From c922cb27b6f52f17a522d3a4940a8fc36fa5c246 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 14 Apr 2024 09:19:48 -0400
Subject: [PATCH] bintools-wrapper: drop postLinkSignHook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the linker signs a Mach-O binary, it sets a flag in the signature’s code directory indicating that the signature was generated by a linker. Tools such as `strip` and `install_name_tool` read this flag and will
update ad hoc signatures after they perform their modifications.

The updated l64 supports signing binaries automatically. Both the updated cctools and LLVM will check for the linker-signed flag and resign binaries they modify automatically when it’s present. Given that, use of postLinkSignHook is unnecessary and potentially harmful.

In particular, if the hook is used and an unwrapped `strip` or `install_name_tool` is on the user’s path, they will not automatically update an ad hoc signature. Instead, they will issue a warning and create a binary with a broken signature.

It is more robust to let the tools handled this since the only time a signature would not be linker-signed is when the user is manually invoking `codesign` (or another tool such as `sigtool` or `rcodesign`), which by nature of the invocation updates the signature to a valid  one.

Since `strip` no longer needs to be wrapped for code-signing, binutils-wrapper now uses the GNU strip wrapper on Darwin.

Fixes https://github.com/NixOS/nixpkgs/issues/208951.
---
 .../bintools-wrapper/default.nix              | 23 +------------------
 pkgs/top-level/all-packages.nix               |  1 -
 2 files changed, 1 insertion(+), 23 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index b7561f1aab55..215dd0f39cd7 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -60,9 +60,6 @@
       (!(targetPlatform.isAarch && targetPlatform.isStatic))
     ])
   ]) "pie"
-
-# Darwin code signing support utilities
-, postLinkSignHook ? null, signingUtils ? null
 }:
 
 assert propagateDoc -> bintools ? man;
@@ -357,7 +354,7 @@ stdenvNoCC.mkDerivation {
     ##
 
     # TODO(@sternenseemann): make a generic strip wrapper?
-    + optionalString (bintools.isGNU or false) ''
+    + optionalString (bintools.isGNU or false || bintools.isCCTools or false) ''
       wrap ${targetPrefix}strip ${./gnu-binutils-strip-wrapper.sh} \
         "${bintools_bin}/bin/${targetPrefix}strip"
     ''
@@ -396,24 +393,6 @@ stdenvNoCC.mkDerivation {
       ''
     )
 
-    ##
-    ## Code signing on Apple Silicon
-    ##
-    + optionalString (targetPlatform.isDarwin && targetPlatform.isAarch64) ''
-      echo 'source ${postLinkSignHook}' >> $out/nix-support/post-link-hook
-
-      export signingUtils=${signingUtils}
-
-      wrap \
-        ${targetPrefix}install_name_tool \
-        ${./darwin-install_name_tool-wrapper.sh} \
-        "${bintools_bin}/bin/${targetPrefix}install_name_tool"
-
-      wrap \
-        ${targetPrefix}strip ${./darwin-strip-wrapper.sh} \
-        "${bintools_bin}/bin/${targetPrefix}strip"
-    ''
-
     ##
     ## Extra custom steps
     ##
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a0e24a76b59e..83056ee7e7d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16774,7 +16774,6 @@ with pkgs;
     noLibc = (self.libc == null);
 
     inherit bintools libc;
-    inherit (darwin) postLinkSignHook signingUtils;
   } // extraArgs; in self);
 
   yaml-language-server = callPackage  ../development/tools/language-servers/yaml-language-server { };