From 636104f2d93f1b777bb97f898d2603db51d90f76 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 01:52:22 -0700 Subject: [PATCH 1/8] macvim: work around Xcode 26.0 bug Xcode 26.0 sets `*_DEPLOYMENT_TARGET` env vars for all platforms in shell script build phases, which breaks invocations of clang from those phases, as they target the wrong platform. --- pkgs/applications/editors/vim/macvim.nix | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index fcb8a7de920e..a4c87e2283bd 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -92,6 +92,13 @@ stdenv.mkDerivation (finalAttrs: { postPatch = '' echo "Patching file src/MacVim/MacVim.xcodeproj/project.pbxproj" sed -e '/Sparkle\.framework/d' -i src/MacVim/MacVim.xcodeproj/project.pbxproj + '' + # Xcode 26.0 sets *_DEPLOYMENT_TARGET env vars for all platforms in shell script build phases. + # This breaks invocations of clang in those phases, as they target the wrong platform. + # Note: The shell script build phase in question uses /bin/zsh. + + '' + substituteInPlace src/MacVim/MacVim.xcodeproj/project.pbxproj \ + --replace-fail 'make \' $'for x in ''${(k)parameters}; do if [[ $x = *_DEPLOYMENT_TARGET ]]; then [[ $x = MACOSX_DEPLOYMENT_TARGET ]] || unset $x; fi; done\nmake \\' ''; # This is unfortunate, but we need to use the same compiler as Xcode, but Xcode doesn't provide a @@ -149,9 +156,9 @@ stdenv.mkDerivation (finalAttrs: { # Xcode project or pass it as a flag to xcodebuild as well. postConfigure = '' substituteInPlace src/auto/config.mk \ - --replace " -L${stdenv.cc.libc}/lib" "" \ - --replace " -L${darwin.libunwind}/lib" "" \ - --replace " -L${libiconv}/lib" "" + --replace-warn " -L${stdenv.cc.libc}/lib" "" \ + --replace-warn " -L${darwin.libunwind}/lib" "" \ + --replace-warn " -L${libiconv}/lib" "" # All the libraries we stripped have -osx- in their name as of this time. # Assert now that this pattern no longer appears in config.mk. From 427a98e1292d7cb6a1693af54b8176fb184e6cc6 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 01:52:22 -0700 Subject: [PATCH 2/8] macvim: delete incorrect manpages We don't provide `eview` so we need to get rid of that manpage, and there's also a bad `man/man1/mvim.1` symlink that goes nowhere. --- pkgs/applications/editors/vim/macvim.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index a4c87e2283bd..cb6c36d51451 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -203,7 +203,8 @@ stdenv.mkDerivation (finalAttrs: { install_name_tool -add_rpath ${ruby}/lib $exe # Remove manpages from tools we aren't providing - find $out/Applications/MacVim.app/Contents/man -name evim.1 -delete + find $out/Applications/MacVim.app/Contents/man \( -name evim.1 -or -name eview.1 \) -delete + rm $out/Applications/MacVim.app/Contents/man/man1/mvim.1 ''; # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and From 3693c2dc20c98f22c05bd43130079d14bd68ad39 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 01:52:22 -0700 Subject: [PATCH 3/8] macvim: ensure we can change install names Pass `-headerpad_max_install_names` again. This is something we used to do, and then the flag got removed at some point. For some reason we need to provide it both to configure and to Xcode. --- pkgs/applications/editors/vim/macvim.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index cb6c36d51451..85aab70ef948 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -108,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: { let # ideally we'd recurse, but we don't need that right now inputs = [ ncurses ] ++ perl.propagatedBuildInputs; - ldflags = map (drv: "-L${lib.getLib drv}/lib") inputs; + ldflags = map (drv: "-L${lib.getLib drv}/lib") inputs ++ [ "-headerpad_max_install_names" ]; cppflags = map (drv: "-isystem ${lib.getDev drv}/include") inputs; in '' @@ -138,7 +138,7 @@ stdenv.mkDerivation (finalAttrs: { # as the scheme seems to have the wrong default. + '' configureFlagsArray+=( - XCODEFLAGS="-scheme MacVim -derivedDataPath $NIX_BUILD_TOP/derivedData" + XCODEFLAGS="-scheme MacVim -derivedDataPath $NIX_BUILD_TOP/derivedData LDFLAGS='\$(inherited) -headerpad_max_install_names' ENABLE_CODE_COVERAGE=NO" --with-xcodecfg="Release" ) ''; From f7c3c92c7a4b2180c0a50abad7f6e0e65c79da03 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 01:52:22 -0700 Subject: [PATCH 4/8] macvim: resign the binary on aarch64-darwin We need to resign the binary after running `install_name_tool` or it will have an invalid code signature. --- pkgs/applications/editors/vim/macvim.nix | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index 85aab70ef948..9b0dcb4df47c 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -14,8 +14,13 @@ darwin, libiconv, python3, + rcodesign, }: +let + inherit (lib) optional optionalString; +in + # Try to match MacVim's documented script interface compatibility let #perl = perl540; @@ -49,7 +54,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ pkg-config buildSymlinks - ]; + ] + ++ optional stdenv.isAarch64 rcodesign; buildInputs = [ gettext ncurses @@ -205,6 +211,10 @@ stdenv.mkDerivation (finalAttrs: { # Remove manpages from tools we aren't providing find $out/Applications/MacVim.app/Contents/man \( -name evim.1 -or -name eview.1 \) -delete rm $out/Applications/MacVim.app/Contents/man/man1/mvim.1 + '' + + optionalString stdenv.isAarch64 '' + # Resign the binary and set the linker-signed flag. + rcodesign sign --code-signature-flags linker-signed $exe ''; # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and From c06af958dcdd1dd05f2b3ef0ac9505bcbce5470d Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 01:43:22 -0700 Subject: [PATCH 5/8] macvim: disable python support by default MacVim currently fails to link against nixpkgs python because Xcode's clang doesn't understand the LLVM bitcode in the `libpython${pythonVersion}.a` static library. I'm not sure what this static library is for when `lib/libpython${pythonVersion}.dylib` exists, but I don't know of a way to tell MacVim to ignore it. Linking against python works if we rebuild python to skip the static library but that doesn't seem like a proper solution, so until a permanent solution is found, just disable python by default. Also mark macvim as no longer broken. --- pkgs/applications/editors/vim/macvim.nix | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index 9b0dcb4df47c..a3c7dabf9b37 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -14,11 +14,12 @@ darwin, libiconv, python3, + enablePython ? false, rcodesign, }: let - inherit (lib) optional optionalString; + inherit (lib) optional optionals optionalString; in # Try to match MacVim's documented script interface compatibility @@ -64,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: { ruby tcl perl - python3 - ]; + ] + ++ optional enablePython python3; patches = [ ./macvim.patch ]; @@ -77,14 +78,22 @@ stdenv.mkDerivation (finalAttrs: { "--enable-multibyte" "--enable-nls" "--enable-luainterp=dynamic" + ] + ++ optionals enablePython [ "--enable-python3interp=dynamic" + ] + ++ [ "--enable-perlinterp=dynamic" "--enable-rubyinterp=dynamic" "--enable-tclinterp=yes" "--without-local-dir" "--with-luajit" "--with-lua-prefix=${luajit}" + ] + ++ optionals enablePython [ "--with-python3-command=${python3}/bin/python3" + ] + ++ [ "--with-ruby-command=${ruby}/bin/ruby" "--with-tclsh=${tcl}/bin/tclsh" "--with-tlib=ncurses" @@ -204,7 +213,11 @@ stdenv.mkDerivation (finalAttrs: { libperl=$(dirname $(find ${perl} -name "libperl.dylib")) install_name_tool -add_rpath ${luajit}/lib $exe install_name_tool -add_rpath ${tcl}/lib $exe + '' + + optionalString enablePython '' install_name_tool -add_rpath ${python3}/lib $exe + '' + + '' install_name_tool -add_rpath $libperl $exe install_name_tool -add_rpath ${ruby}/lib $exe @@ -233,8 +246,6 @@ stdenv.mkDerivation (finalAttrs: { maintainers = [ ]; platforms = platforms.darwin; hydraPlatforms = [ ]; # hydra can't build this as long as we rely on Xcode and sandboxProfile - # Needs updating to a newer MacVim for Python and Ruby version support - broken = true; knownVulnerabilities = [ "CVE-2023-46246" "CVE-2023-48231" From 5ece9f37b1b90898002ee777972b2d1684f84dae Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 02:31:45 -0700 Subject: [PATCH 6/8] macvim: 179 -> 181 Updates macvim to r181, including bumping the Ruby version to 3.4 since that's what MacVim r181 is built against. There's still 3 CVEs in the `knownVulnerabilities` list that are newer than this release, but this is the latest MacVim release available right now. --- pkgs/applications/editors/vim/macvim.nix | 32 ++++------------------ pkgs/applications/editors/vim/macvim.patch | 13 --------- 2 files changed, 5 insertions(+), 40 deletions(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index a3c7dabf9b37..668604968f72 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -7,7 +7,7 @@ gettext, pkg-config, cscope, - ruby, + ruby_3_4, tcl, perl, luajit, @@ -24,9 +24,8 @@ in # Try to match MacVim's documented script interface compatibility let - #perl = perl540; - # Ruby 3.3 - #ruby = ruby_3_3; + # Ruby 3.4 + ruby = ruby_3_4; # Building requires a few system tools to be in PATH. # Some of these we could patch into the relevant source files (such as xcodebuild and @@ -41,13 +40,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "macvim"; - version = "179"; + version = "181"; src = fetchFromGitHub { owner = "macvim-dev"; repo = "macvim"; rev = "release-${finalAttrs.version}"; - hash = "sha256-L9LVXyeA09aMtNf+b/Oo+eLpeVEKTD1/oNWCiFn5FbU="; + hash = "sha256-Wdq+eXSaGs+y+75ZbxoNAcyopRkWRHHRm05T0SHBrow="; }; enableParallelBuilding = true; @@ -247,27 +246,6 @@ stdenv.mkDerivation (finalAttrs: { platforms = platforms.darwin; hydraPlatforms = [ ]; # hydra can't build this as long as we rely on Xcode and sandboxProfile knownVulnerabilities = [ - "CVE-2023-46246" - "CVE-2023-48231" - "CVE-2023-48232" - "CVE-2023-48233" - "CVE-2023-48234" - "CVE-2023-48235" - "CVE-2023-48236" - "CVE-2023-48237" - "CVE-2023-48706" - "CVE-2023-5344" - "CVE-2023-5441" - "CVE-2023-5535" - "CVE-2024-22667" - "CVE-2024-41957" - "CVE-2024-41965" - "CVE-2024-43374" - "CVE-2024-47814" - "CVE-2025-1215" - "CVE-2025-22134" - "CVE-2025-24014" - "CVE-2025-26603" "CVE-2025-29768" "CVE-2025-53905" "CVE-2025-53906" diff --git a/pkgs/applications/editors/vim/macvim.patch b/pkgs/applications/editors/vim/macvim.patch index 223778acf60c..767c59bd154c 100644 --- a/pkgs/applications/editors/vim/macvim.patch +++ b/pkgs/applications/editors/vim/macvim.patch @@ -199,16 +199,3 @@ index 6e33142..6185f45 100644 #ifdef AMIGA # include "os_amiga.h" #endif -diff --git a/src/vimtutor b/src/vimtutor -index 3b154f2..e89f260 100755 ---- a/src/vimtutor -+++ b/src/vimtutor -@@ -16,7 +16,7 @@ seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi" - if test "$1" = "-g"; then - # Try to use the GUI version of Vim if possible, it will fall back - # on Vim if Gvim is not installed. -- seq="gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq" -+ seq="mvim gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq" - shift - fi - From 8b45a0a4f0cea1b9c9e932aca579e75afbac0eb5 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 02:58:18 -0700 Subject: [PATCH 7/8] maintainers: add lilyball --- maintainers/maintainer-list.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 0948524fc6a4..dd68132569b4 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -14728,6 +14728,13 @@ githubId = 54189319; name = "Lilly Cham"; }; + lilyball = { + email = "lily@ballards.net"; + github = "lilyball"; + githubId = 714; + matrix = "@esperlily:matrix.org"; + name = "Lily Ballard"; + }; limeytexan = { email = "limeytexan@gmail.com"; github = "limeytexan"; From f20cb87b0a864f5cfb7af71fbab7e31ae470ec2f Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Thu, 23 Oct 2025 02:59:56 -0700 Subject: [PATCH 8/8] macvim: add lilyball as maintainer --- pkgs/applications/editors/vim/macvim.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index 668604968f72..943fd5b3b29e 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -242,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: { description = "Vim - the text editor - for macOS"; homepage = "https://macvim.org/"; license = licenses.vim; - maintainers = [ ]; + maintainers = with maintainers; [ lilyball ]; platforms = platforms.darwin; hydraPlatforms = [ ]; # hydra can't build this as long as we rely on Xcode and sandboxProfile knownVulnerabilities = [