Revert "darwin 10.12 commits"

Reverts commits bumping to macOS stuff to 10.12:

commit ec1f78d1cb6ac86743ffb797bf88d4633b91e733.
commit d0dc91d24f643ca2cb6901f80a641099db975966.
commit a1d297374df55c30b8b74834a85924e9dc739dda.
commit 425112151db3b05fec01e86cb10c90b4037e9367.
commit e6f7f2928f668262577125290dc90ad8df12e724.

76 files changed, 1606 insertions, 696 deletions

diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index cdba7013cfa..f0d629ad5e4 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -126,6 +126,25 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system = if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then let inherit (pkgs.darwin) security_tool;
+      in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
+        # darwin.security_tool is broken in Mojave (#45042)
+
+        # We will use the system provided security for now.
+        # Beware this WILL break in sandboxes!
+
+        # TODO(matthewbauer): If someone really needs this to work in sandboxes,
+        # I think we can add a propagatedImpureHost dep here, but I’m hoping to
+        # get a proper fix available soonish.
+        postPatch = (drv.postPatch or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+        '';
+      })
+    else super.x509-system;
+
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/tools/xcbuild/toolchains.nix b/pkgs/development/tools/xcbuild/toolchains.nix
index e435f0978c5..59e009a4338 100644
--- a/pkgs/development/tools/xcbuild/toolchains.nix
+++ b/pkgs/development/tools/xcbuild/toolchains.nix
@@ -67,7 +67,5 @@ runCommand "Toolchains" {} (''
   done
 
   ln -s ${buildPackages.darwin.bootstrap_cmds}/bin/mig $toolchain/bin
-  mkdir -p $toolchain/libexec
-  ln -s ${buildPackages.darwin.bootstrap_cmds}/libexec/migcom $toolchain/libexec
   ln -s ${mkdep-darwin-src} $toolchain/bin/mkdep
 '')
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 71574998885..c23a2148143 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,22 +1,30 @@
-{ stdenv, fetchurl, xar, cpio, pkgs, python, pbzx, lib }:
+{ stdenv, fetchurl, xar, xz, cpio, pkgs, python, lib }:
 
 let
+  # TODO: make this available to other packages and generalize the unpacking a bit
+  # from https://gist.github.com/pudquick/ff412bcb29c9c1fa4b8d
+  # This isn't needed until we get to SDK 10.11, but that presents other challenges
+  # unpbzx = fetchurl {
+  #   url    = "https://gist.githubusercontent.com/pudquick/ff412bcb29c9c1fa4b8d/raw/24b25538ea8df8d0634a2a6189aa581ccc6a5b4b/parse_pbzx2.py";
+  #   sha256 = "0jgp6qbfl36i0jlz7as5zk2w20z4ca8wlrhdw49lwsld6wi3rfhc";
+  # };
+
   # sadly needs to be exported because security_tool needs it
   sdk = stdenv.mkDerivation rec {
-    version = "10.12";
+    version = "10.10";
     name    = "MacOS_SDK-${version}";
 
-    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.12.merged-1.sucatalog, which we found by:
+    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.10.merged-1.sucatalog, which we found by:
     #  1. Google: site:swscan.apple.com and look for a name that seems appropriate for your version
     #  2. In the resulting file, search for a file called DevSDK ending in .pkg
     #  3. ???
     #  4. Profit
     src = fetchurl {
-      url    = "http://swcdn.apple.com/content/downloads/28/09/091-29862/pafhn2u002b9slnrxzy9p86rpedycnjhb5/DevSDK_OSX1012.pkg";
-      sha256 = "1sggc70rypqwcjwr7ciavw8sczwll16cwqxdxrbw7r2qvy3b0nhx";
+      url    = "http://swcdn.apple.com/content/downloads/22/52/031-45139/hcjjv7cm4n6yqk56ict73qqw15ikm5iaql/DevSDK_OSX1010.pkg";
+      sha256 = "08bxa93zw7r4vzs28j9giq2qyk3b68ky6jx1bb9850gflr3nvgq1";
     };
 
-    buildInputs = [ xar cpio python pbzx ];
+    buildInputs = [ xar xz cpio python ];
 
     phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
     outputs = [ "out" "dev" "man" ];
@@ -29,7 +37,7 @@ let
       start="$(pwd)"
       mkdir -p $out
       cd $out
-      pbzx -n $start/Payload | cpio -idm
+      cat $start/Payload | gzip -d | cpio -idm
 
       mv usr/* .
       rmdir usr
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h b/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
deleted file mode 100644
index a1cbb72b917..00000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-/***********************************************************************
- * Not to be installed in /usr/local/include
- ***********************************************************************/
-
-#ifndef _LIBC_CRASHREPORTERCLIENT_H
-#define _LIBC_CRASHREPORTERCLIENT_H
-
-#include "stdint.h"
-
-/* Fake the CrashReporterClient API */
-#define CRGetCrashLogMessage() 0
-#define CRSetCrashLogMessage(m) true
-
-#define CRASH_REPORTER_CLIENT_HIDDEN __attribute__((visibility("hidden")))
-#define CRASHREPORTER_ANNOTATIONS_VERSION 4
-#define CRASHREPORTER_ANNOTATIONS_SECTION "__crash_info"
-
-struct crashreporter_annotations_t {
-	uint64_t version;		// unsigned long
-	uint64_t message;		// char *
-	uint64_t signature_string;	// char *
-	uint64_t backtrace;		// char *
-	uint64_t message2;		// char *
-	uint64_t thread;		// uint64_t
-	uint64_t dialog_mode;		// unsigned int
-};
-
-#endif
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
index 6ebb470145d..542ea20de11 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -11,8 +11,6 @@ appleDerivation {
     export PRIVATE_HEADERS_FOLDER_PATH=include
     bash xcodescripts/headers.sh
 
-    cp ${./CrashReporterClient.h} $out/include/CrashReporterClient.h
-
     cp ${Libc_10-9}/include/NSSystemDirectories.h $out/include
 
     # Ugh Apple stopped releasing this stuff so we need an older one...
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index a0edfbbb3b5..1e27ead69f1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,11 +1,9 @@
-{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo
-, dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
-, copyfile, removefile, libresolv, Libnotify, libplatform, libpthread
-, mDNSResponder, launchd, libutil, hfs }:
+{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo,
+  dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto, copyfile,
+  removefile, libresolv, Libnotify, libplatform, libpthread, mDNSResponder, launchd, libutil }:
 
 appleDerivation rec {
-  dontBuild = true;
-  dontFixup = true;
+  phases = [ "unpackPhase" "installPhase" ];
 
   nativeBuildInputs = [ cpio ];
 
@@ -19,21 +17,19 @@ appleDerivation rec {
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/Availability*.h $out/include
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/stdarg.h        $out/include
 
-    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} \
-               ${libclosure} ${CarbonHeaders} ${libdispatch} ${ncurses.dev} \
-               ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
-               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} \
-               ${libutil} ${libpthread} ${hfs}; do
+    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} ${libclosure} ${CarbonHeaders} \
+               ${libdispatch} ${ncurses.dev} ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
+               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} ${libutil} ${libpthread}; do
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
+
     (cd ${cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
 
     cat <<EOF > $out/include/TargetConditionals.h
     #ifndef __TARGETCONDITIONALS__
     #define __TARGETCONDITIONALS__
     #define TARGET_OS_MAC           1
-    #define TARGET_OS_OSX           1
     #define TARGET_OS_WIN32         0
     #define TARGET_OS_UNIX          0
     #define TARGET_OS_EMBEDDED      0
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
index 1ec6c6332cf..4d83c5cfe9b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -232,8 +232,6 @@ __os_assert_log_ctx
 __os_assumes_log
 __os_assumes_log_ctx
 __os_avoid_tail_call
-__os_crash
-__os_crash_callback
 __os_debug_log
 __os_debug_log_error_str
 __putenvp
@@ -265,7 +263,6 @@ __unsetenvp
 __utmpxname
 _a64l
 _abort
-_abort_report_np
 _abs
 _acl_add_flag_np
 _acl_add_perm
@@ -348,7 +345,6 @@ _backtrace
 _backtrace_symbols
 _backtrace_symbols_fd
 _basename
-_basename_r
 _bcmp
 _bcopy
 _brk
@@ -381,12 +377,8 @@ _chmodx_np
 _clearerr
 _clearerr_unlocked
 _clock
-_clock_getres
-_clock_gettime
-_clock_gettime_nsec_np
 _clock_port
 _clock_sem
-_clock_settime
 _closedir
 _compat_mode
 _confstr
@@ -419,7 +411,6 @@ _digittoint
 _digittoint_l
 _dirfd
 _dirname
-_dirname_r
 _div
 _dprintf
 _dprintf_l
@@ -780,12 +771,8 @@ _mergesort_b
 _mkdirx_np
 _mkdtemp
 _mkfifox_np
-_mkostemp
-_mkostemps
 _mkpath_np
-_mkpathat_np
 _mkstemp
-_mkstemp_dprotected_np
 _mkstemps
 _mktemp
 _mktime
@@ -818,7 +805,6 @@ _nice
 _nl_langinfo
 _nl_langinfo_l
 _nrand48
-_nvis
 _off32
 _off64
 _offtime
@@ -973,7 +959,6 @@ _sleep
 _sleep$NOCANCEL
 _snprintf
 _snprintf_l
-_snvis
 _sockatmark
 _sprintf
 _sprintf_l
@@ -1003,7 +988,6 @@ _strcoll_l
 _strcpy
 _strcspn
 _strdup
-_strenvisx
 _strerror
 _strerror_r
 _strfmon
@@ -1022,23 +1006,14 @@ _strncpy
 _strndup
 _strnlen
 _strnstr
-_strnunvis
-_strnunvisx
-_strnvis
-_strnvisx
 _strpbrk
 _strptime
 _strptime_l
 _strrchr
-_strsenvisx
 _strsep
 _strsignal
-_strsnvis
-_strsnvisx
 _strspn
 _strstr
-_strsvis
-_strsvisx
 _strtod
 _strtod_l
 _strtof
@@ -1071,7 +1046,6 @@ _strvisx
 _strxfrm
 _strxfrm_l
 _suboptarg
-_svis
 _swab
 _swprintf
 _swprintf_l
@@ -1113,7 +1087,6 @@ _timelocal
 _timeoff
 _times
 _timezone
-_timingsafe_bcmp
 _tmpfile
 _tmpnam
 _toascii
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 7c5b90f95ed..4d1a1f521b0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -3,7 +3,6 @@ _____old_semwait_signal_nocancel
 _____sigwait_nocancel
 ____kernelVersionNumber
 ____kernelVersionString
-___abort_with_payload
 ___accept
 ___accept_nocancel
 ___access_extended
@@ -14,11 +13,6 @@ ___bsdthread_ctl
 ___bsdthread_register
 ___bsdthread_terminate
 ___carbon_delete
-___channel_get_info
-___channel_get_opt
-___channel_open
-___channel_set_opt
-___channel_sync
 ___chmod
 ___chmod_extended
 ___close_nocancel
@@ -38,7 +32,6 @@ ___fchmod_extended
 ___fcntl
 ___fcntl_nocancel
 ___fork
-___fs_snapshot
 ___fstat64_extended
 ___fstat_extended
 ___fsync_nocancel
@@ -64,8 +57,6 @@ ___ioctl
 ___iopolicysys
 ___kdebug_trace
 ___kdebug_trace64
-___kdebug_trace_string
-___kdebug_typefilter
 ___kill
 ___lchown
 ___libkernel_init
@@ -88,7 +79,6 @@ ___mac_set_file
 ___mac_set_link
 ___mac_set_proc
 ___mac_syscall
-___microstackshot
 ___mkdir_extended
 ___mkfifo_extended
 ___mmap
@@ -100,13 +90,6 @@ ___msgsys
 ___msync
 ___msync_nocancel
 ___munmap
-___nexus_create
-___nexus_deregister
-___nexus_destroy
-___nexus_get_opt
-___nexus_open
-___nexus_register
-___nexus_set_opt
 ___old_semwait_signal
 ___open
 ___open_dprotected_np
@@ -114,17 +97,12 @@ ___open_extended
 ___open_nocancel
 ___openat
 ___openat_nocancel
-___os_nexus_ifattach
-___os_nexus_ifdetach
-___persona
 ___pipe
 ___poll_nocancel
 ___posix_spawn
 ___pread_nocancel
 ___proc_info
 ___process_policy
-___pselect
-___pselect_nocancel
 ___psynch_cvbroad
 ___psynch_cvclrprepost
 ___psynch_cvsignal
@@ -155,7 +133,6 @@ ___recvmsg
 ___recvmsg_nocancel
 ___rename
 ___renameat
-___renameatx_np
 ___rmdir
 ___sandbox_me
 ___sandbox_mm
@@ -198,7 +175,6 @@ ___sigsuspend
 ___sigsuspend_nocancel
 ___sigwait
 ___socketpair
-___stack_snapshot_with_config
 ___stat64_extended
 ___stat_extended
 ___syscall
@@ -206,11 +182,8 @@ ___syscall_logger
 ___sysctl
 ___sysctlbyname
 ___telemetry
-___terminate_with_payload
 ___thread_selfid
 ___thread_selfusage
-___ulock_wait
-___ulock_wake
 ___umask_extended
 ___unlink
 ___unlinkat
@@ -218,7 +191,6 @@ ___vfork
 ___wait4
 ___wait4_nocancel
 ___waitid_nocancel
-___work_interval_ctl
 ___workq_kernreturn
 ___workq_open
 ___write_nocancel
@@ -230,7 +202,6 @@ __get_cpu_capabilities
 __getprivatesystemidentifier
 __host_page_size
 __init_cpu_capabilities
-__kernelrpc_host_create_mach_voucher
 __kernelrpc_mach_port_allocate
 __kernelrpc_mach_port_allocate_full
 __kernelrpc_mach_port_allocate_name
@@ -286,17 +257,13 @@ __kernelrpc_mach_vm_map
 __kernelrpc_mach_vm_map_trap
 __kernelrpc_mach_vm_protect
 __kernelrpc_mach_vm_protect_trap
-__kernelrpc_mach_vm_purgable_control
-__kernelrpc_mach_vm_purgable_control_trap
 __kernelrpc_mach_vm_read
 __kernelrpc_mach_vm_remap
-__kernelrpc_mach_voucher_extract_attr_recipe
 __kernelrpc_task_set_port_space
 __kernelrpc_thread_policy
 __kernelrpc_thread_policy_set
 __kernelrpc_thread_set_policy
 __kernelrpc_vm_map
-__kernelrpc_vm_purgable_control
 __kernelrpc_vm_read
 __kernelrpc_vm_remap
 __mach_errors
@@ -305,9 +272,6 @@ __mach_snprintf
 __mach_vsnprintf
 __os_alloc_once_table
 __register_gethostuuid_callback
-__thread_set_tsd_base
-_abort_with_payload
-_abort_with_reason
 _accept
 _accept$NOCANCEL
 _access
@@ -348,8 +312,6 @@ _clock_set_attributes
 _clock_set_time
 _clock_sleep
 _clock_sleep_trap
-_clonefile
-_clonefileat
 _close
 _close$NOCANCEL
 _coalition_create
@@ -383,7 +345,6 @@ _fchmod
 _fchmodat
 _fchown
 _fchownat
-_fclonefileat
 _fcntl
 _fcntl$NOCANCEL
 _fdatasync
@@ -397,16 +358,9 @@ _flistxattr
 _flock
 _fpathconf
 _fremovexattr
-_fs_snapshot_create
-_fs_snapshot_delete
-_fs_snapshot_list
-_fs_snapshot_mount
-_fs_snapshot_rename
-_fs_snapshot_revert
 _fsctl
 _fsetattrlist
 _fsetxattr
-_fsgetpath
 _fstat
 _fstat$INODE64
 _fstat64
@@ -430,7 +384,6 @@ _getdirentries
 _getdirentriesattr
 _getdtablesize
 _getegid
-_getentropy
 _geteuid
 _getfh
 _getfsstat
@@ -456,7 +409,6 @@ _getsockopt
 _getuid
 _getwgroups_np
 _getxattr
-_grab_pgo_data
 _guarded_close_np
 _guarded_kqueue_np
 _guarded_open_dprotected_np
@@ -464,18 +416,14 @@ _guarded_open_np
 _guarded_pwrite_np
 _guarded_write_np
 _guarded_writev_np
-_host_check_multiuser_mode
 _host_create_mach_voucher
-_host_create_mach_voucher_trap
 _host_default_memory_manager
 _host_get_UNDServer
-_host_get_atm_diagnostic_flag
 _host_get_boot_info
 _host_get_clock_control
 _host_get_clock_service
 _host_get_exception_ports
 _host_get_io_master
-_host_get_multiuser_config_flags
 _host_get_special_port
 _host_info
 _host_kernel_version
@@ -495,9 +443,7 @@ _host_security_set_task_token
 _host_self
 _host_self_trap
 _host_set_UNDServer
-_host_set_atm_diagnostic_flag
 _host_set_exception_ports
-_host_set_multiuser_config_flags
 _host_set_special_port
 _host_statistics
 _host_statistics64
@@ -510,28 +456,15 @@ _internal_catch_exc_subsystem
 _ioctl
 _issetugid
 _kas_info
-_kdebug_is_enabled
-_kdebug_signpost
-_kdebug_signpost_end
-_kdebug_signpost_start
 _kdebug_trace
-_kdebug_trace_string
-_kdebug_typefilter
 _kevent
 _kevent64
-_kevent_qos
 _kext_request
 _kill
 _kmod_control
 _kmod_create
 _kmod_destroy
 _kmod_get_info
-_kpersona_alloc
-_kpersona_dealloc
-_kpersona_find
-_kpersona_get
-_kpersona_info
-_kpersona_pidinfo
 _kqueue
 _lchown
 _ledger
@@ -554,20 +487,14 @@ _lstat$INODE64
 _lstat64
 _mach_absolute_time
 _mach_approximate_time
-_mach_boottime_usec
-_mach_continuous_approximate_time
-_mach_continuous_time
 _mach_error
 _mach_error_full_diag
 _mach_error_string
 _mach_error_type
-_mach_generate_activity_id
-_mach_get_times
 _mach_host_self
 _mach_init
 _mach_make_memory_entry
 _mach_make_memory_entry_64
-_mach_memory_info
 _mach_memory_object_memory_entry
 _mach_memory_object_memory_entry_64
 _mach_msg
@@ -627,7 +554,6 @@ _mach_task_self
 _mach_task_self_
 _mach_thread_self
 _mach_timebase_info
-_mach_timebase_info_trap
 _mach_vm_allocate
 _mach_vm_behavior_set
 _mach_vm_copy
@@ -654,7 +580,6 @@ _mach_voucher_debug_info
 _mach_voucher_extract_all_attr_recipes
 _mach_voucher_extract_attr_content
 _mach_voucher_extract_attr_recipe
-_mach_voucher_extract_attr_recipe_trap
 _mach_wait_until
 _mach_zone_force_gc
 _mach_zone_info
@@ -673,7 +598,6 @@ _mig_get_reply_port
 _mig_put_reply_port
 _mig_reply_setup
 _mig_strncpy
-_mig_strncpy_zerofill
 _mincore
 _minherit
 _mk_timer_arm
@@ -706,10 +630,7 @@ _msync$NOCANCEL
 _munlock
 _munlockall
 _munmap
-_necp_client_action
 _necp_match_policy
-_necp_open
-_netagent_trigger
 _netname_check_in
 _netname_check_out
 _netname_look_up
@@ -724,44 +645,6 @@ _open_dprotected_np
 _openat
 _openat$NOCANCEL
 _openbyid_np
-_os_channel_advance_slot
-_os_channel_attr_clone
-_os_channel_attr_create
-_os_channel_attr_destroy
-_os_channel_attr_get
-_os_channel_attr_get_key
-_os_channel_attr_set
-_os_channel_attr_set_key
-_os_channel_available_slot_count
-_os_channel_create
-_os_channel_create_extended
-_os_channel_destroy
-_os_channel_get_fd
-_os_channel_get_next_slot
-_os_channel_pending
-_os_channel_read_attr
-_os_channel_read_nexus_extension_info
-_os_channel_ring_id
-_os_channel_rx_ring
-_os_channel_set_slot_properties
-_os_channel_sync
-_os_channel_tx_ring
-_os_channel_write_attr
-_os_nexus_attr_clone
-_os_nexus_attr_create
-_os_nexus_attr_destroy
-_os_nexus_attr_get
-_os_nexus_attr_set
-_os_nexus_controller_alloc_provider_instance
-_os_nexus_controller_bind_provider_instance
-_os_nexus_controller_create
-_os_nexus_controller_deregister_provider
-_os_nexus_controller_destroy
-_os_nexus_controller_free_provider_instance
-_os_nexus_controller_get_fd
-_os_nexus_controller_read_provider_attr
-_os_nexus_controller_register_provider
-_os_nexus_controller_unbind_provider_instance
 _panic
 _panic_init
 _pathconf
@@ -786,7 +669,6 @@ _posix_spawn_file_actions_addopen
 _posix_spawn_file_actions_destroy
 _posix_spawn_file_actions_init
 _posix_spawnattr_destroy
-_posix_spawnattr_get_darwin_role_np
 _posix_spawnattr_get_qos_clamp_np
 _posix_spawnattr_getbinpref_np
 _posix_spawnattr_getcpumonitor
@@ -798,12 +680,7 @@ _posix_spawnattr_getprocesstype_np
 _posix_spawnattr_getsigdefault
 _posix_spawnattr_getsigmask
 _posix_spawnattr_init
-_posix_spawnattr_set_darwin_role_np
 _posix_spawnattr_set_importancewatch_port_np
-_posix_spawnattr_set_persona_gid_np
-_posix_spawnattr_set_persona_groups_np
-_posix_spawnattr_set_persona_np
-_posix_spawnattr_set_persona_uid_np
 _posix_spawnattr_set_qos_clamp_np
 _posix_spawnattr_setauditsessionport_np
 _posix_spawnattr_setbinpref_np
@@ -812,7 +689,6 @@ _posix_spawnattr_setcpumonitor
 _posix_spawnattr_setcpumonitor_default
 _posix_spawnattr_setexceptionports_np
 _posix_spawnattr_setflags
-_posix_spawnattr_setjetsam_ext
 _posix_spawnattr_setmacpolicyinfo_np
 _posix_spawnattr_setpcontrol_np
 _posix_spawnattr_setpgroup
@@ -822,7 +698,6 @@ _posix_spawnattr_setsigmask
 _posix_spawnattr_setspecialport_np
 _pread
 _pread$NOCANCEL
-_proc_clear_cpulimits
 _proc_clear_delayidlesleep
 _proc_clear_dirty
 _proc_clear_vmpressure
@@ -840,10 +715,8 @@ _proc_importance_assertion_begin_with_msg
 _proc_importance_assertion_complete
 _proc_kmsgbuf
 _proc_libversion
-_proc_list_uptrs
 _proc_listallpids
 _proc_listchildpids
-_proc_listcoalitions
 _proc_listpgrppids
 _proc_listpids
 _proc_listpidspath
@@ -855,7 +728,6 @@ _proc_pidinfo
 _proc_pidoriginatorinfo
 _proc_pidpath
 _proc_regionfilename
-_proc_resume_cpumon
 _proc_rlimit_control
 _proc_set_cpumon_defaults
 _proc_set_cpumon_params
@@ -865,7 +737,6 @@ _proc_set_dirty
 _proc_set_owner_vmpressure
 _proc_set_wakemon_defaults
 _proc_set_wakemon_params
-_proc_setcpu_percentage
 _proc_setpcontrol
 _proc_setthread_cpupercent
 _proc_suppress
@@ -919,8 +790,6 @@ _removexattr
 _rename
 _rename_ext
 _renameat
-_renameatx_np
-_renamex_np
 _revoke
 _rmdir
 _searchfs
@@ -1007,16 +876,6 @@ _sigsuspend$NOCANCEL
 _socket
 _socket_delegate
 _socketpair
-_stackshot_capture_with_config
-_stackshot_config_create
-_stackshot_config_dealloc
-_stackshot_config_dealloc_buffer
-_stackshot_config_get_stackshot_buffer
-_stackshot_config_get_stackshot_size
-_stackshot_config_set_delta_timestamp
-_stackshot_config_set_flags
-_stackshot_config_set_pid
-_stackshot_config_set_size_hint
 _stat
 _stat$INODE64
 _stat64
@@ -1038,26 +897,18 @@ _task_assign
 _task_assign_default
 _task_create
 _task_for_pid
-_task_generate_corpse
 _task_get_assignment
-_task_get_dyld_image_infos
 _task_get_emulation_vector
 _task_get_exception_ports
 _task_get_mach_voucher
 _task_get_special_port
 _task_get_state
 _task_info
-_task_map_corpse_info
-_task_map_corpse_info_64
 _task_name_for_pid
 _task_policy
 _task_policy_get
 _task_policy_set
 _task_purgable_info
-_task_register_dyld_get_process_state
-_task_register_dyld_image_infos
-_task_register_dyld_set_dyld_state
-_task_register_dyld_shared_cache_image_info
 _task_resume
 _task_resume2
 _task_sample
@@ -1080,10 +931,7 @@ _task_swap_exception_ports
 _task_swap_mach_voucher
 _task_terminate
 _task_threads
-_task_unregister_dyld_image_infos
 _task_zone_info
-_terminate_with_payload
-_terminate_with_reason
 _thread_abort
 _thread_abort_safely
 _thread_assign
@@ -1094,7 +942,6 @@ _thread_depress_abort
 _thread_get_assignment
 _thread_get_exception_ports
 _thread_get_mach_voucher
-_thread_get_register_pointer_values
 _thread_get_special_port
 _thread_get_state
 _thread_info
@@ -1121,7 +968,6 @@ _undelete
 _unlink
 _unlinkat
 _unmount
-_usrctl
 _utimes
 _vfork
 _vfs_purge
@@ -1162,10 +1008,6 @@ _waitevent
 _waitid
 _waitid$NOCANCEL
 _watchevent
-_work_interval_create
-_work_interval_destroy
-_work_interval_notify
-_work_interval_notify_simple
 _write
 _write$NOCANCEL
 _writev
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
deleted file mode 100644
index e04142b8b11..00000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ /dev/null
@@ -1,116 +0,0 @@
-{ appleDerivation }:
-
-appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
-  __propagatedImpureHostDeps = [
-    "/System/Library/Frameworks/Security.framework/Security"
-    "/System/Library/Frameworks/Security.framework/Resources"
-    "/System/Library/Frameworks/Security.framework/PlugIns"
-    "/System/Library/Frameworks/Security.framework/XPCServices"
-    "/System/Library/Frameworks/Security.framework/Versions"
-  ];
-
-  installPhase = ''
-    ###### IMPURITIES
-    mkdir -p $out/Library/Frameworks/Security.framework
-    pushd $out/Library/Frameworks/Security.framework
-    ln -s /System/Library/Frameworks/Security.framework/Security
-    ln -s /System/Library/Frameworks/Security.framework/Resources
-    ln -s /System/Library/Frameworks/Security.framework/PlugIns
-    ln -s /System/Library/Frameworks/Security.framework/XPCServices
-    popd
-
-    ###### HEADERS
-
-    export dest=$out/Library/Frameworks/Security.framework/Headers
-    mkdir -p $dest
-
-    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
-    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
-    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
-    cp libsecurity_asn1/lib/oidsalg.h          $dest
-    cp libsecurity_asn1/lib/oidsattr.h         $dest
-
-    cp libsecurity_authorization/lib/AuthSession.h         $dest
-    cp libsecurity_authorization/lib/Authorization.h       $dest
-    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
-    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
-    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
-
-    cp libsecurity_cms/lib/CMSDecoder.h $dest
-    cp libsecurity_cms/lib/CMSEncoder.h $dest
-
-    cp libsecurity_codesigning/lib/CSCommon.h       $dest
-    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
-    cp libsecurity_codesigning/lib/SecCode.h        $dest
-    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
-    cp libsecurity_codesigning/lib/SecRequirement.h $dest
-    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
-    cp libsecurity_codesigning/lib/SecTask.h        $dest
-
-    cp libsecurity_cssm/lib/certextensions.h $dest
-    cp libsecurity_cssm/lib/cssm.h           $dest
-    cp libsecurity_cssm/lib/cssmaci.h        $dest
-    cp libsecurity_cssm/lib/cssmapi.h        $dest
-    cp libsecurity_cssm/lib/cssmapple.h      $dest
-    cp libsecurity_cssm/lib/cssmcli.h        $dest
-    cp libsecurity_cssm/lib/cssmconfig.h     $dest
-    cp libsecurity_cssm/lib/cssmcspi.h       $dest
-    cp libsecurity_cssm/lib/cssmdli.h        $dest
-    cp libsecurity_cssm/lib/cssmerr.h        $dest
-    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
-    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
-    cp libsecurity_cssm/lib/cssmspi.h        $dest
-    cp libsecurity_cssm/lib/cssmtpi.h        $dest
-    cp libsecurity_cssm/lib/cssmtype.h       $dest
-    cp libsecurity_cssm/lib/eisl.h           $dest
-    cp libsecurity_cssm/lib/emmspi.h         $dest
-    cp libsecurity_cssm/lib/emmtype.h        $dest
-    cp libsecurity_cssm/lib/oidsbase.h       $dest
-    cp libsecurity_cssm/lib/oidscert.h       $dest
-    cp libsecurity_cssm/lib/oidscrl.h        $dest
-    cp libsecurity_cssm/lib/x509defs.h       $dest
-
-    cp libsecurity_keychain/lib/SecACL.h                $dest
-    cp libsecurity_keychain/lib/SecAccess.h             $dest
-    cp libsecurity_keychain/lib/SecBase.h               $dest
-    cp libsecurity_keychain/lib/SecCertificate.h        $dest
-    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
-    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
-    cp libsecurity_keychain/lib/SecIdentity.h           $dest
-    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
-    cp libsecurity_keychain/lib/SecImportExport.h       $dest
-    cp libsecurity_keychain/lib/SecItem.h               $dest
-    cp libsecurity_keychain/lib/SecKey.h                $dest
-    cp libsecurity_keychain/lib/SecKeychain.h           $dest
-    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
-    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
-    cp libsecurity_keychain/lib/SecPolicy.h             $dest
-    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
-    cp libsecurity_keychain/lib/SecRandom.h             $dest
-    cp libsecurity_keychain/lib/SecTrust.h              $dest
-    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
-    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
-    cp libsecurity_keychain/lib/Security.h              $dest
-
-    cp libsecurity_manifest/lib/SecureDownload.h $dest
-
-    cp libsecurity_mds/lib/mds.h        $dest
-    cp libsecurity_mds/lib/mds_schema.h $dest
-
-    cp libsecurity_ssl/lib/CipherSuite.h     $dest
-    cp libsecurity_ssl/lib/SecureTransport.h $dest
-
-    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
-    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
-    cp libsecurity_transform/lib/SecReadTransform.h          $dest
-    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
-    cp libsecurity_transform/lib/SecTransform.h              $dest
-    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
-
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
index be744fa8873..e04142b8b11 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -1,19 +1,116 @@
-{ stdenv, appleDerivation, xcbuildHook, Foundation, xpc, darling, dtrace, xnu }:
+{ appleDerivation }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook dtrace ];
-  # buildInputs = [ Foundation xpc darling ];
-  buildInputs = [ xpc xnu ];
+  phases = [ "unpackPhase" "installPhase" ];
 
-  xcbuildFlags = "-target Security_frameworks_osx";
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
 
-  # NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
+  installPhase = ''
+    ###### IMPURITIES
+    mkdir -p $out/Library/Frameworks/Security.framework
+    pushd $out/Library/Frameworks/Security.framework
+    ln -s /System/Library/Frameworks/Security.framework/Security
+    ln -s /System/Library/Frameworks/Security.framework/Resources
+    ln -s /System/Library/Frameworks/Security.framework/PlugIns
+    ln -s /System/Library/Frameworks/Security.framework/XPCServices
+    popd
 
-  preBuild = ''
-    dtrace -h -C -s OSX/libsecurity_utilities/lib/security_utilities.d -o OSX/libsecurity_utilities/lib/utilities_dtrace.h
+    ###### HEADERS
+
+    export dest=$out/Library/Frameworks/Security.framework/Headers
+    mkdir -p $dest
+
+    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
+    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
+    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
+    cp libsecurity_asn1/lib/oidsalg.h          $dest
+    cp libsecurity_asn1/lib/oidsattr.h         $dest
+
+    cp libsecurity_authorization/lib/AuthSession.h         $dest
+    cp libsecurity_authorization/lib/Authorization.h       $dest
+    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
+    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
+    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
+
+    cp libsecurity_cms/lib/CMSDecoder.h $dest
+    cp libsecurity_cms/lib/CMSEncoder.h $dest
+
+    cp libsecurity_codesigning/lib/CSCommon.h       $dest
+    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
+    cp libsecurity_codesigning/lib/SecCode.h        $dest
+    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
+    cp libsecurity_codesigning/lib/SecRequirement.h $dest
+    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
+    cp libsecurity_codesigning/lib/SecTask.h        $dest
+
+    cp libsecurity_cssm/lib/certextensions.h $dest
+    cp libsecurity_cssm/lib/cssm.h           $dest
+    cp libsecurity_cssm/lib/cssmaci.h        $dest
+    cp libsecurity_cssm/lib/cssmapi.h        $dest
+    cp libsecurity_cssm/lib/cssmapple.h      $dest
+    cp libsecurity_cssm/lib/cssmcli.h        $dest
+    cp libsecurity_cssm/lib/cssmconfig.h     $dest
+    cp libsecurity_cssm/lib/cssmcspi.h       $dest
+    cp libsecurity_cssm/lib/cssmdli.h        $dest
+    cp libsecurity_cssm/lib/cssmerr.h        $dest
+    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
+    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
+    cp libsecurity_cssm/lib/cssmspi.h        $dest
+    cp libsecurity_cssm/lib/cssmtpi.h        $dest
+    cp libsecurity_cssm/lib/cssmtype.h       $dest
+    cp libsecurity_cssm/lib/eisl.h           $dest
+    cp libsecurity_cssm/lib/emmspi.h         $dest
+    cp libsecurity_cssm/lib/emmtype.h        $dest
+    cp libsecurity_cssm/lib/oidsbase.h       $dest
+    cp libsecurity_cssm/lib/oidscert.h       $dest
+    cp libsecurity_cssm/lib/oidscrl.h        $dest
+    cp libsecurity_cssm/lib/x509defs.h       $dest
+
+    cp libsecurity_keychain/lib/SecACL.h                $dest
+    cp libsecurity_keychain/lib/SecAccess.h             $dest
+    cp libsecurity_keychain/lib/SecBase.h               $dest
+    cp libsecurity_keychain/lib/SecCertificate.h        $dest
+    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
+    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
+    cp libsecurity_keychain/lib/SecIdentity.h           $dest
+    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
+    cp libsecurity_keychain/lib/SecImportExport.h       $dest
+    cp libsecurity_keychain/lib/SecItem.h               $dest
+    cp libsecurity_keychain/lib/SecKey.h                $dest
+    cp libsecurity_keychain/lib/SecKeychain.h           $dest
+    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
+    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
+    cp libsecurity_keychain/lib/SecPolicy.h             $dest
+    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
+    cp libsecurity_keychain/lib/SecRandom.h             $dest
+    cp libsecurity_keychain/lib/SecTrust.h              $dest
+    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
+    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
+    cp libsecurity_keychain/lib/Security.h              $dest
+
+    cp libsecurity_manifest/lib/SecureDownload.h $dest
+
+    cp libsecurity_mds/lib/mds.h        $dest
+    cp libsecurity_mds/lib/mds_schema.h $dest
+
+    cp libsecurity_ssl/lib/CipherSuite.h     $dest
+    cp libsecurity_ssl/lib/SecureTransport.h $dest
+
+    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
+    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
+    cp libsecurity_transform/lib/SecReadTransform.h          $dest
+    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
+    cp libsecurity_transform/lib/SecTransform.h              $dest
+    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
 
-    xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target copyHeadersToSystem
-    NIX_CFLAGS_COMPILE+=" -F./Products/Release"
-    ln -s $PWD/Products/Release/Security.bundle/Contents $PWD/Products/Release/Security.framework
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
new file mode 100644
index 00000000000..6e900335078
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, appleDerivation, xcbuildHook, gnumake, Security
+, libsecurity_utilities, libsecurity_cdsa_utilities }:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities ];
+
+  DSTROOT = "$out";
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  preBuild = ''
+    mkdir -p Security
+    cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
+  '';
+
+  patchPhase = ''
+    substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
+      --replace "/usr/bin/gnumake" "${gnumake}/bin/make"
+    substituteInPlace src/PCSC/PCSC.exp \
+      --replace _PCSCVersionString "" \
+      --replace _PCSCVersionNumber ""
+    substituteInPlace Makefile.installPhase \
+      --replace chown "# chown" \
+      --replace /usr/bin/ ""
+  '';
+
+  installPhase = ''
+    make -f Makefile.installPhase install
+    make -f Makefile-exec.installPhase install
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir -p $out/Library/Frameworks
+    cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
deleted file mode 100644
index 318e2728fc2..00000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
-}:
-
-# this derivation sucks
-# locale data was removed after adv_cmds-118, so our base is that because it's easier than
-# replicating the bizarre bsdmake file structure
-#
-# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
-# longer understand
-#
-# the more recent adv_cmds release is used for everything else in this package
-
-let recentAdvCmds = fetchzip {
-  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
-  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
-};
-
-in appleDerivation {
-  nativeBuildInputs = [ bsdmake perl yacc flex ];
-  buildInputs = [ flex ];
-
-  patchPhase = ''
-    substituteInPlace BSDmakefile \
-      --replace chgrp true \
-      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
-      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
-      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
-      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
-
-    substituteInPlace Makefile --replace perl true
-
-    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
-      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
-        --replace /usr/share/locale "" \
-        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
-        --replace "rsync -a" "cp -r"
-    done
-  '';
-
-  preBuild = ''
-    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
-    pushd colldef
-    mv locale/collate.h .
-    flex -t -8 -i scan.l > scan.c
-    yacc -d parse.y
-    clang *.c -o colldef -lfl
-    popd
-    mv colldef/colldef colldef.tproj/colldef
-
-    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
-    pushd mklocale
-    flex -t -8 -i lex.l > lex.c
-    yacc -d yacc.y
-    clang *.c -o mklocale -lfl
-    popd
-    mv mklocale/mklocale mklocale.tproj/mklocale
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    bsdmake -C usr-share-locale.tproj
-
-    clang ${recentAdvCmds}/ps/*.c -o ps
-  '';
-
-  installPhase = ''
-    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
-
-    # need to get rid of runtime dependency on flex
-    # install -d 0755 $locale/bin
-    # install -m 0755 colldef.tproj/colldef $locale/bin
-    # install -m 0755 mklocale.tproj/mklocale $locale/bin
-
-    install -d 0755 $ps/bin
-    install ps $ps/bin/ps
-    touch "$out"
-  '';
-
-  outputs = [
-    "out"
-    "ps"
-    "locale"
-  ];
-  setOutputFlags = false;
-
-  meta = {
-    platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index ba80ab923bd..a3b12d73a11 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,36 +1,69 @@
-{ stdenv, appleDerivation, xcbuild, ncurses, libutil }:
+{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
+}:
 
-appleDerivation {
-  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
+# this derivation sucks
+# locale data was removed after adv_cmds-118, so our base is that because it's easier than
+# replicating the bizarre bsdmake file structure
+#
+# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
+# longer understand
+#
+# the more recent adv_cmds release is used for everything else in this package
 
-  # pkill requires special private headers that are unavailable in
-  # NixPkgs. These ones are needed:
-  #  - xpc/xpxc.h
-  #  - os/base_private.h
-  #  - _simple.h
-  # We disable it here for now. TODO: build pkill inside adv_cmds
+let recentAdvCmds = fetchzip {
+  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
+  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
+};
+
+in appleDerivation {
+  nativeBuildInputs = [ bsdmake perl yacc flex ];
+  buildInputs = [ flex ];
 
-  # We also disable locale here because of some issues with a missing
-  # "lstdc++".
   patchPhase = ''
-    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
-      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
-      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
-      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+    substituteInPlace BSDmakefile \
+      --replace chgrp true \
+      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
+      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
+      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
+      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
+
+    substituteInPlace Makefile --replace perl true
+
+    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
+      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
+        --replace /usr/share/locale "" \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
+        --replace "rsync -a" "cp -r"
+    done
+  '';
+
+  preBuild = ''
+    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+    pushd colldef
+    mv locale/collate.h .
+    flex -t -8 -i scan.l > scan.c
+    yacc -d parse.y
+    clang *.c -o colldef -lfl
+    popd
+    mv colldef/colldef colldef.tproj/colldef
+
+    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
+    pushd mklocale
+    flex -t -8 -i lex.l > lex.c
+    yacc -d yacc.y
+    clang *.c -o mklocale -lfl
+    popd
+    mv mklocale/mklocale mklocale.tproj/mklocale
   '';
 
   buildPhase = ''
-    targets=$(xcodebuild -list \
-                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
-                | tail -n +2 | sed 's/^[ \t]*//' \
-                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
+    runHook preBuild
 
-    for i in $targets; do
-      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
-    done
+    bsdmake -C usr-share-locale.tproj
+
+    clang ${recentAdvCmds}/ps/*.c -o ps
   '';
 
-  # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     for f in Products/Release/*; do
       if [ -f $f ]; then
@@ -43,19 +76,27 @@ appleDerivation {
       install */*.$n $out/share/man/man$n
     done
 
-    mkdir -p $out/System/Library/LaunchDaemons
-    install fingerd/finger.plist $out/System/Library/LaunchDaemons
+    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
+
+    # need to get rid of runtime dependency on flex
+    # install -d 0755 $locale/bin
+    # install -m 0755 colldef.tproj/colldef $locale/bin
+    # install -m 0755 mklocale.tproj/mklocale $locale/bin
 
-    # from variant_links.sh
-    # ln -s $out/bin/pkill $out/bin/pgrep
-    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
+    install -d 0755 $ps/bin
+    install ps $ps/bin/ps
+    touch "$out"
   '';
 
-  nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil ];
+  outputs = [
+    "out"
+    "ps"
+    "locale"
+  ];
+  setOutputFlags = false;
 
   meta = {
     platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
new file mode 100644
index 00000000000..7b1492799dd
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
@@ -0,0 +1,58 @@
+{ stdenv, appleDerivation, xcbuild, ncurses, libutil-new }:
+
+appleDerivation {
+  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
+
+  # pkill requires special private headers that are unavailable in
+  # NixPkgs. These ones are needed:
+  #  - xpc/xpxc.h
+  #  - os/base_private.h
+  #  - _simple.h
+  # We disable it here for now. TODO: build pkill inside adv_cmds
+
+  # We also disable locale here because of some issues with a missing
+  # "lstdc++".
+  patchPhase = ''
+    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
+      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
+      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
+      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+  '';
+
+  buildPhase = ''
+    targets=$(xcodebuild -list \
+                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
+                | tail -n +2 | sed 's/^[ \t]*//' \
+                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
+
+    for i in $targets; do
+      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
+    done
+  '';
+
+  # temporary install phase until xcodebuild has "install" support
+  installPhase = ''
+    mkdir -p $out/bin/
+    install Products/Release/* $out/bin/
+
+    for n in 1 8; do
+      mkdir -p $out/share/man/man$n
+      install */*.$n $out/share/man/man$n
+    done
+
+    mkdir -p $out/System/Library/LaunchDaemons
+    install fingerd/finger.plist $out/System/Library/LaunchDaemons
+
+    # from variant_links.sh
+    # ln -s $out/bin/pkill $out/bin/pgrep
+    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
+  '';
+
+  nativeBuildInputs = [ xcbuild ];
+  buildInputs = [ ncurses libutil-new ];
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
index 256781f61b1..591e7bd5230 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
@@ -32,7 +32,6 @@ appleDerivation {
     chmod +x mig.sh
     cp mig.sh   $out/bin/mig
     cp migcom   $out/libexec
-    ln -s $out/libexec/migcom $out/bin/migcom
     cp mig.1    $out/share/man/man1
     cp migcom.1 $out/share/man/man1
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index a1440c93709..4fa0c0e3e47 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -6,31 +6,9 @@ let
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
   # now it's staying here.
   versions = {
-    "osx-10.12.6" = {
-      xnu           = "3789.70.16";
-      libiconv      = "50";
-      Libnotify     = "165.20.1";
-      objc4         = "709.1";
-      dyld          = "433.5";
-      CommonCrypto  = "60092.50.5";
-      copyfile      = "138";
-      ppp           = "838.50.1";
-      libclosure    = "67";
-      Libinfo       = "503.50.4";
-      Libsystem     = "1238.60.2";
-      removefile    = "45";
-      libresolv     = "64";
-      libplatform   = "126.50.8";
-      mDNSResponder = "765.50.9";
-      libutil       = "47.30.1";
-      libunwind     = "35.3";
-      Libc          = "1158.50.2";
-      dtrace        = "209.50.12";
-      libpthread    = "218.60.3";
-      hfs           = "366.70.1";
-    };
     "osx-10.11.6" = {
       PowerManagement = "572.50.1";
+      SmartCardServices = "55111";
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
@@ -80,6 +58,7 @@ let
       ICU           = "531.48";
       libdispatch   = "442.1.4";
       Security      = "57031.40.6";
+      security_systemkeychain = "55202";
 
       IOAudioFamily                        = "203.3";
       IOFireWireFamily                     = "458";
@@ -115,6 +94,28 @@ let
     "osx-10.8.4" = {
       IOUSBFamily = "560.4.2";
     };
+    "osx-10.7.5" = {
+      libsecurity_apple_csp      = "55003";
+      libsecurity_apple_cspdl    = "55000";
+      libsecurity_apple_file_dl  = "55000";
+      libsecurity_apple_x509_cl  = "55004";
+      libsecurity_apple_x509_tp  = "55009.3";
+      libsecurity_asn1           = "55000.2";
+      libsecurity_cdsa_client    = "55000";
+      libsecurity_cdsa_plugin    = "55001";
+      libsecurity_cdsa_utilities = "55006";
+      libsecurity_cdsa_utils     = "55000";
+      libsecurity_codesigning    = "55037.15";
+      libsecurity_cssm           = "55005.5";
+      libsecurity_filedb         = "55016.1";
+      libsecurity_keychain       = "55050.9";
+      libsecurity_mds            = "55000";
+      libsecurity_ocspd          = "55010";
+      libsecurity_pkcs12         = "55000";
+      libsecurity_sd_cspdl       = "55003";
+      libsecurity_utilities      = "55030.3";
+      libsecurityd               = "55004";
+    };
     "osx-10.7.4" = {
       Libm = "2026";
     };
@@ -165,6 +166,10 @@ let
       callPackage = pkgs.newScope (packages // pkgs.darwin // { inherit appleDerivation name version; });
     in callPackage (./. + "/${namePath}");
 
+  libsecPackage = pkgs.callPackage ./libsecurity_generic {
+    inherit applePackage appleDerivation_;
+  };
+
   IOKitSpecs = {
     IOAudioFamily                        = fetchApple "osx-10.10.5" "0ggq7za3iq8g02j16rj67prqhrw828jsw3ah3bxq8a1cvr55aqnq";
     IOFireWireFamily                     = fetchApple "osx-10.10.5" "059qa1m668kwvchl90cqcx35b31zaqdg61zi11y1imn5s389y2g1";
@@ -189,58 +194,60 @@ let
 
   IOKitSrcs = stdenv.lib.mapAttrs (name: value: if stdenv.lib.isFunction value then value name else value) IOKitSpecs;
 
-  # Only used for bootstrapping. It’s convenient because it was the last version to come with a real makefile.
-  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
+  adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
 
   packages = {
-    inherit (adv_cmds-boot) ps locale;
+    SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
+
+    inherit (adv_cmds) ps locale;
     architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
     bootstrap_cmds  = applePackage "bootstrap_cmds"    "dev-tools-7.0"   "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
     bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "11a9kkhz5bfgi1i8kpdkis78lhc6b5vxmhd598fcdgra1jw4iac2" {};
     CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "1zam29847cxr6y9rnl76zqmkbac53nx0szmqm9w5p469a6wzjqar" {};
-    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "0sgsqjcxbdm2g2zfpc50mzmk4b4ldyw7xvvkwiayhpczg1fga4ff" {};
-    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
-      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
-    };
-    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "0a70bvzndkava1a946cdq42lnjhg7i7b5alpii3lap6r5fkvas0n" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.11.6"     "0vllfpb8f4f97wj2vpdd7w5k9ibnsbr6ff1zslpp6q323h01n25y" {};
+    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
+    copyfile        = applePackage "copyfile"          "osx-10.11.6"     "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "0hpd6348av463yqf70n3xkygwmf1i5zza8kps4zys52sviqz3a0l" {};
-    dyld            = applePackage "dyld"              "osx-10.12.6"     "0q4jmk78b5ajn33blh4agyq6v2a63lpb3fln78az0dy12bnp1qqk" {};
+    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dtrace-xcode    = applePackage "dtrace/xcode.nix"  "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
+
+    # Splicing is currently broken in Nixpkgs
+    # cctools need to be specified manually here to handle this
     ICU             = applePackage "ICU"               "osx-10.10.5"     "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
+
     IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
     launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
     libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
-    Libc            = applePackage "Libc"              "osx-10.12.6"     "183wcy1nlj2wkpfsx3k3lyv917mk8r2p72qw8lb89mbjsw3yw0xx" {
+    Libc            = applePackage "Libc"              "osx-10.11.5"     "1qv7r0dgz06jy9i5agbqzxgdibb0m8ylki6g5n5pary88lzrawfd" {
       Libc_10-9 = fetchzip {
         url    = "http://www.opensource.apple.com/tarballs/Libc/Libc-997.90.3.tar.gz";
         sha256 = "1xchgxkxg5288r2b9yfrqji2gsgdap92k4wx2dbjwslixws12pq7";
       };
-      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     };
+    Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     libclosure      = applePackage "libclosure"        "osx-10.11.6"     "1zqy1zvra46cmqv6vsf1mcsz3a76r9bky145phfwh4ab6y15vjpq" {};
     libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "0jsfbzp87lwk9snlby0hd4zvj7j894p5q3cw0wdx9ny1mcp3kdcj" {};
-    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "1gg5h6z8sk851bhv87vyxzs54jmqz6lh57ny8j4s51j7srja0nly" {};
+    libiconv        = applePackage "libiconv"          "osx-10.11.6"     "11h6lfajydri4widis62q8scyz7z8l6msqyx40ly4ahsdlbl0981" {};
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "0p5qhvalf6j1w6n8xwywhn6dvbpzv74q5wqrgs8rwfpf74wg6s9z" {};
-    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
-    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
-    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {
-      libutil = pkgs.darwin.libutil.override { headersOnly = true; };
-      hfs = pkgs.darwin.hfs.override { headersOnly = true; };
-    };
-    libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
-    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
-    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
-    objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
-    ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
-    removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
-    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {};
-    hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.11.6"     "0zbcyxlcfhf91jxczhd5bq9qfgvg494gwwp3l7q5ayb2qdihzr8b" {};
+    libplatform     = applePackage "libplatform"       "osx-10.11.6"     "1v4ik6vlklwsi0xb1g5kmhy29j9xk5m2y8xb9zbi1k4ng8x39czk" {};
+    libpthread      = applePackage "libpthread"        "osx-10.11.6"     "1kbw738cmr9pa7pz1igmajs307clfq7gv2vm1sqdzhcnnjxbl28w" {};
+    libresolv       = applePackage "libresolv"         "osx-10.11.6"     "09flfdi3dlzq0yap32sxidacpc4nn4va7z12a6viip21ix2xb2gf" {};
+    Libsystem       = applePackage "Libsystem"         "osx-10.11.6"     "1nfkmbqml587v2s1d1y2s2v8nmr577jvk51y6vqrfvsrhdhc2w94" {};
+    libutil         = applePackage "libutil"           "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
+    libutil-new     = applePackage "libutil/new.nix"   "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
+    libunwind       = applePackage "libunwind"         "osx-10.11.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.11.6"     "069incq28a78yh1bnr17h9cd5if5mwqpq8ahnkyxxx25fkaxgzcf" {};
+    objc4           = applePackage "objc4"             "osx-10.11.6"     "00b7vbgxni8frrqyi69b4njjihlwydzjd9zj9x4z5dbx8jabkvrj" {};
+    ppp             = applePackage "ppp"               "osx-10.11.6"     "1dql6r1v0vbcs04958nn2i6p31yfsxyy51jca63bm5mf0gxalk3f" {};
+    removefile      = applePackage "removefile"        "osx-10.11.6"     "1b6r74ry3k01kypvlaclf33fha15pcm0kzx9zrymlg66wg0s0i3r" {};
+    Security        = applePackage "Security"          "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    xnu             = applePackage "xnu"               "osx-10.11.6"     "0yhziq4dqqcbjpf6vyqn8xhwva2zb525gndkx8cp8alzwp76jnr9" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
+    adv_cmds        = applePackage "adv_cmds/xcode.nix" "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
     diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
@@ -252,8 +259,28 @@ let
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
-    # TODO(matthewbauer):
-    # To be removed, once I figure out how to build a newer Security version.
-    Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
+
+    libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
+    libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
+    libsecurity_apple_file_dl  = libsecPackage "libsecurity_apple_file_dl"  "osx-10.7.5" "1dfqani3n135i3iqmafc1k9awmz6s0a78zifhk15rx5a8ps870bl" {};
+    libsecurity_apple_x509_cl  = libsecPackage "libsecurity_apple_x509_cl"  "osx-10.7.5" "1gji2i080560s08k1nigsla1zdmi6slyv97xaj5vqxjpxb0g1xf5" {};
+    libsecurity_apple_x509_tp  = libsecPackage "libsecurity_apple_x509_tp"  "osx-10.7.5" "1bsms3nvi62wbvjviwjhjhzhylad8g6vmvlj3ngd0wyd0ywxrs46" {};
+    libsecurity_asn1           = libsecPackage "libsecurity_asn1"           "osx-10.7.5" "0i8aakjxdfj0lqcgqmbip32g7r4h57xhs8w0sxfvfl45q22s782w" {};
+    libsecurity_cdsa_client    = libsecPackage "libsecurity_cdsa_client"    "osx-10.7.5" "127jxnypkycy8zqwicfv333h11318m00gd37jnswbrpg44xd1wdy" {};
+    libsecurity_cdsa_plugin    = libsecPackage "libsecurity_cdsa_plugin"    "osx-10.7.5" "0ifmx85rs51i7zjm015s8kc2dqyrlvbr39lw9xzxgd2ds33i4lfj" {};
+    libsecurity_cdsa_utilities = libsecPackage "libsecurity_cdsa_utilities" "osx-10.7.5" "1kzsl0prvfa8a0m3j3pcxq06aix1csgayd3lzx27iqg84c8mhzan" {};
+    libsecurity_cdsa_utils     = libsecPackage "libsecurity_cdsa_utils"     "osx-10.7.5" "0q55jizav6n0lkj7lcmcr2mjdhnbnnn525fa9ipwgvzbspihw0g6" {};
+    libsecurity_codesigning    = libsecPackage "libsecurity_codesigning"    "osx-10.7.5" "0vf5nj2g383b4hknlp51qll5pm8z4qbf56dnc16n3wm8gj82iasy" {};
+    libsecurity_cssm           = libsecPackage "libsecurity_cssm"           "osx-10.7.5" "0l6ia533bhr8kqp2wa712bnzzzisif3kbn7h3bzzf4nps4wmwzn4" {};
+    libsecurity_filedb         = libsecPackage "libsecurity_filedb"         "osx-10.7.5" "1r0ik95xapdl6l2lhd079vpq41jjgshz2hqb8490gpy5wyc49cxb" {};
+    libsecurity_keychain       = libsecPackage "libsecurity_keychain"       "osx-10.7.5" "15wf2slcgyns61kk7jndgm9h22vidyphh9x15x8viyprra9bkhja" {};
+    libsecurity_mds            = libsecPackage "libsecurity_mds"            "osx-10.7.5" "0vin5hnzvkx2rdzaaj2gxmx38amxlyh6j24a8gc22y09d74p5lzs" {};
+    libsecurity_ocspd          = libsecPackage "libsecurity_ocspd"          "osx-10.7.5" "1bxzpihc6w0ji4x8810a4lfkq83787yhjl60xm24bv1prhqcm73b" {};
+    libsecurity_pkcs12         = libsecPackage "libsecurity_pkcs12"         "osx-10.7.5" "1yq8p2sp39q40fxshb256b7jn9lvmpymgpm8yz9kqrf980xddgsg" {};
+    libsecurity_sd_cspdl       = libsecPackage "libsecurity_sd_cspdl"       "osx-10.7.5" "10v76xycfnvz1n0zqfbwn3yh4w880lbssqhkn23iim3ihxgm5pbd" {};
+    libsecurity_utilities      = libsecPackage "libsecurity_utilities"      "osx-10.7.5" "0ayycfy9jm0n0c7ih9f3m69ynh8hs80v8yicq47aa1h9wclbxg8r" {};
+    libsecurityd               = libsecPackage "libsecurityd"               "osx-10.7.5" "1ywm2qj8l7rhaxy5biwxsyavd0d09d4bzchm03nlvwl313p2747x" {};
+    security_dotmac_tp         = libsecPackage "security_dotmac_tp"         "osx-10.9.5" "1l4fi9qhrghj0pkvywi8da22bh06c5bv3l40a621b5g258na50pl" {};
   };
 in packages
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index 4da9144bbe1..0f46e50de3a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -1,9 +1,9 @@
 { stdenv, appleDerivation, xcbuildHook
-, Libc, xnu, libutil }:
+, Libc, xnu, libutil-new }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ libutil ];
+  buildInputs = [ libutil-new ];
 
   NIX_CFLAGS_COMPILE = "-I.";
   NIX_LDFLAGS = "-lutil";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 8706d22be19..fd2c95563b4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -1,53 +1,50 @@
-{ appleDerivation, xcbuildHook, CoreSymbolication
-, xnu, bison, flex, darling, stdenv, fixDarwinDylibNames }:
+{ appleDerivation, cctools, zlib }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
-  buildInputs = [ CoreSymbolication darling xnu ];
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
-  NIX_LDFLAGS = "-L./Products/Release";
-  xcbuildFlags = "-target dtrace_frameworks -target dtrace";
-
-  doCheck = false;
-  checkPhase = "xcodebuild -target dtrace_tests";
-
-  postPatch = ''
-    substituteInPlace dtrace.xcodeproj/project.pbxproj \
-      --replace "/usr/sbin" ""
-    substituteInPlace libdtrace/dt_open.c \
-      --replace /usr/bin/clang ${stdenv.cc.cc}/bin/clang \
-      --replace /usr/bin/ld ${stdenv.cc.bintools.bintools}/bin/ld \
-      --replace /usr/lib/dtrace/dt_cpp.h $out/include/dt_cpp.h \
-      --replace /usr/lib/dtrace $out/lib/dtrace
-  '';
-
-  # hack to handle xcbuild's broken lex handling
-  preBuild = ''
-    pushd libdtrace
-    yacc -d dt_grammar.y
-    flex -l -d dt_lex.l
+  buildInputs = [ cctools zlib ];
+
+  buildPhase = ''
+    export CFLAGS=" -I$PWD/head -I$PWD/sys -I$PWD/libelf -I$PWD/libdwarf"
+
+    pushd libelf
+    for f in *.c; do
+      if [ "$f" != "lintsup.c" ]; then # Apple doesn't use it, so I don't either
+        cc -D_INT64_TYPE -D_LONGLONG_TYPE -D_ILP32 $CFLAGS -c $f
+      fi
+    done
+    libtool -static -o libelf.a *.o
     popd
 
-    substituteInPlace dtrace.xcodeproj/project.pbxproj \
-      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
-      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
-  '';
+    pushd libdwarf
+    ./configure CFLAGS="$CFLAGS -Icmplrs"
+    make
+    popd
 
-  # xcbuild doesn't support install
-  installPhase = ''
-    mkdir -p $out
+    cp libelf/libelf.a     tools/ctfconvert
+    cp libdwarf/libdwarf.a tools/ctfconvert
 
-    cp -r Products/Release/usr/include $out/include
-    cp scripts/dt_cpp.h $out/include/dt_cpp.h
+    pushd tools/ctfconvert
+    for f in ../../darwin_shim.c *.c; do
+      cc -DNDEBUG -DNS_BLOCK_ASSERTIONS $CFLAGS -c $f
+    done
 
-    mkdir $out/lib
-    cp Products/Release/*.dylib $out/lib
+    export COMMON="alist.o ctf.o darwin_shim.o hash.o iidesc.o input.o list.o \
+      memory.o output.o stack.o strtab.o symbol.o tdata.o traverse.o util.o"
 
-    mkdir $out/bin
-    cp Products/Release/dtrace $out/bin
+    export CONVERT="ctfconvert.o dwarf.o merge.o st_bugs.o st_parse.o stabs.o"
+    export MERGE="barrier.o ctfmerge.o dwarf.o fifo.o merge.o st_bugs.o st_parse.o stabs.o utils.o"
+    export DUMP="dump.o fifo.o utils.o"
 
-    mkdir -p $out/lib/dtrace
+    clang -o ctfconvert $CONVERT $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfmerge   $MERGE   $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfdump    $DUMP    $COMMON -L. -lz -lelf
+    popd
+  '';
 
-    install_name_tool -change $PWD/Products/Release/libdtrace.dylib $out/lib/libdtrace.dylib $out/bin/dtrace
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tools/ctfconvert/ctfconvert $out/bin
+    cp tools/ctfconvert/ctfmerge   $out/bin
+    cp tools/ctfconvert/ctfdump    $out/bin
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
new file mode 100644
index 00000000000..f8636403ed5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
@@ -0,0 +1,47 @@
+{ appleDerivation, xcbuildHook, CoreSymbolication
+, xnu, bison, flex, darling, stdenv }:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook flex bison ];
+  buildInputs = [ CoreSymbolication darling ];
+  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
+  NIX_LDFLAGS = "-L./Products/Release";
+  xcbuildFlags = "-target dtrace";
+
+  patchPhase = ''
+    substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
+    substituteInPlace libdtrace/dt_open.c \
+      --replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
+      --replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
+      --replace "/usr/bin/dtrace" $out/lib/dtrace
+  '';
+
+  # hack to handle xcbuild's broken lex handling
+  preBuild = ''
+    cd libdtrace
+    yacc -d dt_grammar.y
+    flex -l -d dt_lex.l
+    cd ..
+
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
+      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+  '';
+
+  # xcbuild doesn't support install
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r Products/Release/usr $out
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir $out/lib
+    cp Products/Release/*.dylib $out/lib
+
+    mkdir $out/bin
+    cp Products/Release/dtrace $out/bin
+
+    mkdir -p $out/lib/dtrace
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index 96dae723b2e..c2320525322 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil }:
+{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil-new }:
 
 appleDerivation rec {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ zlib bzip2 lzma ncurses libutil ];
+  buildInputs = [ zlib bzip2 lzma ncurses libutil-new ];
 
   # some commands not working:
   # mtree: _simple.h not found
diff --git a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
deleted file mode 100644
index ab294b143d3..00000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ appleDerivation, lib, headersOnly ? false }:
-
-appleDerivation {
-  installPhase = lib.optionalString headersOnly ''
-    mkdir -p $out/include/hfs
-    cp core/*.h $out/include/hfs
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
new file mode 100644
index 00000000000..ca263228fde
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_csp
+
+security_apple_csp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_csp_HEADER_FILES_DIR = lib
+
+security_apple_csp_CC_FILES = $(wildcard lib/*.cpp)
+security_apple_csp_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
new file mode 100644
index 00000000000..639d377d1b6
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
@@ -0,0 +1,31 @@
+{ appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_utilities, CommonCrypto, stdenv }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurity_cdsa_plugin
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+  ];
+  NIX_CFLAGS_COMPILE = "-Iopen_ssl";
+  patchPhase = ''
+    for file in lib/BlockCryptor.h lib/RSA_DSA_signature.h lib/castContext.h \
+      lib/RawSigner.h lib/MD2Object.h lib/HMACSHA1.h lib/bfContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '"CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h"' \
+        '"${stdenv.lib.getDev apple_sdk.sdk}/include/MacTypes.h"'
+    done
+
+    for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '/usr/local/include/CommonCrypto/CommonCryptorSPI.h' \
+        '${CommonCrypto}/include/CommonCrypto/CommonCryptorSPI.h'
+    done
+    
+    substituteInPlace lib/opensshWrap.cpp --replace RSA_DSA_Keys.h RSA_DSA_keys.h
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/pbkdf2.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/ConditionalMacros.h>' \
+      '"${stdenv.libc}/include/ConditionalMacros.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
new file mode 100644
index 00000000000..a0d48cf4965
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_cspdl
+
+security_apple_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_cspdl_HEADER_FILES_DIR = lib
+
+security_apple_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
new file mode 100644
index 00000000000..b80d4c8aad2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
@@ -0,0 +1,16 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
new file mode 100644
index 00000000000..f52829c644d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_file_dl
+
+security_apple_file_dl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_file_dl_HEADER_FILES_DIR = lib
+
+security_apple_file_dl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
new file mode 100644
index 00000000000..0eb2ee10fd8
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
@@ -0,0 +1,17 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
new file mode 100644
index 00000000000..c7c9c3d4e79
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_cl
+
+security_apple_x509_cl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_cl_HEADER_FILES_DIR = lib
+
+security_apple_x509_cl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
new file mode 100644
index 00000000000..c5e9418ce91
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
@@ -0,0 +1,18 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
new file mode 100644
index 00000000000..166b4e631c8
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_tp
+
+security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_tp_HEADER_FILES_DIR = lib
+
+security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
+security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
new file mode 100644
index 00000000000..6410c134f89
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
@@ -0,0 +1,19 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_ocspd, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+    libsecurity_ocspd
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
new file mode 100644
index 00000000000..1c3c4f0b25b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_asn1
+
+security_asn1_C_FILES = $(wildcard lib/*.c)
+security_asn1_CC_FILES = $(wildcard lib/*.cpp)
+
+security_asn1_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_asn1_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
new file mode 100644
index 00000000000..a1c3204c15a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
+  propagatedBuildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
new file mode 100644
index 00000000000..91fb6bb679e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_client
+
+security_cdsa_client_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_client_HEADER_FILES_DIR = lib
+
+security_cdsa_client_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
new file mode 100644
index 00000000000..2ecad568bf7
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
new file mode 100644
index 00000000000..9e1260f9b9c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_plugin
+
+security_cdsa_plugin_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_plugin_HEADER_FILES_DIR = lib
+
+security_cdsa_plugin_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
new file mode 100644
index 00000000000..b2dbb75f297
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_cssm, libsecurity_utilities, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    perl
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cssm.src}
+    cp libsecurity_cssm*/lib/cssm{dli,aci,cli,cspi,tpi}.h lib
+  '';
+  preBuild = ''
+    perl lib/generator.pl lib lib/generator.cfg lib lib || exit 1
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
new file mode 100644
index 00000000000..24bc1fe7e3a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utilities
+
+security_cdsa_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utilities_HEADER_FILES_DIR = lib
+
+security_cdsa_utilities_CC_FILES = $(wildcard lib/*.cpp) lib/Schema.cpp lib/KeySchema.cpp
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
new file mode 100644
index 00000000000..26515353b73
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
@@ -0,0 +1,13 @@
+{ CommonCrypto, appleDerivation, libsecurity_codesigning, libsecurity_utilities, m4 }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    m4
+  ];
+  patchPhase = ''
+    patch -p1 < ${./handletemplates.patch}
+    unpackFile ${libsecurity_codesigning.src}
+    mv libsecurity_codesigning*/lib security_codesigning
+  '';
+  NIX_CFLAGS_COMPILE = "-I${CommonCrypto}/include/CommonCrypto";
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
new file mode 100644
index 00000000000..e5a703b2a08
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
@@ -0,0 +1,19 @@
+--- a/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
++++ b/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
+@@ -32,6 +32,7 @@
+ #include <security_utilities/threading.h>
+ #include <security_utilities/globalizer.h>
+ #include <security_cdsa_utilities/cssmerrors.h>
++#include <vector>
+ 
+ #if __GNUC__ > 2
+ #include <ext/hash_map>
+@@ -129,7 +130,7 @@
+     // @@@  Remove when 4003540 is fixed
+     template <class Subtype>
+     static void findAllRefs(std::vector<_Handle> &refs) {
+-        state().findAllRefs<Subtype>(refs);
++        state().template findAllRefs<Subtype>(refs);
+     }
+     
+ protected:
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
new file mode 100644
index 00000000000..7b5b7dc186a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utils
+
+security_cdsa_utils_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utils_HEADER_FILES_DIR = lib
+
+security_cdsa_utils_CC_FILES = $(wildcard lib/*.cpp)
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
new file mode 100644
index 00000000000..e5637d6db41
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, m4 }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    m4
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
new file mode 100644
index 00000000000..e923b962c26
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_codesigning
+
+security_codesigning_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_codesigning_HEADER_FILES_DIR = lib
+
+security_codesigning_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
new file mode 100644
index 00000000000..f5035a06f1e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -0,0 +1,33 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
+, Security, xnu, xar, antlr, libsecurityd, apple_sdk
+, dtrace-xcode, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
+                  Security xar antlr libsecurityd ];
+  NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
+  patchPhase = ''
+    substituteInPlace lib/policydb.cpp \
+      --replace "new MutableDictionary::MutableDictionary()" NULL
+    substituteInPlace lib/xpcengine.h \
+      --replace "#include <xpc/private.h>" ""
+    substituteInPlace lib/policyengine.cpp \
+      --replace "#include <OpenScriptingUtilPriv.h>" ""
+
+    rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
+  '';
+  preBuild = ''
+    mkdir -p include
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
+    mkdir -p include/CoreServices/
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
+
+    unpackFile ${Security.src}
+    mkdir -p include/securityd_client
+    cp Security-*/libsecurityd/lib/*.h include/securityd_client
+    mkdir -p include/xpc
+    cp ${apple_sdk.sdk.out}/include/xpc/*.h include/xpc
+
+    sed -i '1i #define bool int' lib/security_codesigning.d
+    dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
new file mode 100644
index 00000000000..c7835aaa9b0
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cssm
+
+security_cssm_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cssm_HEADER_FILES_DIR = lib
+
+security_cssm_CC_FILES = $(wildcard lib/*.cpp)
+security_cssm_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
new file mode 100644
index 00000000000..cf9fe411533
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_client
+    perl
+    libsecurity_cdsa_plugin
+  ];
+  preBuild = ''
+    mkdir derived_src
+    perl lib/generator.pl lib lib/generator.cfg derived_src
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
new file mode 100644
index 00000000000..4359810c56b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_filedb
+
+security_filedb_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_filedb_HEADER_FILES_DIR = lib
+
+security_filedb_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
new file mode 100644
index 00000000000..435cd0f069f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -0,0 +1,13 @@
+{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk, lib }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_plugin
+  ];
+  patchPhase = ''
+    cp ${osx_private_sdk}/include/sandbox_private.h .
+    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${lib.getDev apple_sdk.sdk}/include/sandbox.h"'
+    substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
new file mode 100644
index 00000000000..714524e8da5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -0,0 +1,63 @@
+{ appleDerivation_, applePackage, pkgs, stdenv }:
+name: version: sha256: args: let
+  n = stdenv.lib.removePrefix "lib" name;
+  makeFile = ../. + "/${name}/GNUmakefile";
+  appleDerivation = appleDerivation_ name version sha256;
+  in applePackage name version sha256 (args // {
+    appleDerivation = a:
+    appleDerivation (stdenv.lib.mergeAttrsConcatenateValues {
+      __impureHostDeps = import ./impure_deps.nix;
+
+      patchPhase = ''
+        # allows including <Security/some-private-header.h>
+        cp -R ${pkgs.darwin.osx_private_sdk}/include/SecurityPrivateHeaders Security
+
+        grep -Rl MacErrors.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+            '"${pkgs.darwin.apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+        done || true # grep returns 1 if it can't find the string
+
+        grep -Rl MacTypes.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+            '"${stdenv.lib.getDev pkgs.darwin.apple_sdk.sdk}/include/MacTypes.h"'
+        done || true # grep returns 1 if it can't find the string
+      '';
+      preBuild = ''
+        ln -s lib ${n}
+        makeFlagsArray=(-j$NIX_BUILD_CORES)
+      '';
+      outputs = [ "out" "dev" ];
+      buildInputs = [
+        pkgs.gnustep.make
+        pkgs.darwin.apple_sdk.frameworks.AppKit
+        pkgs.darwin.apple_sdk.frameworks.Foundation
+      ];
+      makeFlags = [
+        "-f${makeFile}"
+        "MAKEFILE_NAME=${makeFile}"
+        "GNUSTEP_ABSOLUTE_INSTALL_PATHS=yes"
+        "GNUSTEP_MAKEFILES=${pkgs.gnustep.make}/share/GNUstep/Makefiles"
+        "LIB_LINK_INSTALL_DIR=\$(out)/lib"
+      ];
+      installFlags = [
+        "${n}_INSTALL_DIR=\$(out)/lib"
+        "${n}_HEADER_FILES_INSTALL_DIR=\$(out)/include/${n}"
+        "GNUSTEP_HEADERS="
+      ];
+      NIX_CFLAGS_COMPILE = [
+        "-isystem lib"
+        "-iframework ${pkgs.darwin.Security}/Library/Frameworks"
+        "-I."
+        "-Wno-deprecated-declarations"
+        "-DNDEBUG"
+      ];
+      NIX_LDFLAGS = with pkgs.darwin; with apple_sdk.frameworks; [
+        "-L${libobjc}/lib"
+        "-F${Foundation}/Library/Frameworks"
+        "-F${AppKit}/Library/Frameworks"
+        "-no_dtrace_dof"
+      ];
+    } a);
+  })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
new file mode 100644
index 00000000000..7725b9f3d1a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
@@ -0,0 +1,129 @@
+# generated using a ruby script
+[
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib"
+  "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis"
+  "/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox"
+  "/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit"
+  "/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition"
+  "/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio"
+  "/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth"
+  "/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData"
+  "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
+  "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit"
+  "/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText"
+  "/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo"
+  "/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN"
+  "/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration"
+  "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"
+  "/System/Library/Frameworks/GSS.framework/Versions/A/GSS"
+  "/System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth"
+  "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit"
+  "/System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib"
+  "/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos"
+  "/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS"
+  "/System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage.framework/Versions/A/CoreImage"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore"
+  "/System/Library/Frameworks/Security.framework/Versions/A/Security"
+  "/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation"
+  "/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement"
+  "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration"
+  "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
+  "/System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG"
+  "/System/Library/PrivateFrameworks/AppleVPA.framework/Versions/A/AppleVPA"
+  "/System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup"
+  "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
+  "/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth"
+  "/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication"
+  "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
+  "/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi"
+  "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
+  "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
+  "/System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols"
+  "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
+  "/System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore"
+  "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
+  "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal"
+  "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
+  "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
+  "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
+  "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
+  "/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis"
+  "/System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices"
+  "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
+  "/System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore"
+  "/System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication"
+  "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
+  "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+  "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
+  "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
+  "/usr/lib/libCRFSuite.dylib"
+  "/usr/lib/libOpenScriptingUtil.dylib"
+  "/usr/lib/libarchive.2.dylib"
+  "/usr/lib/libbsm.0.dylib"
+  "/usr/lib/libbz2.1.0.dylib"
+  "/usr/lib/libc++.1.dylib"
+  "/usr/lib/libc++abi.dylib"
+  "/usr/lib/libcmph.dylib"
+  "/usr/lib/libcups.2.dylib"
+  "/usr/lib/libextension.dylib"
+  "/usr/lib/libheimdal-asn1.dylib"
+  "/usr/lib/libiconv.2.dylib"
+  "/usr/lib/libicucore.A.dylib"
+  "/usr/lib/liblangid.dylib"
+  "/usr/lib/liblzma.5.dylib"
+  "/usr/lib/libmecabra.dylib"
+  "/usr/lib/libpam.2.dylib"
+  "/usr/lib/libresolv.9.dylib"
+  "/usr/lib/libsqlite3.dylib"
+  "/usr/lib/libxar.1.dylib"
+  "/usr/lib/libxml2.2.dylib"
+  "/usr/lib/libxslt.1.dylib"
+  "/usr/lib/libz.1.dylib"
+]
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
new file mode 100644
index 00000000000..8830006f00e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_keychain
+
+security_keychain_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_keychain_HEADER_FILES_DIR = lib
+
+security_keychain_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
new file mode 100644
index 00000000000..724c4788b6c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -0,0 +1,43 @@
+{ CF, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp, lib }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurity_cdsa_utilities
+    libsecurityd
+    CF
+    libsecurity_asn1
+    libsecurity_pkcs12
+    libsecurity_cdsa_utils
+    openssl
+    libsecurity_ocspd
+    security_dotmac_tp
+  ];
+  patchPhase = ''
+    substituteInPlace lib/Keychains.cpp --replace DLDbListCFPref.h DLDBListCFPref.h
+
+    substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
+
+    cp ${osx_private_sdk}/include/xpc/private.h xpc
+    cp ${lib.getDev apple_sdk.sdk}/include/xpc/*.h xpc
+    cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h
+
+    substituteInPlace lib/SecItemPriv.h \
+      --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
+      --replace "extern CFTypeRef kSecAttrIsSensitive" "extern const CFTypeRef kSecAttrIsSensitive" \
+      --replace "extern CFTypeRef kSecAttrIsExtractable" "extern const CFTypeRef kSecAttrIsExtractable"
+
+    substituteInPlace lib/Keychains.cpp --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+
+    substituteInPlace lib/CertificateValues.cpp --replace \
+      '#include <Security/SecCertificatePriv.h>' ""
+
+    substituteInPlace lib/DLDBListCFPref.cpp --replace \
+      'dispatch_once_t AppSandboxChecked;' ''$'namespace Security {\ndispatch_once_t AppSandboxChecked;' \
+      --replace 'return mLoginDLDbIdentifier;' 'return mLoginDLDbIdentifier; }' \
+      --replace '_xpc_runtime_is_app_sandboxed()' 'false'
+      # hope that doesn't hurt anything
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
new file mode 100644
index 00000000000..119a43621fb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_mds
+
+security_mds_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_mds_HEADER_FILES_DIR = lib
+
+security_mds_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
new file mode 100644
index 00000000000..cd691f71e95
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
@@ -0,0 +1,11 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_filedb
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
new file mode 100644
index 00000000000..140c5a909a6
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_ocspd
+
+security_ocspd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_ocspd_HEADER_FILES_DIR = lib
+
+security_ocspd_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
new file mode 100644
index 00000000000..81551e9a76e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
@@ -0,0 +1,20 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    bootstrap_cmds
+  ];
+  postUnpack = ''
+    pushd libsecurity*
+    ls -lah
+    mkdir -p lib
+    cp common/* lib
+    cp client/* lib
+    popd
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=. || exit 1
+    cp derived_src/* lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
new file mode 100644
index 00000000000..b2af7e72c41
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_pkcs12
+
+security_pkcs12_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_pkcs12_HEADER_FILES_DIR = lib
+
+security_pkcs12_CC_FILES = $(wildcard lib/*.cpp)
+security_pkcs12_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
new file mode 100644
index 00000000000..b225d062dc9
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utils, libsecurity_keychain }:
+appleDerivation {
+  patchPhase = ''
+    substituteInPlace lib/pkcsoids.h --replace '#error' '#warning'
+  '';
+  preBuild = ''
+    unpackFile ${libsecurity_keychain.src}
+    mv libsecurity_keychain*/lib security_keychain
+  '';
+  buildInputs = [
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
new file mode 100644
index 00000000000..47a1c609d06
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_sd_cspdl
+
+security_sd_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_sd_cspdl_HEADER_FILES_DIR = lib
+
+security_sd_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
new file mode 100644
index 00000000000..22491091661
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
@@ -0,0 +1,10 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
new file mode 100644
index 00000000000..d3ba09142c9
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_utilities
+
+security_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_utilities_HEADER_FILES_DIR = lib
+
+security_utilities_C_FILES = $(wildcard lib/*.c)
+security_utilities_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
new file mode 100644
index 00000000000..1ab950a9233
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -0,0 +1,28 @@
+{ IOKit, appleDerivation, apple_sdk, libauto, libobjc, sqlite, stdenv, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libauto
+    libobjc
+    IOKit
+  ];
+  propagatedBuildInputs = [
+    sqlite
+    apple_sdk.frameworks.PCSC
+  ];
+  NIX_LDFLAGS = "-framework PCSC";
+  patchPhase = ''
+    substituteInPlace lib/errors.h --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+      '"MacTypes.h"'
+    substituteInPlace lib/debugging.cpp --replace PATH_MAX 1024
+    substituteInPlace lib/superblob.h --replace 'result->at' 'result->template at'
+    substituteInPlace lib/ccaudit.cpp --replace '<bsm/libbsm.h>' '"bsm/libbsm.h"'
+    substituteInPlace lib/powerwatch.h --replace \
+      '<IOKit/pwr_mgt/IOPMLibPrivate.h>' \
+      '"${IOKit}/Library/Frameworks/IOKit.framework/Headers/pwr_mgt/IOPMLibPrivate.h"'
+    cp -R ${osx_private_sdk}/include/bsm lib
+    cp ${osx_private_sdk}/include/utilities_dtrace.h lib
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
new file mode 100644
index 00000000000..6058043e79f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = securityd
+
+securityd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+securityd_HEADER_FILES_DIR = lib
+
+securityd_CC_FILES = $(wildcard lib/*.cpp)
+securityd_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
new file mode 100644
index 00000000000..fb3441f7050
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
@@ -0,0 +1,23 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    bootstrap_cmds
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cdsa_client.src}
+    mv libsecurity_cdsa_client*/lib security_cdsa_client
+    ln -s lib securityd_client
+
+    patch -p1 < ${./xdr-arity.patch}
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=.
+    cp derived_src/* lib
+    rm lib/ucspClientC.c
+  '';
+  postFixup = ''
+    ln -s $dev/include/securityd $dev/include/securityd_client
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
new file mode 100644
index 00000000000..5d0328629f1
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
@@ -0,0 +1,79 @@
+diff --git a/lib/sec_xdr.c b/lib/sec_xdr.c
+index fe5f038..6239b6c 100644
+--- a/lib/sec_xdr.c
++++ b/lib/sec_xdr.c
+@@ -223,7 +223,7 @@ bool_t copyin(void *data, xdrproc_t proc, void** copy, u_int *size)
+     sec_xdrmem_create(&xdr, (char *)xdr_data, length, XDR_ENCODE);
+ 
+     // cast to void* - function can go both ways (xdr->x_op) 
+-    if (proc(&xdr, data)) {
++    if (proc(&xdr, data, 0)) {
+         *copy = xdr_data;
+         if (size) *size = length;
+         return (TRUE);
+@@ -261,7 +261,7 @@ bool_t copyout(const void *copy, u_int size, xdrproc_t proc, void **data, u_int
+     if (!sec_xdr_arena_init(&arena, &xdr, length_out ? length_out : length_required, length_out ? *data : NULL))
+         return (FALSE);
+ 
+-    if (proc(&xdr, data))
++    if (proc(&xdr, data, 0))
+     {
+         *length = length_required;
+         return (TRUE);
+@@ -284,7 +284,7 @@ bool_t copyout_chunked(const void *copy, u_int size, xdrproc_t proc, void **data
+ 
+     void *data_out = NULL;
+ 
+-    if (proc(&xdr, &data_out))
++    if (proc(&xdr, &data_out, 0))
+     {
+         *data = data_out;
+         return (TRUE);
+diff --git a/lib/sec_xdr_array.c b/lib/sec_xdr_array.c
+index 152a71b..e5ec1ad 100644
+--- a/lib/sec_xdr_array.c
++++ b/lib/sec_xdr_array.c
+@@ -147,7 +147,7 @@ sec_xdr_array(XDR *xdrs, uint8_t **addrp, u_int *sizep, u_int maxsize, u_int els
+     for (i = 0; (i < c) && stat; i++) {
+         if ((xdrs->x_op == XDR_DECODE) && sizeof_alloc)
+             memset(obj, 0, elsize);
+-        stat = (*elproc)(xdrs, target);
++        stat = (*elproc)(xdrs, target, 0);
+         if ((xdrs->x_op == XDR_ENCODE) || !sizeof_alloc)
+             target += elsize;
+     }
+diff --git a/lib/sec_xdr_reference.c b/lib/sec_xdr_reference.c
+index a66fb37..ab5b4c4 100644
+--- a/lib/sec_xdr_reference.c
++++ b/lib/sec_xdr_reference.c
+@@ -121,7 +121,7 @@ sec_xdr_reference(XDR *xdrs, uint8_t **pp, u_int size, xdrproc_t proc)
+                 break;
+             }
+ 
+-    stat = (*proc)(xdrs, loc);
++    stat = (*proc)(xdrs, loc, 0);
+ 
+     if (xdrs->x_op == XDR_FREE) {
+         sec_mem_free(xdrs, loc, size);
+diff --git a/lib/sec_xdr_sizeof.c b/lib/sec_xdr_sizeof.c
+index a18bcd0..8c33dbc 100644
+--- a/lib/sec_xdr_sizeof.c
++++ b/lib/sec_xdr_sizeof.c
+@@ -190,7 +190,7 @@ sec_xdr_sizeof_in(func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (x.x_private)
+         free(x.x_private);
+     return (stat == TRUE ? (unsigned) x.x_handy: 0);
+@@ -210,7 +210,7 @@ sec_xdr_sizeof_out(copy, size, func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (size_alloc.data)
+         free(size_alloc.data);
+     return (stat == TRUE ? (unsigned long)size_alloc.offset : 0);
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index 87211f481d4..a6f484ba4e8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -1,33 +1,13 @@
-{ stdenv, lib, appleDerivation, xcbuildHook
-
-# headersOnly is true when building for libSystem
-, headersOnly ? false }:
+{ stdenv, appleDerivation }:
 
+# all symbols are located in libSystem
 appleDerivation {
-  nativeBuildInputs = lib.optional (!headersOnly) xcbuildHook;
-
-  prePatch = ''
-    substituteInPlace tzlink.c \
-      --replace '#include <xpc/xpc.h>' ""
-  '';
-
-  xcbuildFlags = "-target util";
-
   installPhase = ''
     mkdir -p $out/include
-  '' + lib.optionalString headersOnly ''
     cp *.h $out/include
-  '' + lib.optionalString (!headersOnly)''
-    mkdir -p $out/lib $out/include
-
-    cp Products/Release/*.dylib $out/lib
-    cp Products/Release/*.h $out/include
-
-    # TODO: figure out how to get this to be right the first time around
-    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
     license     = licenses.apsl20;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
new file mode 100644
index 00000000000..0115ce537e2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
@@ -0,0 +1,29 @@
+{ stdenv, appleDerivation, xcbuildHook }:
+
+# TODO: make this the official libutil expression once we've integrated xcbuild in the bootstrap
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+
+  prePatch = ''
+    substituteInPlace tzlink.c \
+      --replace '#include <xpc/xpc.h>' ""
+  '';
+
+  xcbuildFlags = "-target util";
+
+  installPhase = ''
+    mkdir -p $out/lib $out/include
+
+    cp Products/Release/*.dylib $out/lib
+    cp Products/Release/*.h $out/include
+
+    # TODO: figure out how to get this to be right the first time around
+    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
new file mode 100644
index 00000000000..6f6a50bd57a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
@@ -0,0 +1,8 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_dotmac_tp
+
+security_dotmac_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_dotmac_tp_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
new file mode 100644
index 00000000000..bfbfb945957
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
@@ -0,0 +1,4 @@
+{ appleDerivation }:
+
+appleDerivation {
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
new file mode 100644
index 00000000000..d5bc3483c38
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
@@ -0,0 +1,32 @@
+{ appleDerivation, xcbuildHook, Security
+, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
+, xnu, osx_private_sdk, pcsclite}:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+  buildInputs = [ Security libsecurity_utilities
+                  libsecurity_cdsa_utilities libsecurity_codesigning
+                  pcsclite ];
+
+  NIX_LDFLAGS = "-lpcsclite";
+
+  # can't build the whole thing
+  xcbuildFlags = "-target codesign";
+
+  preBuild = ''
+    mkdir -p include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
+
+    unpackFile ${xnu.src}
+    mkdir -p include/sys
+    cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Iinclude";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp Products/Release/codesign $out/bin/codesign
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index a2f912ca578..3513cb2e172 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -1,8 +1,8 @@
-{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil, lib}:
+{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil-new, lib}:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
+  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil-new ];
   NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index aaa3a1ebe32..74c9f254348 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,11 +1,11 @@
-{ appleDerivation, lib, bootstrap_cmds, bison, flex
-, gnum4, unifdef, perl, python
-, headersOnly ? true }:
+{ appleDerivation, bootstrap_cmds, bison, flex, gnum4, unifdef, perl, python }:
 
-appleDerivation ({
-  nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
+appleDerivation {
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
 
-  postPatch = ''
+  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
+
+  patchPhase = ''
     substituteInPlace Makefile \
       --replace "/bin/" "" \
       --replace "MAKEJOBS := " '# MAKEJOBS := '
@@ -40,27 +40,7 @@ appleDerivation ({
     patchShebangs .
   '';
 
-  PLATFORM = "MacOSX";
-  SDKVERSION = "10.11";
-  CC = "cc";
-  CXX = "c++";
-  MIG = "mig";
-  MIGCOM = "migcom";
-  STRIP = "strip";
-  NM = "nm";
-  UNIFDEF = "unifdef";
-  DSYMUTIL = "dsymutil";
-  HOST_OS_VERSION = "10.10";
-  HOST_CC = "cc";
-  HOST_FLEX = "flex";
-  HOST_BISON = "bison";
-  HOST_GM4 = "m4";
-  MIGCC = "cc";
-  ARCHS = "x86_64";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  preBuild = ''
+  installPhase = ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
 
@@ -76,27 +56,49 @@ appleDerivation ({
 
     export SDKROOT_RESOLVED=$PWD/sdk
     export HOST_SDKROOT_RESOLVED=$PWD/sdk
+    export PLATFORM=MacOSX
+    export SDKVERSION=10.11
+
+    export CC=cc
+    export CXX=c++
+    export MIG=${bootstrap_cmds}/bin/mig
+    export MIGCOM=${bootstrap_cmds}/libexec/migcom
+    export STRIP=sentinel-missing
+    export LIPO=sentinel-missing
+    export LIBTOOL=sentinel-missing
+    export NM=sentinel-missing
+    export UNIFDEF=${unifdef}/bin/unifdef
+    export DSYMUTIL=sentinel-missing
+    export CTFCONVERT=sentinel-missing
+    export CTFMERGE=sentinel-missing
+    export CTFINSERT=sentinel-missing
+    export NMEDIT=sentinel-missing
+
+    export HOST_OS_VERSION=10.7
+    export HOST_CC=cc
+    export HOST_FLEX=${flex}/bin/flex
+    export HOST_BISON=${bison}/bin/bison
+    export HOST_GM4=${gnum4}/bin/m4
+    export HOST_CODESIGN='echo dummy_codesign'
+    export HOST_CODESIGN_ALLOCATE=echo
 
     export BUILT_PRODUCTS_DIR=.
-    export DSTROOT=$out
-  '';
 
-  buildFlags = lib.optionalString headersOnly "exporthdrs";
-  installTargets = lib.optionalString headersOnly "installhdrs";
+    export DSTROOT=$out
+    make installhdrs
 
-  postInstall = lib.optionalString headersOnly ''
     mv $out/usr/include $out
 
-    (cd BUILD/obj/EXPORT_HDRS && find -type f -exec install -D \{} $out/include/\{} \;)
-
     # TODO: figure out why I need to do this
     cp libsyscall/wrappers/*.h $out/include
-    install -D libsyscall/os/tsd.h $out/include/os/tsd.h
+    mkdir -p $out/include/os
+    cp libsyscall/os/tsd.h $out/include/os/tsd.h
     cp EXTERNAL_HEADERS/AssertMacros.h $out/include
     cp EXTERNAL_HEADERS/Availability*.h $out/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/
-    cp -r EXTERNAL_HEADERS/corecrypto $out/include
 
     # Build the mach headers we crave
+    export MIGCC=cc
+    export ARCHS="x86_64"
     export SRCROOT=$PWD/libsyscall
     export DERIVED_SOURCES_DIR=$out/include
     export SDKROOT=$out
@@ -106,13 +108,14 @@ appleDerivation ({
 
     # Get rid of the System prefix
     mv $out/System/* $out/
-    rmdir $out/System
 
     # TODO: do I need this?
     mv $out/internal_hdr/include/mach/*.h $out/include/mach
 
     # Get rid of some junk lying around
-    rm -rf $out/internal_hdr $out/usr $out/local
+    rm -rf $out/internal_hdr
+    rm -rf $out/usr
+    rm -rf $out/local
 
     # Add some symlinks
     ln -s $out/Library/Frameworks/System.framework/Versions/B \
@@ -120,18 +123,8 @@ appleDerivation ({
     ln -s $out/Library/Frameworks/System.framework/Versions/Current/PrivateHeaders \
           $out/Library/Frameworks/System.framework/Headers
 
-    # IOKit (and possibly the others) is incomplete,
-    # so let's not make it visible from here...
+    # IOKit (and possibly the others) is incomplete, so let's not make it visible from here...
     mkdir $out/Library/PrivateFrameworks
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
-} // lib.optionalAttrs headersOnly {
-  HOST_CODESIGN = "echo";
-  HOST_CODESIGN_ALLOCATE = "echo";
-  LIPO = "echo";
-  LIBTOOL = "echo";
-  CTFCONVERT = "echo";
-  CTFMERGE = "echo";
-  CTFINSERT = "echo";
-  NMEDIT = "echo";
-})
+}
diff --git a/pkgs/os-specific/darwin/darling/default.nix b/pkgs/os-specific/darwin/darling/default.nix
index 846831d0a87..6ed3b28eccc 100644
--- a/pkgs/os-specific/darwin/darling/default.nix
+++ b/pkgs/os-specific/darwin/darling/default.nix
@@ -26,9 +26,6 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cp -rL src/sandbox/include/ $out/
     cp libsystem_sandbox.dylib $out/lib/
-
-    mkdir -p $out/include
-    cp src/libaks/include/* $out/include
   '';
 
   # buildInputs = [ cmake bison flex ];
diff --git a/pkgs/os-specific/darwin/security-tool/GNUmakefile b/pkgs/os-specific/darwin/security-tool/GNUmakefile
new file mode 100644
index 00000000000..ae25f6a67c0
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/GNUmakefile
@@ -0,0 +1,14 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+TOOL_NAME = security
+security_C_FILES = $(wildcard *.c)
+security_CC_FILES = $(wildcard *.cpp)
+
+security_LDFLAGS = \
+	-lsecurity_cdsa_utilities -lsecurity_cdsa_utils -lsecurity_keychain -lsecurity_cssm \
+	-lsecurity_cdsa_client -lsecurity_utilities -lsecurity_asn1 -lsecurity_mds \
+	-lsecurity_cdsa_plugin -lsecurity_pkcs12 -lsecurity_apple_csp -lsecurity_apple_cspdl \
+	-lsecurity_apple_file_dl -lsecurity_apple_x509_cl -lsecurity_apple_x509_tp \
+	-lsecurity_sd_cspdl -lsecurity_filedb -lsecurityd -framework Security -framework PCSC
+
+include $(GNUSTEP_MAKEFILES)/tool.make
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
new file mode 100644
index 00000000000..f161a7a88e1
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -0,0 +1,101 @@
+{ Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk,
+fetchurl, gnustep, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl,
+libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp,
+libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin,
+libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb,
+libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl,
+libsecurity_utilities, libsecurityd, osx_private_sdk, Security-framework, stdenv }:
+
+stdenv.mkDerivation rec {
+  version = "55115";
+  name = "SecurityTool-${version}";
+
+  src = fetchurl {
+    url = "http://opensource.apple.com/tarballs/SecurityTool/SecurityTool-${version}.tar.gz";
+    sha256 = "0apcz4vy2z5645jhrs60wj3w27mncjjqv42h5lln36g6qs2n9113";
+  };
+
+  disallowedRequisites = [ apple_sdk.sdk  ];
+
+  patchPhase = ''
+    # copied from libsecurity_generic
+    cp -R ${osx_private_sdk}/include/SecurityPrivateHeaders Security
+
+    substituteInPlace cmsutil.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+    substituteInPlace createFVMaster.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+  '';
+
+  postUnpack = ''
+    unpackFile ${Security.src}
+    cp Security-*/utilities/src/fileIo.c SecurityTool*
+    cp Security-*/utilities/src/fileIo.h SecurityTool*
+  '';
+
+  preBuild = ''
+    makeFlagsArray=(-j$NIX_BUILD_CORES)
+  '';
+
+  NIX_LDFLAGS = "-no_dtrace_dof";
+
+  makeFlags = [
+    "-f ${./GNUmakefile}"
+    "MAKEFILE_NAME=${./GNUmakefile}"
+    "GNUSTEP_MAKEFILES=${gnustep.make}/share/GNUstep/Makefiles"
+  ];
+
+  installFlags = [
+    "security_INSTALL_DIR=\$(out)/bin"
+  ];
+
+  propagatedBuildInputs = [ GSS Kerberos Security-framework PCSC Foundation ];
+
+  __propagatedImpureHostDeps = [ "/System/Library/Keychains" ];
+
+  buildInputs = [
+    gnustep.make
+    libsecurity_asn1
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libobjc
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_cssm
+    libsecurity_cdsa_utils
+    libsecurity_mds
+    libsecurity_cdsa_plugin
+    libsecurity_apple_csp
+    libsecurity_apple_cspdl
+    libsecurity_apple_file_dl
+    libsecurity_apple_x509_cl
+    libsecurity_apple_x509_tp
+    libsecurity_pkcs12
+    libsecurity_sd_cspdl
+    libsecurity_filedb
+    libsecurityd
+    makeWrapper
+  ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-F${Security}/Library/Frameworks"
+    "-F${PCSC}/Library/Frameworks"
+    "-Wno-deprecated-declarations"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/security --set DYLD_INSERT_LIBRARIES /usr/lib/libsqlite3.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Command line interface to macOS keychains and Security framework";
+    maintainers = with maintainers; [
+      copumpkin
+      joelteon
+    ];
+    platforms = platforms.darwin;
+    license = licenses.apsl20;
+  };
+}
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index da1878c5fc1..1fc36139ac0 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -61,6 +61,10 @@ in
 
   osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { };
 
+  security_tool = darwin.callPackage ../os-specific/darwin/security-tool {
+    Security-framework = darwin.apple_sdk.frameworks.Security;
+  };
+
   stubs = callPackages ../os-specific/darwin/stubs { };
 
   trash = darwin.callPackage ../os-specific/darwin/trash { };