removeReferencesTo: fix code signatures on aarch64-darwin

3 files changed, 72 insertions, 29 deletions

diff --git a/pkgs/build-support/remove-references-to/darwin-sign-fixup.sh b/pkgs/build-support/remove-references-to/darwin-sign-fixup.sh
new file mode 100644
index 00000000000..940c18e5a62
--- /dev/null
+++ b/pkgs/build-support/remove-references-to/darwin-sign-fixup.sh
@@ -0,0 +1,5 @@
+# Fixup hook for nukeReferences, not stdenv
+
+source @signingUtils@
+
+fixupHooks+=(signIfRequired)
diff --git a/pkgs/build-support/remove-references-to/default.nix b/pkgs/build-support/remove-references-to/default.nix
index 8b1d05fc230..f022611ef91 100644
--- a/pkgs/build-support/remove-references-to/default.nix
+++ b/pkgs/build-support/remove-references-to/default.nix
@@ -3,32 +3,33 @@
 # non-existent path (/nix/store/eeee...).  This is useful for getting rid of
 # dependencies that you know are not actually needed at runtime.
 
-{ stdenv, writeScriptBin }:
-
-writeScriptBin "remove-references-to" ''
-#! ${stdenv.shell} -e
-
-# References to remove
-targets=()
-while getopts t: o; do
-    case "$o" in
-        t) storeId=$(echo "$OPTARG" | sed -n "s|^$NIX_STORE/\\([a-z0-9]\{32\}\\)-.*|\1|p")
-           if [ -z "$storeId" ]; then
-               echo "-t argument must be a Nix store path"
-               exit 1
-           fi
-           targets+=("$storeId")
-    esac
-done
-shift $(($OPTIND-1))
-
-# Files to remove the references from
-regions=()
-for i in "$@"; do
-    test ! -L "$i" -a -f "$i" && regions+=("$i")
-done
-
-for target in "''${targets[@]}" ; do
-    sed -i -e "s|$NIX_STORE/$target-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "''${regions[@]}"
-done
-''
+{ lib, stdenvNoCC, signingUtils, shell ? stdenvNoCC.shell }:
+
+let
+  stdenv = stdenvNoCC;
+
+  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
+in
+
+stdenv.mkDerivation {
+  name = "remove-references-to";
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    substituteAll ${./remove-references-to.sh} $out/bin/remove-references-to
+    chmod a+x $out/bin/remove-references-to
+  '';
+
+  postFixup = lib.optionalString darwinCodeSign ''
+    mkdir -p $out/nix-support
+    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
+  '';
+
+  inherit (builtins) storeDir;
+  shell = lib.getBin shell + (shell.shellPath or "");
+  signingUtils = if darwinCodeSign then signingUtils else null;
+}
diff --git a/pkgs/build-support/remove-references-to/remove-references-to.sh b/pkgs/build-support/remove-references-to/remove-references-to.sh
new file mode 100644
index 00000000000..d8d38dbd80a
--- /dev/null
+++ b/pkgs/build-support/remove-references-to/remove-references-to.sh
@@ -0,0 +1,37 @@
+#! @shell@ -e
+
+fixupHooks=()
+
+if [ -e @out@/nix-support/setup-hooks.sh ]; then
+    source @out@/nix-support/setup-hooks.sh
+fi
+
+# References to remove
+targets=()
+while getopts t: o; do
+    case "$o" in
+        t) storeId=$(echo "$OPTARG" | sed -n "s|^@storeDir@/\\([a-z0-9]\{32\}\\)-.*|\1|p")
+           if [ -z "$storeId" ]; then
+               echo "-t argument must be a Nix store path"
+               exit 1
+           fi
+           targets+=("$storeId")
+    esac
+done
+shift $(($OPTIND-1))
+
+# Files to remove the references from
+regions=()
+for i in "$@"; do
+    test ! -L "$i" -a -f "$i" && regions+=("$i")
+done
+
+for target in "${targets[@]}" ; do
+    sed -i -e "s|@storeDir@/$target-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "${regions[@]}"
+done
+
+for region in "${regions[@]}"; do
+    for hook in "${fixupHooks[@]}"; do
+        eval "$hook" "$i"
+    done
+done