From e53453bc1bb2ba77b8fb70ed6a3a093d0ae6dc0f Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:23 -0700
Subject: [PATCH 1/3] xquartz: properly replace X utility paths

---
 pkgs/by-name/xq/xquartz/package.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/xq/xquartz/package.nix b/pkgs/by-name/xq/xquartz/package.nix
index a3a33b92d458..008e213e97e4 100644
--- a/pkgs/by-name/xq/xquartz/package.nix
+++ b/pkgs/by-name/xq/xquartz/package.nix
@@ -240,12 +240,12 @@ stdenv.mkDerivation {
     cp ${fontsConf} $fontsConfPath
 
     substituteInPlace $out/bin/startx \
-      --replace "bindir=${xinit}/bin" "bindir=$out/bin" \
-      --replace 'defaultserver=${xorg-server}/bin/X' "defaultserver=$out/bin/Xquartz" \
-      --replace "${xinit}" "$out" \
-      --replace "${xorg-server}" "$out" \
-      --replace "eval xinit" "eval $out/bin/xinit" \
-      --replace "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
+      --replace-fail "${xinit}" "$out" \
+      --replace-fail "xserver=\"${xorg-server}/bin/X\"" "xserver=\"$out/bin/Xquartz\"" \
+      --replace-fail 'xinit="xinit"' "xinit=$out/bin/xinit" \
+      --replace-fail '"xauth"' "${lib.getExe xauth}" \
+      --replace-fail "xauth " '"$xauth" ' \
+      --replace-fail "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
 
     wrapProgram $out/bin/Xquartz \
       --set XQUARTZ_APP $out/Applications/XQuartz.app
@@ -262,9 +262,9 @@ stdenv.mkDerivation {
     EOF
 
     substituteInPlace $out/etc/X11/xinit/xinitrc \
-      --replace ${xinit} $out \
-      --replace xmodmap ${xmodmap}/bin/xmodmap \
-      --replace xrdb ${xrdb}/bin/xrdb
+      --replace-fail ${xinit} $out \
+      --replace-fail '"xmodmap"' ${xmodmap}/bin/xmodmap \
+      --replace-fail '"xrdb"' ${xrdb}/bin/xrdb
 
     mkdir -p $out/etc/X11/xinit/xinitrc.d
 
@@ -281,7 +281,7 @@ stdenv.mkDerivation {
     chmod +x $out/etc/X11/xinit/xinitrc.d/99-quartz-wm.sh
 
     substituteInPlace $out/etc/X11/xinit/privileged_startx.d/20-font_cache \
-      --replace ${xinit} $out
+      --replace-fail ${xinit} $out
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \

From eb4202e42878c3674857e2d85da9f6d5edd7c129 Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:23 -0700
Subject: [PATCH 2/3] xorg-server: enable SECURITY module on darwin

This is required for `ssh -X` to work properly.
---
 pkgs/by-name/xo/xorg-server/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 270f23950dbf..05def6678eba 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -152,8 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dxkb_bin_dir=${xkbcomp}/bin"
     "-Dxkb_dir=${xkeyboard-config}/share/X11/xkb"
     "-Dxkb_output_dir=$out/share/X11/xkb/compiled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+
     "-Dxcsecurity=true"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

From 44f293318432773f7f200d3e5440d75e2ede37bf Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:24 -0700
Subject: [PATCH 3/3] xorg-server: disable false positive buffer overrun check

The bounds checks introduced by `-D_FORTIFY_SOURCE=2` in functions
like `strlcpy` interact poorly with data structures that treat fixed
sized arrays as flexible arrays (e.g. `struct sockaddr`).  This bug
manifested as an endless crashloop in XQuartz.

See also https://github.com/llvm/llvm-project/issues/29694
---
 pkgs/by-name/xo/xorg-server/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 05def6678eba..b9028ccbbe4c 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -176,6 +176,9 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
   '';
 
+  # avoid linux rebuilds
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
+
   # default X install symlinks this to Xorg, we want XQuartz
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -sf $out/bin/Xquartz $out/bin/X