From 9315b841a7c7ee27b2be453a641ee79b76eddf5c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Jul 2026 03:32:53 +0200
Subject: [PATCH] gst_all_1.gst-plugins-bad: work around `ld64` hardening issue

---
 pkgs/development/libraries/gstreamer/bad/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 463e73d32190..743c769e2047 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -112,6 +112,8 @@
   guiSupport ? false,
   gst-plugins-bad,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -156,6 +158,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (gst-plugins-base.waylandEnabled && stdenv.hostPlatform.isLinux) [
     wayland-scanner
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -408,6 +414,9 @@ stdenv.mkDerivation (finalAttrs: {
   # that trip up clang with format security enabled.
   hardeningDisable = [ "format" ];
 
+  # TODO: Clean up on `staging`.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   doCheck = false; # fails 20 out of 58 tests, expensive
 
   preFixup = ''