnetsnmp*"
+    ]
+  },
+  {
+    "package": "nghttp",
+    "libraries": [
+      "lib*nghttp2.*"
+    ]
+  },
+  {
+    "package": "openblas",
+    "headers": [
+      "cblas.h",
+      "f77blas.h",
+      "lapack.h",
+      "lapacke.h",
+      "lapacke_config.h",
+      "lapacke_mangling.h",
+      "lapacke_utils.h",
+      "openblas_config.h"
+    ],
+    "libraries": [
+      "libblas.*",
+      "libcblas.*",
+      "libclapack.*",
+      "libf77lapack.*",
+      "liblapack.*",
+      "liblapacke.*",
+      "libopenblas.*",
+      "libopenblas.*",
+      "libopenblasp*"
+    ]
+  },
+  {
+    "package": "openldap",
+    "headers": [
+      "lber.h",
+      "lber_types.h",
+      "ldap.h",
+      "ldap_cdefs.h",
+      "ldap_features.h",
+      "ldap_schema.h",
+      "ldap_utf8.h",
+      "ldif.h",
+      "openldap.h",
+      "slapi-plugin.h"
+    ],
+    "libraries": [
+      "liblber.*",
+      "liblber_r.*",
+      "libldap.*",
+      "libldap_r.*"
+    ]
+  },
+  {
+    "package": "openpam",
+    "headers": [
+      "security"
+    ],
+    "libraries": [
+      "libpam.*",
+      "pam_*"
+    ]
+  },
+  {
+    "package": "pcre",
+    "headers": [
+      "pcre.h",
+      "pcreposix.h"
+    ],
+    "libraries": [
+      "libpcre.*",
+      "libpcre2*",
+      "libpcreposix.*"
+    ]
+  },
+  {
+    "package": "php",
+    "headers": [
+      "php"
+    ],
+    "libraries": [
+      "php"
+    ]
+  },
+  {
+    "package": "postgresql",
+    "libraries": [
+      "libecpg*",
+      "libpg*",
+      "libpq*"
+    ]
+  },
+  {
+    "package": "python",
+    "headers": [
+      "python*"
+    ],
+    "frameworks": [
+      "Python.framework"
+    ],
+    "libraries": [
+      "libpython*",
+      "python*"
+    ]
+  },
+  {
+    "package": "readline",
+    "headers": [
+      "readline"
+    ],
+    "libraries": [
+      "libhistory.*",
+      "libreadline.*"
+    ]
+  },
+  {
+    "package": "ruby",
+    "frameworks": [
+      "Ruby.framework"
+    ],
+    "libraries": [
+      "libruby.*",
+      "ruby"
+    ]
+  },
+  {
+    "package": "sqlite3",
+    "headers": [
+      "sqlite3.h",
+      "sqlite3ext.h"
+    ],
+    "libraries": [
+      "libsqlite3.*"
+    ]
+  },
+  {
+    "package": "swift",
+    "libraries": [
+      "swift/shims"
+    ]
+  },
+  {
+    "package": "tcl",
+    "headers": [
+      "tcl*",
+      "tk*"
+    ],
+    "frameworks": [
+      "Tcl.framework",
+      "Tk.framework"
+    ],
+    "libraries": [
+      "libtcl*",
+      "libtk*",
+      "tclConfig.sh",
+      "tkConfig.sh"
+    ]
+  },
+  {
+    "package": "xar",
+    "headers": [
+      "xar"
+    ],
+    "libraries": [
+      "libxar.*"
+    ]
+  },
+  {
+    "package": "xz",
+    "headers": [
+      "lzma*"
+    ],
+    "libraries": [
+      "liblzma.*"
+    ]
+  },
+  {
+    "package": "zlib",
+    "headers": [
+      "zconf.h",
+      "zlib.h"
+    ],
+    "libraries": [
+      "libz.*"
+    ]
+  }
+]
diff --git a/pkgs/by-name/ap/apple-sdk/metadata/versions.json b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
new file mode 100644
index 000000000000..3b7f086c5544
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
@@ -0,0 +1,12 @@
+{
+  "10.12": {
+    "url": "http://swcdn.apple.com/content/downloads/22/62/041-88607/wg8avdk0jo75k9a13gentz9stwqgrqmcv6/CLTools_SDK_OSX1012.pkg",
+    "version": "10.12.2",
+    "hash": "sha256-Jf2WIB9bY/rPwe0AOW3YWJY/6EqVe41yhezdTGOO3M8="
+  },
+  "11": {
+    "url": "https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg",
+    "version": "11.3",
+    "hash": "sha256-/go8utcx3jprf6c8V/DUbXwsmNYSFchOAai1OaJs3Bg="
+  }
+}
diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
new file mode 100644
index 000000000000..2fb57182001c
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -0,0 +1,120 @@
+let
+  sdkVersions = builtins.fromJSON (builtins.readFile ./metadata/versions.json);
+in
+
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  substitute,
+
+  # Specifies the major version used for the SDK. Uses `hostPlatform.darwinSdkVersion` by default.
+  darwinSdkMajorVersion ? (
+    if lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11" then
+      lib.versions.majorMinor stdenv.hostPlatform.darwinSdkVersion
+    else
+      lib.versions.major stdenv.hostPlatform.darwinSdkVersion
+  ),
+  # Enabling bootstrap disables propagation. Defaults to `false` (meaning to propagate certain packages and `xcrun`)
+  # except in stage0 of the Darwin stdenv bootstrap.
+  enableBootstrap ? stdenv.name == "bootstrap-stage0-stdenv-darwin",
+
+  # Required by various phases
+  callPackage,
+  jq,
+}:
+
+let
+  sdkInfo =
+    sdkVersions.${darwinSdkMajorVersion}
+      or (lib.throw "Unsupported SDK major version: ${darwinSdkMajorVersion}");
+  sdkVersion = sdkInfo.version;
+
+  fetchSDK = callPackage ./common/fetch-sdk.nix { };
+
+  phases = lib.composeManyExtensions (
+    [
+      (callPackage ./common/add-core-symbolication.nix { })
+      (callPackage ./common/derivation-options.nix { })
+      (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
+      (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
+      (callPackage ./common/remove-disallowed-packages.nix { })
+    ]
+    # Only process stubs and convert them to tbd-v4 if jq is available. This can be made unconditional once
+    # the bootstrap tools have jq and libtapi.
+    ++ lib.optional (jq != null) (callPackage ./common/process-stubs.nix { })
+    # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
+    ++ lib.optionals (!enableBootstrap) [
+      (callPackage ./common/propagate-inputs.nix { })
+      (callPackage ./common/propagate-xcrun.nix { })
+    ]
+    ++ [
+      # These have to happen last.
+      (callPackage ./common/rewrite-sdk-paths.nix { inherit sdkVersion; })
+      (callPackage ./common/run-build-phase-hooks.nix { })
+    ]
+  );
+in
+stdenvNoCC.mkDerivation (
+  lib.extends phases (finalAttrs: {
+    pname = "apple-sdk";
+    inherit (sdkInfo) version;
+
+    src = fetchSDK sdkInfo;
+
+    dontConfigure = true;
+
+    strictDeps = true;
+
+    setupHooks = [
+      # `role.bash` is copied from `../build-support/setup-hooks/role.bash` due to the requirements not to reference
+      # paths outside the package when it is in `by-name`.  It needs to be kept in sync, but it fortunately does not
+      # change often. Once `build-support` is available as a package (or some other mechanism), it should be changed
+      # to whatever that replacement is.
+      ./setup-hooks/role.bash
+      (substitute {
+        src = ./setup-hooks/sdk-hook.sh;
+        substitutions = [
+          "--subst-var-by"
+          "sdkVersion"
+          (lib.escapeShellArgs (lib.splitVersion sdkVersion))
+        ];
+      })
+    ];
+
+    installPhase =
+      let
+        sdkName = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+        sdkMajor = lib.versions.major sdkVersion;
+      in
+      ''
+        runHook preInstall
+
+        mkdir -p "$sdkpath"
+
+        cp -rd . "$sdkpath/${sdkName}"
+        ${lib.optionalString (lib.versionAtLeast finalAttrs.version "11.0") ''
+          ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
+        ''}
+        ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
+
+        runHook postInstall
+      '';
+
+    passthru = {
+      sdkroot = finalAttrs.finalPackage + "/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
+    };
+
+    __structuredAttrs = true;
+
+    meta = {
+      description = "Frameworks and libraries required for building packages on Darwin";
+      homepage = "https://developer.apple.com";
+      maintainers = lib.teams.darwin.members;
+      platforms = lib.platforms.darwin;
+      badPlatforms =
+        lib.optionals (lib.versionAtLeast sdkVersion "10.15") [ lib.systems.inspect.patterns.is32bit ]
+        ++ lib.optionals (lib.versionOlder sdkVersion "11.0") [ lib.systems.inspect.patterns.isAarch ];
+    };
+  })
+)
diff --git a/pkgs/by-name/ap/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch b/pkgs/by-name/ap/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
new file mode 100644
index 000000000000..681970cb2f71
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
@@ -0,0 +1,48 @@
+From 6531da946949a94643e6d8424236174ae64fe0ca Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sat, 30 Sep 2023 18:02:39 -0400
+Subject: [PATCH 1/2] Add function definitions needed to build zlog in
+ system_cmds
+
+---
+ CoreSymbolication.h | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index a413860..f3cf63f 100644
+--- a/CoreSymbolication.h
++++ b/CoreSymbolication.h
+@@ -324,7 +324,9 @@ CSSymbolOwnerEditRelocations
+ CSSymbolOwnerForeachRegion
+ CSSymbolOwnerForeachRegionWithName
+ CSSymbolOwnerForeachSection
+-CSSymbolOwnerForeachSegment
++*/
++void CSSymbolOwnerForeachSegment(CSSymbolOwnerRef owner, void (^block)(CSSegmentRef));
++/*
+ CSSymbolOwnerForeachSourceInfo
+ CSSymbolOwnerForeachSymbol
+  */
+@@ -333,7 +335,9 @@ void CSSymbolOwnerForeachSymbolWithName(CSSymbolOwnerRef owner,  const char *sna
+ /*
+ CSSymbolOwnerGetArchitecture
+ CSSymbolOwnerGetBaseAddress
+-CSSymbolOwnerGetCFUUIDBytes
++*/
++const CFUUIDBytes* CSSymbolOwnerGetCFUUIDBytes(CSSymbolOwnerRef owner);
++/*
+ CSSymbolOwnerGetCompatibilityVersion
+ CSSymbolOwnerGetCurrentVersion
+ CSSymbolOwnerGetDataFlags
+@@ -390,7 +394,7 @@ CSSymbolOwnerSetLoadTimestamp
+ CSSymbolOwnerSetPath
+ CSSymbolOwnerSetRelocationCount
+  */
+-CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
++void CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
+  /*
+ CSSymbolOwnerSetUnloadTimestamp
+ */
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/ap/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch b/pkgs/by-name/ap/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch
new file mode 100644
index 000000000000..01f934be6ef4
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch
@@ -0,0 +1,45 @@
+From ae7ac6a7043dbae8e63d6ce5e63dfaf02b5977fe Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sat, 30 Sep 2023 18:37:18 -0400
+Subject: [PATCH 2/2] Add CF_EXPORT To const symbols
+
+---
+ CoreSymbolication.h | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index f3cf63f..4124a54 100644
+--- a/CoreSymbolication.h
++++ b/CoreSymbolication.h
+@@ -49,6 +49,7 @@
+ 
+ 
+ #include <CoreFoundation/CoreFoundation.h>
++#include <CoreFoundation/CFBase.h>
+ #include <mach/mach.h>
+ 
+ 
+@@ -139,13 +140,13 @@ typedef void (^CSSegmentIterator)(CSSegmentRef segment);
+  * External symbols
+  */
+ 
+-const char* kCSRegionMachHeaderName;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
+-const CSSetCallBacks kCSTypeSetCallBacks;
+-const CSSetCallBacks kCSTypeSetWeakCallBacks;
++CF_EXPORT const char* kCSRegionMachHeaderName;
++CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
++CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
++CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
++CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
++CF_EXPORT const CSSetCallBacks kCSTypeSetCallBacks;
++CF_EXPORT const CSSetCallBacks kCSTypeSetWeakCallBacks;
+ 
+ 
+ /*
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/ap/apple-sdk/scripts/get-sdks-from-catalog.sh b/pkgs/by-name/ap/apple-sdk/scripts/get-sdks-from-catalog.sh
new file mode 100755
index 000000000000..1293fab11cc9
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/scripts/get-sdks-from-catalog.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl file gzip jq xcbuild yq
+
+set -eu -o pipefail
+
+catalog=${1-}
+
+if [ -z "$catalog" ]; then
+    echo "usage: get-sdks-from-catalog.sh <catalog>"
+    echo " <catalog>   Apple software update catalog (may be gzipped)" >&2
+    exit 1
+fi
+
+scratch=$(mktemp)
+trap 'rm -f -- "$scratch"' EXIT
+
+if [[ "$(file "$catalog")" =~ gzip ]]; then
+    gzcat "$catalog" > "$scratch"
+else
+    cp --reflink=auto "$catalog" "$scratch"
+fi
+
+# Grab all SDK packages from the catalog
+filter='.Products[].Packages[] | select(.URL | test(".*CLTools_macOSNMOS_SDK.pkg")) | "\(.URL)|\(.MetadataURL)"'
+
+declare -A package_list
+for package in $(plutil -convert json -o - "$scratch" | jq -r "$filter"); do
+    package_list[${package%%|*}]=${package#*|}
+done
+
+truncate --size 0 "$scratch"
+for pkg in "${!package_list[@]}"; do
+    ver=$(curl --silent "${package_list[$pkg]}" | xq -r '."pkg-info"."@version"')
+    echo "{\"url\": \"$pkg\", \"version\": \"$(cut -d. -f1-3 <<< "$ver")\", \"long_version\": \"$ver\"}" >> "$scratch"
+done
+
+jq -r --slurp '
+    group_by(.version | split(".")[0])
+    | map(max_by(.version))
+    | sort_by(.version)[]
+    | "Package URL: \(.url)\n  Xcode Ver: \(.version) (\(.long_version))\n"' "$scratch"
diff --git a/pkgs/by-name/ap/apple-sdk/scripts/lock-sdk-deps.sh b/pkgs/by-name/ap/apple-sdk/scripts/lock-sdk-deps.sh
new file mode 100755
index 000000000000..ce2c1f1aeb53
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/scripts/lock-sdk-deps.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl git gnutar jq moreutils nix
+
+set -eu -o pipefail
+
+if [ ! -v 2 ]; then
+    echo "usage: lock-sdk-deps.sh <SDK version> <Packages>" >&2
+    echo " <SDK version>   Decimal-separated version number." >&2
+    echo "                 Must correspond to a tag in https://github.com/apple-oss-distributions/distribution-macOS" >&2
+    echo " <Packages>      List of packages from the distributions-macOS repository." >&2
+    echo "                 Packages not in the repository at the tag for <SDK version> will be ignored."
+    exit 1
+fi
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+lockfile=$pkgdir/metadata/apple-oss-lockfile.json
+if [ ! -e "$lockfile" ]; then
+    touch "$lockfile"
+fi
+
+workdir=$(mktemp -d)
+trap 'rm -rf -- "$workdir"' EXIT
+
+sdkVersion=$1; shift
+tag="macos-${sdkVersion//.}"
+
+declare -a packages=("$@")
+
+echo "Locking versions for macOS $sdkVersion using tag '$tag'..."
+
+pushd "$workdir" > /dev/null
+
+git clone --branch "$tag" https://github.com/apple-oss-distributions/distribution-macOS.git &> /dev/null
+cd distribution-macOS
+
+for package in "${packages[@]}"; do
+    # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from Github.
+    packageTag=$(jq -r --arg package "$package" '.projects[] | select(.project == $package) | .tag' release.json)
+    packageCommit=$(git ls-tree -d HEAD "$package" | awk '{print $3}')
+
+    if [ ! -d "$package" ]; then
+        packageCommit=HEAD
+    fi
+
+    # However, sometimes it doesn’t exist. In that case, fall back to cloning the repo and check manually
+    # which tag corresponds to the commit from the submodule.
+    if [ -z "$packageTag" ]; then
+        git clone --no-checkout "https://github.com/apple-oss-distributions/$package.git" ../source &> /dev/null
+        pushd ../source > /dev/null
+        packageTag=$(git tag --points-at "$packageCommit")
+        popd > /dev/null
+        rm -rf ../source
+    fi
+
+    packageVersion=${packageTag##"$package"-}
+
+    curl -OL "https://github.com/apple-oss-distributions/$package/archive/$packageTag.tar.gz" &> /dev/null
+    tar axf "$packageTag.tar.gz"
+
+    packageHash=$(nix --extra-experimental-features nix-command hash path "$package-$packageTag")
+
+    pkgsjson="{\"$package\": {\"version\": \"$packageVersion\", \"hash\": \"$packageHash\"}}"
+
+    echo "   - Locking $package to version $packageVersion with hash '$packageHash'"
+    jq --argjson pkg "$pkgsjson" -S '. * $pkg' "$lockfile" | sponge "$lockfile"
+done
+
+popd > /dev/null
diff --git a/pkgs/by-name/ap/apple-sdk/scripts/regenerate-lockfile.sh b/pkgs/by-name/ap/apple-sdk/scripts/regenerate-lockfile.sh
new file mode 100755
index 000000000000..3922916e6135
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/scripts/regenerate-lockfile.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils jq
+
+set -eu -o pipefail
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+echo '{}' > "$pkgdir/metadata/apple-oss-lockfile.json"
+
+declare -a versions
+readarray -t versions < <(jq -r '.[].version' "$pkgdir/metadata/versions.json")
+
+declare -a packages=(
+    CarbonHeaders
+    CommonCrypto
+    IOAudioFamily
+    IOFireWireFamily
+    IOFWDVComponents
+    IOFireWireAVC
+    IOFireWireSBP2
+    IOFireWireSerialBusProtocolTransport
+    IOGraphics
+    IOHIDFamily
+    IONetworkingFamily
+    IOSerialFamily
+    IOStorageFamily
+    IOBDStorageFamily
+    IOCDStorageFamily
+    IODVDStorageFamily
+    IOUSBFamily
+    IOKitUser
+    Libc
+    Libinfo
+    Libm
+    Libnotify
+    Librpcsvc
+    Libsystem
+    OpenDirectory
+    Security
+    architecture
+    configd
+    copyfile
+    dtrace
+    dyld
+    eap8021x
+    hfs
+    launchd
+    libclosure
+    libdispatch
+    libmalloc
+    libplatform
+    libpthread
+    mDNSResponder
+    objc4
+    ppp
+    removefile
+    xnu
+)
+
+for version in "${versions[@]}"; do
+    "$pkgdir/scripts/lock-sdk-deps.sh" "$version" "${packages[@]}"
+done
diff --git a/pkgs/by-name/ap/apple-sdk/setup-hooks/add-private-frameworks.sh b/pkgs/by-name/ap/apple-sdk/setup-hooks/add-private-frameworks.sh
new file mode 100644
index 000000000000..d5c48e3dd879
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/setup-hooks/add-private-frameworks.sh
@@ -0,0 +1,6 @@
+function enablePrivateFrameworks() {
+    export NIX_CFLAGS_COMPILE+=" -iframework $DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+    export NIX_LDFLAGS+=" -F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+}
+
+preConfigureHooks+=(enablePrivateFrameworks)
diff --git a/pkgs/by-name/ap/apple-sdk/setup-hooks/role.bash b/pkgs/by-name/ap/apple-sdk/setup-hooks/role.bash
new file mode 100644
index 000000000000..bfd6b61f0aed
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/setup-hooks/role.bash
@@ -0,0 +1,71 @@
+# Since the same derivation can be depended on in multiple ways, we need to
+# accumulate *each* role (i.e. host and target platforms relative the depending
+# derivation) in which the derivation is used.
+#
+# The role is intended to be used as part of other variables names like
+#  - $NIX_SOMETHING${role_post}
+
+function getRole() {
+    case $1 in
+        -1)
+            role_post='_FOR_BUILD'
+            ;;
+        0)
+            role_post=''
+            ;;
+        1)
+            role_post='_FOR_TARGET'
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}
+
+# `hostOffset` describes how the host platform of the package is slid relative
+# to the depending package. `targetOffset` likewise describes the target
+# platform of the package. Both are brought into scope of the setup hook defined
+# for dependency whose setup hook is being processed relative to the package
+# being built.
+
+function getHostRole()   {
+    getRole "$hostOffset"
+}
+function getTargetRole() {
+    getRole "$targetOffset"
+}
+
+# `depHostOffset` describes how the host platform of the dependencies are slid
+# relative to the depending package. `depTargetOffset` likewise describes the
+# target platform of dependenices. Both are brought into scope of the
+# environment hook defined for the dependency being applied relative to the
+# package being built.
+
+function getHostRoleEnvHook()   {
+    getRole "$depHostOffset"
+}
+function getTargetRoleEnvHook() {
+    getRole "$depTargetOffset"
+}
+
+# This variant is intended specifically for code-producing tool wrapper scripts
+# `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
+# env var so can't use fancier data structures).
+function getTargetRoleWrapper() {
+    case $targetOffset in
+        -1)
+            export NIX_@wrapperName@_TARGET_BUILD_@suffixSalt@=1
+            ;;
+        0)
+            export NIX_@wrapperName@_TARGET_HOST_@suffixSalt@=1
+            ;;
+        1)
+            export NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@=1
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}
diff --git a/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh b/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh
new file mode 100644
index 000000000000..62fa8b339a71
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh
@@ -0,0 +1,17 @@
+local role_post
+getHostRole
+
+local sdkVersionVar=NIX_APPLE_SDK_VERSION${role_post}
+local developerDirVar=DEVELOPER_DIR${role_post}
+
+local sdkVersionArr=(@sdkVersion@)
+local sdkVersion
+sdkVersion=$(printf "%02d%02d%02d" "${sdkVersionArr[0]-0}" "${sdkVersionArr[1]-0}" "${sdkVersionArr[2]-0}")
+
+if [ "$sdkVersion" -gt "${!sdkVersionVar-000000}" ]; then
+    export "$developerDirVar"='@out@'
+    export "$sdkVersionVar"="$sdkVersion"
+    export "SDKROOT${role_post}"="${!developerDirVar}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+fi
+
+unset -v role_post developerDirVar sdkVersion sdkVersionArr sdkVersionVar
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd4ca3df70c7..c520299026ae 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23742,6 +23742,9 @@ with pkgs;
 
   ### DEVELOPMENT / LIBRARIES / DARWIN SDKS
 
+  apple-sdk_10_12 = callPackage ../by-name/ap/apple-sdk/package.nix { darwinSdkMajorVersion = "10.12"; };
+  apple-sdk_11 = callPackage ../by-name/ap/apple-sdk/package.nix { darwinSdkMajorVersion = "11"; };
+
   darwinMinVersionHook =
     deploymentTarget:
     makeSetupHook {