From e30337ef36303edcc876e29d14613734e3f42d07 Mon Sep 17 00:00:00 2001
From: Anish Pallati <i@anish.land>
Date: Mon, 13 Jul 2026 20:27:28 -0400
Subject: [PATCH 1/2] darwin.PowerManagement: update xcodeHash

Signed-off-by: Anish Pallati <i@anish.land>
---
 pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix b/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
index 5c64820839a0..07b458419a40 100644
--- a/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
+++ b/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
@@ -20,7 +20,7 @@ in
 mkAppleDerivation {
   releaseName = "PowerManagement";
 
-  xcodeHash = "sha256-06rCxqBUrYqBY7BDZ6s/vSoviUAmIbsQP1pfrvR2Gpk=";
+  xcodeHash = "sha256-8dASJnzc7yZ4LNbanNjWuCoJunxAz/7R1Ulj/zOrkkI=";
 
   env.NIX_CFLAGS_COMPILE = "-I${privateHeaders}/include";
 

From 0058f85b416141327a05c090b8a7b4a2222b9622 Mon Sep 17 00:00:00 2001
From: Anish Pallati <i@anish.land>
Date: Mon, 13 Jul 2026 20:27:32 -0400
Subject: [PATCH 2/2] darwin.mkAppleDerivation: add build-platform xcodeHash
 test

Signed-off-by: Anish Pallati <i@anish.land>
---
 .../darwin/mk-apple-derivation/default.nix    | 58 +++++++++++++------
 1 file changed, 40 insertions(+), 18 deletions(-)

diff --git a/pkgs/os-specific/darwin/mk-apple-derivation/default.nix b/pkgs/os-specific/darwin/mk-apple-derivation/default.nix
index 9bd230eee5e9..f727a62423ac 100644
--- a/pkgs/os-specific/darwin/mk-apple-derivation/default.nix
+++ b/pkgs/os-specific/darwin/mk-apple-derivation/default.nix
@@ -3,6 +3,7 @@
   bootstrapStdenv,
   meson,
   ninja,
+  runCommand,
   sourceRelease,
   xcodeProjectCheckHook,
 }:
@@ -51,25 +52,46 @@ lib.extendMkDerivation {
       }
       // args.meta or { };
     }
-    // lib.optionalAttrs (args ? xcodeHash) {
-      postUnpack =
-        args.postUnpack or ""
-        + lib.concatMapStrings (
-          file:
-          if baseNameOf file == "meson.build.in" then
-            "substitute ${lib.escapeShellArg "${file}"} \"$sourceRoot/meson.build\" --subst-var version\n"
-          else
-            "cp ${lib.escapeShellArg "${file}"} \"$sourceRoot/\"${lib.escapeShellArg (baseNameOf file)}\n"
-        ) mesonFiles;
+    // lib.optionalAttrs (args ? xcodeHash) (
+      let
+        xcodeProject = args.xcodeProject or "${releaseName}.xcodeproj";
+      in
+      {
+        postUnpack =
+          args.postUnpack or ""
+          + lib.concatMapStrings (
+            file:
+            if baseNameOf file == "meson.build.in" then
+              "substitute ${lib.escapeShellArg "${file}"} \"$sourceRoot/meson.build\" --subst-var version\n"
+            else
+              "cp ${lib.escapeShellArg "${file}"} \"$sourceRoot/\"${lib.escapeShellArg (baseNameOf file)}\n"
+          ) mesonFiles;
 
-      xcodeProject = args.xcodeProject or "${releaseName}.xcodeproj";
+        inherit xcodeProject;
 
-      nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
-        meson
-        ninja
-        xcodeProjectCheckHook
-      ];
+        nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
+          meson
+          ninja
+          xcodeProjectCheckHook
+        ];
 
-      mesonBuildType = "release";
-    };
+        mesonBuildType = "release";
+
+        # build-platform check so CI catches stale xcodeHashes the Darwin-only postUnpack hook misses
+        passthru = lib.recursiveUpdate (args.passthru or { }) {
+          tests.xcodeProjectHash =
+            runCommand "${finalAttrs.pname}-xcodeproject-hash-check"
+              {
+                sourceRoot = "${finalAttrs.src}";
+                inherit xcodeProject;
+                inherit (args) xcodeHash;
+                nativeBuildInputs = [ xcodeProjectCheckHook ];
+              }
+              ''
+                verifyXcodeProjectHash
+                touch "$out"
+              '';
+        };
+      }
+    );
 }