darwin.system_cmds: 1012.60.2 -> 1026.140.2

https://github.com/apple-oss-distributions/system_cmds/compare/system_cmds-1012.60.2...system_cmds-1026.140.2

pkgs/os-specific/darwin/apple-source-releases/system_cmds/package.nix

@@ -1,6 +1,8 @@
 {
   lib,
+  AvailabilityVersions,
   apple-sdk,
+  apple-sdk_15,
   libutil,
   mkAppleDerivation,
   ncurses,
@@ -18,12 +20,15 @@ let
   OpenDirectory = apple-sdk.sourceRelease "OpenDirectory";
 
   libplatform = apple-sdk.sourceRelease "libplatform";
-  xnu = apple-sdk.sourceRelease "xnu";
+  xnu = apple-sdk_15.sourceRelease "xnu"; # Needed for `posix_spawn_secflag_options`
 
   privateHeaders = stdenvNoCC.mkDerivation {
     name = "system_cmds-deps-private-headers";
 
     buildCommand = ''
+      mkdir -p "$out/include/sys"
+      '${lib.getExe AvailabilityVersions}' ${lib.getVersion apple-sdk} "$out"
+
       install -D -t "$out/include/CFOpenDirectory" \
         '${OpenDirectory}/Core/CFOpenDirectoryPriv.h' \
         '${OpenDirectory}/Core/CFODTrigger.h'
@@ -105,6 +110,12 @@ mkAppleDerivation {
 
   xcodeHash = "sha256-gdtn3zNIneZKy6+X0mQ51CFVLNM6JQYLbd/lotG5/Tw=";
 
+  patches = [
+    # `posix_spawnattr_set_use_sec_transition_shims_np` is only available on macOS 15.2 or newer.
+    # Disable the feature that requires it when running on older systems.
+    ./patches/conditionalize-security-transition-shims.patch
+  ];
+
   postPatch = ''
     # Replace hard-coded, impure system paths with the output path in the store.
     sed -e "s|PATH=[^;]*|PATH='$out/bin'|" -i "pagesize/pagesize.sh"

pkgs/os-specific/darwin/apple-source-releases/system_cmds/patches/conditionalize-security-transition-shims.patch

@@ -0,0 +1,33 @@
+diff --git a/taskpolicy/taskpolicy.c b/taskpolicy/taskpolicy.c
+index b031f944b2..4ad82018ed 100644
+--- a/taskpolicy/taskpolicy.c
++++ b/taskpolicy/taskpolicy.c
+@@ -126,7 +126,12 @@
+ 				flag_s = true;
+ 				break;
+ 			case 'S':
+-				sec_transition_shims = parse_sec_transition_shims(optarg);
++				if (__builtin_available(macOS 15.2, *)) {
++					sec_transition_shims = parse_sec_transition_shims(optarg);
++				} else {
++					fprintf(stderr, "Running with security transition shims is only supported on macOS 15.2 and newer.\n");
++					exit(EX_USAGE);
++				}
+ 				break;
+ 			case '?':
+ 			default:
+@@ -246,9 +251,11 @@
+ 		if (ret != 0) errc(EX_NOINPUT, ret, "posix_spawnattr_set_darwin_role_np");
+ 	}
+
+-	if (sec_transition_shims) {
+-		ret = posix_spawnattr_set_use_sec_transition_shims_np(&attr, sec_transition_shims);
+-		if (ret != 0) errc(EX_NOINPUT, ret, "setting security transition shims");
++	if (__builtin_available(macOS 15.2, *)) {
++		if (sec_transition_shims) {
++			ret = posix_spawnattr_set_use_sec_transition_shims_np(&attr, sec_transition_shims);
++			if (ret != 0) errc(EX_NOINPUT, ret, "setting security transition shims");
++		}
+ 	}
+
+ 	ret = posix_spawnp(&pid, argv[0], NULL, &attr, argv, environ);

pkgs/os-specific/darwin/apple-source-releases/versions.json

@@ -104,8 +104,8 @@
     "version": "326"
   },
   "system_cmds": {
-    "hash": "sha256-9nNJeVJo4XwGSHh+SJydhVt+I8+Rb5hCsPiFYKQ8/28=",
-    "version": "1012.60.2"
+    "hash": "sha256-mEo+v0m+aP42XHHwibGKPkT55JFYLTOD5YT5IYQ8Hr0=",
+    "version": "1026.140.2"
   },
   "text_cmds": {
     "hash": "sha256-76dagwRcAf5fpoyH5FDR5kdCldv6Mgre6aFBzxaCRkg=",