removeReferencesTo: fix code signatures on aarch64-darwin

pkgs/build-support/remove-references-to/darwin-sign-fixup.sh

@@ -0,0 +1,5 @@
+# Fixup hook for nukeReferences, not stdenv
+
+source @signingUtils@
+
+fixupHooks+=(signIfRequired)

pkgs/build-support/remove-references-to/default.nix

@@ -3,32 +3,33 @@
 # non-existent path (/nix/store/eeee...).  This is useful for getting rid of
 # dependencies that you know are not actually needed at runtime.
 
-{ stdenv, writeScriptBin }:
+{ lib, stdenvNoCC, signingUtils, shell ? stdenvNoCC.shell }:
 
-writeScriptBin "remove-references-to" ''
+let
-#! ${stdenv.shell} -e
+  stdenv = stdenvNoCC;
 
-# References to remove
+  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
-targets=()
+in
-while getopts t: o; do
-    case "$o" in
-        t) storeId=$(echo "$OPTARG" | sed -n "s|^$NIX_STORE/\\([a-z0-9]\{32\}\\)-.*|\1|p")
-           if [ -z "$storeId" ]; then
-               echo "-t argument must be a Nix store path"
-               exit 1
-           fi
-           targets+=("$storeId")
-    esac
-done
-shift $(($OPTIND-1))
 
-# Files to remove the references from
+stdenv.mkDerivation {
-regions=()
+  name = "remove-references-to";
-for i in "$@"; do
-    test ! -L "$i" -a -f "$i" && regions+=("$i")
-done
 
-for target in "''${targets[@]}" ; do
+  dontUnpack = true;
-    sed -i -e "s|$NIX_STORE/$target-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "''${regions[@]}"
+  dontConfigure = true;
-done
+  dontBuild = true;
-''
+
+  installPhase = ''
+    mkdir -p $out/bin
+    substituteAll ${./remove-references-to.sh} $out/bin/remove-references-to
+    chmod a+x $out/bin/remove-references-to
+  '';
+
+  postFixup = lib.optionalString darwinCodeSign ''
+    mkdir -p $out/nix-support
+    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
+  '';
+
+  inherit (builtins) storeDir;
+  shell = lib.getBin shell + (shell.shellPath or "");
+  signingUtils = if darwinCodeSign then signingUtils else null;
+}

pkgs/build-support/remove-references-to/remove-references-to.sh

@@ -0,0 +1,37 @@
+#! @shell@ -e
+
+fixupHooks=()
+
+if [ -e @out@/nix-support/setup-hooks.sh ]; then
+    source @out@/nix-support/setup-hooks.sh
+fi
+
+# References to remove
+targets=()
+while getopts t: o; do
+    case "$o" in
+        t) storeId=$(echo "$OPTARG" | sed -n "s|^@storeDir@/\\([a-z0-9]\{32\}\\)-.*|\1|p")
+           if [ -z "$storeId" ]; then
+               echo "-t argument must be a Nix store path"
+               exit 1
+           fi
+           targets+=("$storeId")
+    esac
+done
+shift $(($OPTIND-1))
+
+# Files to remove the references from
+regions=()
+for i in "$@"; do
+    test ! -L "$i" -a -f "$i" && regions+=("$i")
+done
+
+for target in "${targets[@]}" ; do
+    sed -i -e "s|@storeDir@/$target-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "${regions[@]}"
+done
+
+for region in "${regions[@]}"; do
+    for hook in "${fixupHooks[@]}"; do
+        eval "$hook" "$i"
+    done
+done

pkgs/top-level/all-packages.nix

@@ -642,7 +642,9 @@ in
 
   referencesByPopularity = callPackage ../build-support/references-by-popularity { };
 
-  removeReferencesTo = callPackage ../build-support/remove-references-to { };
+  removeReferencesTo = callPackage ../build-support/remove-references-to {
+    inherit (darwin) signingUtils;
+  };
 
   vmTools = callPackage ../build-support/vm { };