From 88e1756bc9ef9faa4a495f92012c6375d52cde61 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 18 Oct 2025 02:53:06 +0100
Subject: [PATCH] darwin.{ditto,sudo}: drop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These were added in <https://github.com/NixOS/nixpkgs/pull/109626> in
2021, and used to provide the definition of `sudo`. That was reverted
shortly after, in <https://github.com/NixOS/nixpkgs/pull/112006>.

While embedding these paths in the output of a derivation is
potentially legitimate, using them as build inputs to other
derivations is not so much; they won’t work in the sandbox, and
using `sudo(8)` in a build especially doesn’t seem like a great
idea. Using `/usr/bin/ditto` directly along with `sandboxProfile` or
`__impureHostDeps` is a better mechanism than a wrapper package if
a build really needs `ditto(1)`.
---
 .../darwin/impure-cmds/default.nix            | 38 -------------------
 pkgs/top-level/darwin-aliases.nix             |  2 +
 pkgs/top-level/darwin-packages.nix            |  6 +--
 3 files changed, 3 insertions(+), 43 deletions(-)
 delete mode 100644 pkgs/os-specific/darwin/impure-cmds/default.nix

diff --git a/pkgs/os-specific/darwin/impure-cmds/default.nix b/pkgs/os-specific/darwin/impure-cmds/default.nix
deleted file mode 100644
index eac4f6b97fd2..000000000000
--- a/pkgs/os-specific/darwin/impure-cmds/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, runCommandLocal }:
-
-# On darwin, there are some commands neither opensource nor able to build in nixpkgs.
-# We have no choice but to use those system-shipped impure ones.
-
-let
-  commands = {
-    ditto = "/usr/bin/ditto"; # ditto is not opensource
-    sudo = "/usr/bin/sudo"; # sudo must be owned by uid 0 and have the setuid bit set
-  };
-
-  mkImpureDrv =
-    name: path:
-    runCommandLocal "${name}-impure-darwin"
-      {
-        __impureHostDeps = [ path ];
-
-        meta = {
-          platforms = lib.platforms.darwin;
-        };
-      }
-      ''
-        if ! [ -x ${path} ]; then
-          echo Cannot find command ${path}
-          exit 1
-        fi
-
-        mkdir -p $out/bin
-        ln -s ${path} $out/bin
-
-        manpage="/usr/share/man/man1/${name}.1"
-        if [ -f $manpage ]; then
-          mkdir -p $out/share/man/man1
-          ln -s $manpage $out/share/man/man1
-        fi
-      '';
-in
-lib.mapAttrs mkImpureDrv commands
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 717f2f58763a..cb0f6d7c6d47 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -116,6 +116,7 @@ stubs
   ### D ###
 
   discrete-scroll = pkgs.discrete-scroll; # added 2024-11-27
+  ditto = throw "'darwin.ditto' has been removed, because it was impure and unused"; # added 2025-10-18
 
   ### I ###
 
@@ -150,5 +151,6 @@ stubs
 
   stdenvNoCF = throw "darwin.stdenvNoCF has been removed; use `stdenv` or `stdenvNoCC`"; # converted to throw 2025-07-29
   stubs = throw "'darwin.stubs.*' have been removed as they were unused"; # added 2025-04-20
+  sudo = throw "'darwin.sudo' has been removed, because it was impure and unused"; # added 2025-10-18
   swift-corelibs-foundation = throw "'darwin.swift-corelibs-foundation' has been removed, as it was broken and is no longer used"; # added 2025-04-20
 }
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 9adaebefedc5..d107ba471187 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -39,14 +39,10 @@ makeScopeWithSplicing' {
         callPackage = self.callPackage;
         directory = ../os-specific/darwin/apple-source-releases;
       };
-
-      # Must use pkgs.callPackage to avoid infinite recursion.
-      impure-cmds = pkgs.callPackage ../os-specific/darwin/impure-cmds { };
     in
 
     lib.recurseIntoAttrs (
-      impure-cmds
-      // apple-source-packages
+      apple-source-packages
       // {
 
         inherit (self.adv_cmds) ps;