From 05e5a4e27941717c399a477ffa1d44ac9f412e15 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 2 Jul 2026 16:15:16 +0100
Subject: [PATCH] ffmpeg: work around `ld64` hardening issue

---
 pkgs/development/libraries/ffmpeg/generic.nix | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 7e7519567883..46a32fec2e7e 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -367,6 +367,9 @@
   libnpp,
   # Testing
   testers,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 /*
@@ -832,7 +835,9 @@ stdenv.mkDerivation (
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ optionals (lib.versionAtLeast version "6") [ texinfo ]
     ++ optionals withCudaLLVM [ clang.cc ]
-    ++ optionals withCudaNVCC [ cuda_nvcc ];
+    ++ optionals withCudaNVCC [ cuda_nvcc ]
+    # TODO: Clean up on `staging`.
+    ++ optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
     buildInputs =
       [ ]
@@ -976,12 +981,17 @@ stdenv.mkDerivation (
 
     buildFlags = [ "all" ] ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
 
-    env = lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = toString [
-        "-Wno-error=incompatible-pointer-types"
-        "-Wno-error=int-conversion"
-      ];
-    };
+    env =
+      lib.optionalAttrs stdenv.cc.isGNU {
+        NIX_CFLAGS_COMPILE = toString [
+          "-Wno-error=incompatible-pointer-types"
+          "-Wno-error=int-conversion"
+        ];
+      }
+      # TODO: Clean up on `staging`.
+      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+        NIX_CFLAGS_LINK = "-fuse-ld=lld";
+      };
 
     # tests linking broken with shaderc after https://github.com/NixOS/nixpkgs/pull/477464/changes/5a47b12dfcd1b909ba35778a866394430054319a
     doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform && !withShaderc;