From 121149836ef2c33bb62abd323eb95780ac7d59a2 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 2 Sep 2024 19:27:03 -0400
Subject: [PATCH] darwin: add xcodeProjectCheckHook

This hook is used by source releases that build with Meson to assert
that the Xcode project has not changed since the previous release. This
is meant to be a check to force those updating source release packages
to make sure they have incorporated any changes that were made to the
Xcode project into the Meson build.
---
 .../xcode-project-check-hook/setup-hook.sh    | 55 +++++++++++++++++++
 pkgs/top-level/darwin-packages.nix            |  5 ++
 2 files changed, 60 insertions(+)
 create mode 100644 pkgs/os-specific/darwin/xcode-project-check-hook/setup-hook.sh

diff --git a/pkgs/os-specific/darwin/xcode-project-check-hook/setup-hook.sh b/pkgs/os-specific/darwin/xcode-project-check-hook/setup-hook.sh
new file mode 100644
index 000000000000..a39c50adbeae
--- /dev/null
+++ b/pkgs/os-specific/darwin/xcode-project-check-hook/setup-hook.sh
@@ -0,0 +1,55 @@
+# Verify that the Xcode project has not changed unexpectedly. This is only useful for source releases that are
+# being built with other build systems (e.g., Meson) instead of xcbuild.
+
+verifyXcodeProjectHash() {
+    printHashInstructions() {
+        echo '1. Set xcodeHash to an empty string: `xcodeHash = "";`'
+        echo '2. Build the derivation and wait for it to fail with a hash mismatch'
+        echo '3. Copy the "got: sha256-..." value back into the xcodeHash field'
+        echo '   You should have: xcodeHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";'
+    }
+
+    if [ -z "${xcodeHash-}" ]; then
+        echo "error: xcodeHash missing"
+        echo
+        echo "To fix the issue:"
+        printHashInstructions
+        exit 1
+    fi
+
+    if [ -z "${xcodeProject-}" ]; then
+        echo "error: xcodeProject missing"
+        echo
+        echo "To fix the issue: Set xcodeProject to the name of the project"
+        exit 1
+    fi
+
+    local xcodeHashArr
+    readarray -t -d - xcodeHashArr < <(printf "$xcodeHash")
+
+    local hashType=${xcodeHashArr[0]}
+    local expectedHash=${xcodeHashArr[1]}
+
+    if [ -z "$hashType" ] || [ -z "$expectedHash" ]; then
+        echo "error: xcodeHash is in invalid format"
+        echo
+        echo "To fix the issue:"
+        printHashInstructions
+        exit 1
+    fi
+
+    local hash
+    hash=$(openssl "$hashType" -binary "$sourceRoot/$xcodeProject/project.pbxproj" | base64)
+
+    if [ "$hash" != "$expectedHash" ]; then
+        echo "error: hash mismatch in $xcodeProject/project.pbxproj"
+        echo "        specified: $xcodeHash"
+        echo "           got:    $hashType-$hash"
+        echo
+        echo 'Upstream Xcode project has changed. Update `meson.build` with any changes, then update `xcodeHash`.'
+        printHashInstructions
+        exit 1
+    fi
+}
+
+postUnpackHooks+=(verifyXcodeProjectHash)
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 0d3cf4033efa..c47cc3e565e7 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -242,6 +242,11 @@ impure-cmds // appleSourcePackages // chooseLibs // {
       setupHook = null;
     });
 
+  xcodeProjectCheckHook = pkgs.makeSetupHook {
+    name = "xcode-project-check-hook";
+    propagatedBuildInputs = [ pkgs.pkgsBuildHost.openssl ];
+  } ../os-specific/darwin/xcode-project-check-hook/setup-hook.sh;
+
   # Formerly the CF attribute. Use this is you need the open source release.
   swift-corelibs-foundation = callPackage ../os-specific/darwin/swift-corelibs/corefoundation.nix { };