From 2fd27b119f37b5b2eec1c2e41024792b9ba12e4f Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 08:34:15 +0100
Subject: [PATCH 01/13] darwin.installBinaryPackage: init

---
 .../darwin/install-binary-package/default.nix | 52 +++++++++++++++++++
 .../install-binary-package/unpack-dmg-pkg.sh  | 29 +++++++++++
 pkgs/top-level/darwin-packages.nix            |  2 +
 3 files changed, 83 insertions(+)
 create mode 100644 pkgs/os-specific/darwin/install-binary-package/default.nix
 create mode 100644 pkgs/os-specific/darwin/install-binary-package/unpack-dmg-pkg.sh

diff --git a/pkgs/os-specific/darwin/install-binary-package/default.nix b/pkgs/os-specific/darwin/install-binary-package/default.nix
new file mode 100644
index 0000000000000..4e8d45f5bfbc5
--- /dev/null
+++ b/pkgs/os-specific/darwin/install-binary-package/default.nix
@@ -0,0 +1,52 @@
+{ lib, stdenvNoCC, makeSetupHook, _7zz, libarchive }:
+
+{ pname
+, version
+, src
+, buildInputs ? []
+, nativeBuildInputs ? []
+, propagatedBuildInputs ? []
+, postInstall ? null
+, appName ? "."
+, sourceRoot ? "."
+, ...
+}@args:
+
+let
+  unpackDmgPkg = makeSetupHook {
+    name = "unpack-dmg-pkg";
+    propagatedBuildInputs = [ _7zz libarchive ];
+  } ./unpack-dmg-pkg.sh;
+in
+stdenvNoCC.mkDerivation (args // {
+  inherit pname appName src buildInputs propagatedBuildInputs postInstall;
+
+  dontMakeSourcesWritable = args.dontMakeSourcesWritable or true;
+  dontPatch = args.dontPatch or true;
+  dontConfigure = args.dontConfigure or true;
+  dontBuild = args.dontBuild or true;
+  dontStrip = args.dontStrip or true;
+  dontFixup = args.dontFixup or true;
+  dontCheck = args.dontCheck or true;
+  doInstallCheck = args.doInstallCheck or false;
+
+  sourceRoot = "${pname}/${sourceRoot}";
+
+  nativeBuildInputs = [ unpackDmgPkg ] ++ nativeBuildInputs;
+
+  installPhase = (args.installPhase or ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -R "${appName}" $out/Applications
+
+    runHook postInstall
+  '');
+
+  installCheckPhase = args.installCheckPhase or null;
+
+  meta = {
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+  } // ( args.meta or {} );
+})
diff --git a/pkgs/os-specific/darwin/install-binary-package/unpack-dmg-pkg.sh b/pkgs/os-specific/darwin/install-binary-package/unpack-dmg-pkg.sh
new file mode 100644
index 0000000000000..4479fd6d1a2b8
--- /dev/null
+++ b/pkgs/os-specific/darwin/install-binary-package/unpack-dmg-pkg.sh
@@ -0,0 +1,29 @@
+# shellcheck shell=bash
+unpackCmdHooks+=(unpackDmgPkg)
+unpackDmgPkg() {
+    case "$curSrc" in
+        *.dmg) unpackDmg "$curSrc";;
+        *.pkg) unpackPkg "$curSrc";;
+        *) return 1
+    esac
+}
+
+unpackDmg() {
+    _unpack "$1" "${2:-$pname}"
+}
+
+unpackPkg() {
+    _unpack "$1" "${2:-$pname}"
+    pushd "${2:-$pname}"
+    # Extract files from Payload or Payload~ file contained in given pkg if any
+    find . -name 'Payload*' -maxdepth 1 -print0 | xargs -0 -t -I % bsdtar -xf %
+    popd
+}
+
+_unpack() {
+    # Exclude */Applications files from extraction as they may
+    # contain a dangerous link path, causing 7zz to error.
+    # Exclude *com.apple.provenance xattr files from extraction as they
+    # break the an application's signature and notarization.
+    7zz x -bd -o"$2" -xr'!*/Applications' -xr'!*com.apple.provenance' "$1"
+}
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 78ad4434f1c32..f76dead02397e 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -142,6 +142,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     propagatedBuildInputs = [ pkgs.darwin.print-reexports ];
   } ../os-specific/darwin/print-reexports/setup-hook.sh;
 
+  installBinaryPackage = callPackage ../os-specific/darwin/install-binary-package { };
+
   sigtool = callPackage ../os-specific/darwin/sigtool { };
 
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };

From 9777f91eb30ad07ebbb8449f7c53b96c82f4fa76 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 09:52:49 +0100
Subject: [PATCH 02/13] treewide: refactor to use darwin.installBinaryPackage
 (1password)

---
 pkgs/applications/misc/1password/default.nix | 52 ++++++++++----------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index b7df39ee2b08c..1aa0e52285d9c 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchurl, fetchzip, autoPatchelfHook, installShellFiles, cpio, xar, _1password, testers }:
+{ lib, stdenvNoCC, fetchurl, fetchzip, autoPatchelfHook, installShellFiles, _1password, testers, darwin }:
 
 let
-  inherit (stdenv.hostPlatform) system;
+  inherit (stdenvNoCC.hostPlatform) system;
   fetch = srcPlatform: hash: extension:
     let
       args = {
@@ -21,49 +21,36 @@ let
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
-  mainProgram = "op";
-in
 
-stdenv.mkDerivation {
-  inherit pname version;
   src =
     if (builtins.elem system platforms) then
       sources.${system}
     else
       throw "Source for ${pname} is not available for ${system}";
 
-  nativeBuildInputs = [ installShellFiles ] ++ lib.optional stdenv.isLinux autoPatchelfHook;
-
-  buildInputs = lib.optionals stdenv.isDarwin [ xar cpio ];
-
-  unpackPhase = lib.optionalString stdenv.isDarwin ''
-    xar -xf $src
-    zcat op.pkg/Payload | cpio -i
-  '';
+  nativeBuildInputs = [ installShellFiles ];
 
   installPhase = ''
     runHook preInstall
-    install -D ${mainProgram} $out/bin/${mainProgram}
+    install -D ${meta.mainProgram} $out/bin/${meta.mainProgram}
     runHook postInstall
   '';
 
   postInstall = ''
     HOME=$TMPDIR
-    installShellCompletion --cmd ${mainProgram} \
-      --bash <($out/bin/${mainProgram} completion bash) \
-      --fish <($out/bin/${mainProgram} completion fish) \
-      --zsh <($out/bin/${mainProgram} completion zsh)
+    installShellCompletion --cmd ${meta.mainProgram} \
+      --bash <($out/bin/${meta.mainProgram} completion bash) \
+      --fish <($out/bin/${meta.mainProgram} completion fish) \
+      --zsh <($out/bin/${meta.mainProgram} completion zsh)
   '';
 
-  dontStrip = stdenv.isDarwin;
-
   doInstallCheck = true;
 
   installCheckPhase = ''
-    $out/bin/${mainProgram} --version
+    $out/bin/${meta.mainProgram} --version
   '';
 
-  passthru.tests.version = testers.testVersion {
+  testers' = testers.testVersion {
     package = _1password;
   };
 
@@ -74,6 +61,21 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ joelburget marsam ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    inherit mainProgram platforms;
+    mainProgram = "op";
+    inherit platforms;
   };
-}
+
+  linux = stdenvNoCC.mkDerivation {
+    inherit pname version src installPhase postInstall doInstallCheck installCheckPhase meta;
+    nativeBuildInputs = nativeBuildInputs ++ [ autoPatchelfHook ];
+    passthru.tests.version = testers';
+  };
+
+  darwin' = darwin.installBinaryPackage {
+    inherit pname version src nativeBuildInputs installPhase postInstall doInstallCheck installCheckPhase meta;
+    passthru.tests.version = testers';
+  };
+in
+if stdenvNoCC.isDarwin
+then darwin'
+else linux

From 23e142ad7cb075c7055a91f052adfba322ff820f Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 10:20:23 +0100
Subject: [PATCH 03/13] treewide: refactor to use darwin.installBinaryPackage
 (wire-desktop)

---
 .../wire-desktop/default.nix                  | 46 ++++---------------
 1 file changed, 8 insertions(+), 38 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 9aaba98710e30..b512d46cbe046 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -3,23 +3,22 @@
 , fetchurl
 , makeDesktopItem
 , makeWrapper
-, stdenv
+, stdenvNoCC
 , lib
 , udev
 , wrapGAppsHook
-, cpio
-, xar
 , libdbusmenu
 , alsa-lib
 , mesa
 , nss
 , nspr
 , systemd
+, darwin
 }:
 
 let
 
-  inherit (stdenv.hostPlatform) system;
+  inherit (stdenvNoCC.hostPlatform) system;
 
   throwSystem = throw "Unsupported system: ${system}";
 
@@ -69,7 +68,7 @@ let
     hydraPlatforms = [];
   };
 
-  linux = stdenv.mkDerivation rec {
+  linux = stdenvNoCC.mkDerivation rec {
     inherit pname version meta;
 
     src = fetchurl {
@@ -143,7 +142,7 @@ let
     '';
   };
 
-  darwin = stdenv.mkDerivation {
+  darwin' = darwin.installBinaryPackage {
     inherit pname version meta;
 
     src = fetchurl {
@@ -151,39 +150,10 @@ let
       inherit hash;
     };
 
-    buildInputs = [
-      cpio
-      xar
-    ];
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      xar -xf $src
-      cd com.wearezeta.zclient.mac.pkg
-
-      runHook postUnpack
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      cat Payload | gunzip -dc | cpio -i
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/Applications
-      cp -r Wire.app $out/Applications
-
-      runHook postInstall
-    '';
+    appName = "Wire.app";
   };
 
 in
-if stdenv.isDarwin
-then darwin
+if stdenvNoCC.isDarwin
+then darwin'
 else linux

From c42449435d1d5a753f892475e54437144bf9ec67 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 12:54:15 +0100
Subject: [PATCH 04/13] treewide: refactor to use darwin.installBinaryPackage
 (bartender)

---
 pkgs/os-specific/darwin/bartender/default.nix | 39 ++++++-------------
 pkgs/top-level/all-packages.nix               |  2 -
 pkgs/top-level/darwin-packages.nix            |  2 +
 3 files changed, 13 insertions(+), 30 deletions(-)

diff --git a/pkgs/os-specific/darwin/bartender/default.nix b/pkgs/os-specific/darwin/bartender/default.nix
index 011a356e54124..d27fd286973cc 100644
--- a/pkgs/os-specific/darwin/bartender/default.nix
+++ b/pkgs/os-specific/darwin/bartender/default.nix
@@ -1,48 +1,31 @@
 { lib
-, stdenvNoCC
 , fetchurl
-, _7zz
+, darwin
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
+darwin.installBinaryPackage rec {
   pname = "bartender";
   version = "5.0.49";
 
   src = fetchurl {
-    name = "Bartender ${lib.versions.major finalAttrs.version}.dmg";
-    url = "https://www.macbartender.com/B2/updates/${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}/Bartender%20${lib.versions.major finalAttrs.version}.dmg";
+    url = "https://www.macbartender.com/B2/updates/${builtins.replaceStrings [ "." ] [ "-" ] version}/Bartender%20${lib.versions.major version}.dmg";
     hash = "sha256-DOQLtdbwYFyRri3GBdjLfFNII65QJMvAQu9Be4ATBx0=";
   };
 
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-  dontFixup = true;
-
-  nativeBuildInputs = [ _7zz ];
-
-  sourceRoot = "Bartender ${lib.versions.major finalAttrs.version}.app";
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/Applications/${finalAttrs.sourceRoot}"
-    cp -R . "$out/Applications/${finalAttrs.sourceRoot}"
-
-    runHook postInstall
-  '';
+  appName = "Bartender ${lib.versions.major version}.app";
 
   meta = with lib; {
     description = "Take control of your menu bar";
     longDescription = ''
-      Bartender is an award-winning app for macOS that superpowers your menu bar, giving you total control over your menu bar items, what's displayed, and when, with menu bar items only showing when you need them.
-      Bartender improves your workflow with quick reveal, search, custom hotkeys and triggers, and lots more.
+      Bartender is an award-winning app for macOS that superpowers your menu
+      bar, giving you total control over your menu bar items, what's displayed,
+      and when, with menu bar items only showing when you need them.
+      Bartender improves your workflow with quick reveal, search, custom
+      hotkeys and triggers, and lots more.
     '';
     homepage = "https://www.macbartender.com";
-    changelog = "https://www.macbartender.com/Bartender${lib.versions.major finalAttrs.version}/release_notes/";
+    changelog = "https://www.macbartender.com/Bartender${lib.versions.major version}/release_notes/";
     license = with licenses; [ unfree ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ stepbrobd ];
-    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
-})
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 85a35a22b721a..fd0db00df60ad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27325,8 +27325,6 @@ with pkgs;
   ath9k-htc-blobless-firmware-unstable =
     callPackage ../os-specific/linux/firmware/ath9k { enableUnstable = true; };
 
-  bartender = callPackage ../os-specific/darwin/bartender { };
-
   b43Firmware_5_1_138 = callPackage ../os-specific/linux/firmware/b43-firmware/5.1.138.nix { };
 
   b43Firmware_6_30_163_46 = callPackage ../os-specific/linux/firmware/b43-firmware/6.30.163.46.nix { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index f76dead02397e..5b5321f83cc29 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -80,6 +80,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     extraBuildInputs = [];
   };
 
+  bartender = callPackage ../os-specific/darwin/bartender { };
+
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
     inherit (pkgs) binutils-unwrapped;
     inherit (pkgs.llvmPackages) llvm clang-unwrapped;

From 33d2247d52d088ab1fecdbe27b9400c01a5cadf2 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 08:35:25 +0100
Subject: [PATCH 05/13] treewide: refactor to use darwin.installBinaryPackage
 (apparency)

---
 pkgs/os-specific/darwin/apparency/default.nix | 35 +++++++------------
 pkgs/top-level/all-packages.nix               |  2 --
 pkgs/top-level/darwin-packages.nix            |  2 ++
 3 files changed, 15 insertions(+), 24 deletions(-)

diff --git a/pkgs/os-specific/darwin/apparency/default.nix b/pkgs/os-specific/darwin/apparency/default.nix
index 0bae99c14b37e..6061542a66848 100644
--- a/pkgs/os-specific/darwin/apparency/default.nix
+++ b/pkgs/os-specific/darwin/apparency/default.nix
@@ -1,39 +1,30 @@
-{ lib
-, fetchurl
-, stdenv
-, undmg
-}:
+{ lib, fetchurl, darwin }:
 
-stdenv.mkDerivation {
+darwin.installBinaryPackage rec {
   pname = "apparency";
-  version = "1.5.1";
+  version = "1.8.1";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20230815073821/https://www.mothersruin.com/software/downloads/Apparency.dmg";
-    hash = "sha256-JpaBdlt8kTNFzK/yZVZ+ZFJ3DnPQbogJC7QBmtSVkoQ=";
+    # Use externally archived download URL because
+    # upstream does not provide stable URLs for versioned releases
+    url = "https://web.archive.org/web/20240304101835/https://www.mothersruin.com/software/downloads/Apparency.dmg";
+    hash = "sha256-hxbAtIy7RdhDrsFIvm9CEr04uUTbWi4KmrzJIcU1YVA=";
   };
 
-  nativeBuildInputs = [ undmg ];
+  appName = "Apparency.app";
+  sourceRoot = "Apparency ${version}";
 
-  sourceRoot = "Apparency.app";
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications/Apparency.app $out/bin
-    cp -R . $out/Applications/Apparency.app
-    ln -s ../Applications/Apparency.app/Contents/MacOS/appy $out/bin
-
-    runHook postInstall
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s ../Applications/${appName}/Contents/MacOS/${meta.mainProgram} $out/bin
   '';
 
   meta = {
     description = "The App That Opens Apps";
     homepage = "https://www.mothersruin.com/software/Apparency/";
+    downloadPage = "https://www.mothersruin.com/software/Apparency/get.html";
     license = lib.licenses.unfreeRedistributable;
     maintainers = with lib.maintainers; [ Enzime ];
     mainProgram = "appy";
-    platforms = lib.platforms.darwin;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd0db00df60ad..480f53800aaf6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27288,8 +27288,6 @@ with pkgs;
     fftw = fftwFloat;
   };
 
-  apparency = callPackage ../os-specific/darwin/apparency { };
-
   arm-trusted-firmware = callPackage ../misc/arm-trusted-firmware { };
   inherit (arm-trusted-firmware)
     buildArmTrustedFirmware
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 5b5321f83cc29..8f7fbb956b7c2 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -80,6 +80,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     extraBuildInputs = [];
   };
 
+  apparency = callPackage ../os-specific/darwin/apparency { };
+
   bartender = callPackage ../os-specific/darwin/bartender { };
 
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {

From 2f0724c64f22ef7d1374e319954f2dbb92912ecf Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 10:24:24 +0100
Subject: [PATCH 06/13] treewide: refactor to use darwin.installBinaryPackage
 (iina)

---
 pkgs/by-name/ii/iina/package.nix | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ii/iina/package.nix b/pkgs/by-name/ii/iina/package.nix
index 2288a688cf0dd..4d7e418f0a6db 100644
--- a/pkgs/by-name/ii/iina/package.nix
+++ b/pkgs/by-name/ii/iina/package.nix
@@ -1,11 +1,11 @@
 { lib
 , fetchurl
-, stdenv
-, undmg
+, stdenvNoCC
+, darwin
 , nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+darwin.installBinaryPackage rec {
   pname = "iina";
   version = "1.3.4";
 
@@ -14,14 +14,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-feUPWtSi/Vsnv1mjGyBgB0wFMxx6r6UzrUratlAo14w=";
   };
 
-  nativeBuildInputs = [ undmg ];
+  appName = "IINA.app";
+  sourceRoot = "IINA";
 
-  sourceRoot = "IINA.app";
-
-  installPhase = ''
-    mkdir -p $out/{bin,Applications/IINA.app}
-    cp -R . "$out/Applications/IINA.app"
-    ln -s "$out/Applications/IINA.app/Contents/MacOS/iina-cli" "$out/bin/iina"
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/Applications/IINA.app/Contents/MacOS/${meta.mainProgram} $out/bin/${meta.mainProgram}
   '';
 
   passthru.updateScript = nix-update-script { };
@@ -29,10 +27,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://iina.io/";
     description = "The modern media player for macOS";
-    platforms = platforms.darwin;
     license = licenses.gpl3;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    mainProgram = "iina";
+    mainProgram = "iina-cli";
     maintainers = with maintainers; [ arkivm stepbrobd ];
   };
 }

From 29c3b5f7fe1b8f056b6a60d2389be0a44deb2a71 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 10:26:52 +0100
Subject: [PATCH 07/13] treewide: refactor to use darwin.installBinaryPackage
 (stats)

---
 pkgs/by-name/st/stats/package.nix | 23 +++++------------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index 4da58eed1ce1c..43757bd6e3b60 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -1,36 +1,23 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, darwin
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
+darwin.installBinaryPackage rec {
   pname = "stats";
   version = "2.10.3";
 
   src = fetchurl {
-    url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
+    url = "https://github.com/exelban/stats/releases/download/v${version}/Stats.dmg";
     hash = "sha256-PSRK9YihiIHKHade3XE/OnAleBhmu71CNFyzJ/Upx/A=";
   };
-  sourceRoot = ".";
-
-  nativeBuildInputs = [ undmg ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications
-    cp -r *.app $out/Applications
-
-    runHook postInstall
-  '';
+  sourceRoot = "Stats";
 
   meta = with lib; {
     description = "macOS system monitor in your menu bar";
     homepage = "https://github.com/exelban/stats";
     license = licenses.mit;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ emilytrau Enzime ];
-    platforms = platforms.darwin;
   };
-})
+}

From 0b89a4babb3ed60028b769df308d2e7de691a6cb Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 10:29:59 +0100
Subject: [PATCH 08/13] treewide: refactor to use darwin.installBinaryPackage
 (hoppscotch)

---
 pkgs/by-name/ho/hoppscotch/package.nix | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index 3e6bf1ac190ca..54035a39686a1 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -1,8 +1,8 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchurl
 , appimageTools
-, undmg
+, darwin
 , nix-update-script
 }:
 
@@ -23,7 +23,7 @@ let
       url = "https://github.com/hoppscotch/releases/releases/download/v${version}-1/Hoppscotch_linux_x64.AppImage";
       hash = "sha256-MYQ7SRm+CUPIXROZxejbbZ0/wH+U5DQO4YGbE/HQAj8=";
     };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  }.${stdenvNoCC.system} or (throw "Unsupported system: ${stdenvNoCC.system}");
 
   meta = {
     description = "Open source API development ecosystem";
@@ -34,22 +34,12 @@ let
     maintainers = with lib.maintainers; [ DataHearth ];
   };
 in
-if stdenv.isDarwin then stdenv.mkDerivation
+if stdenvNoCC.isDarwin then darwin.installBinaryPackage
 {
   inherit pname version src meta;
 
-  sourceRoot = ".";
-
-  nativeBuildInputs = [ undmg ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/Applications"
-    mv Hoppscotch.app $out/Applications/
-
-    runHook postInstall
-  '';
+  sourceRoot = "Hoppscotch";
+  appName = "Hoppscotch.app";
 }
 else appimageTools.wrapType2 {
   inherit pname version src meta;

From 0961514c8e6433a1a5f9f47de5ddaca7ec5acfec Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 10:55:49 +0100
Subject: [PATCH 09/13] treewide: refactor to use darwin.installBinaryPackage
 (zoom-us)

---
 .../instant-messengers/zoom-us/default.nix    | 136 ++++++++----------
 1 file changed, 61 insertions(+), 75 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index dcd573e69d30e..8adeaab19ec32 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -3,8 +3,7 @@
 , fetchurl
 , pipewire
 , makeWrapper
-, xar
-, cpio
+, darwin
   # Dynamic libraries
 , alsa-lib
 , atk
@@ -112,81 +111,10 @@ let
     libkrb5
   ] ++ lib.optional (pulseaudioSupport) libpulseaudio);
 
-in
-stdenv.mkDerivation rec {
   pname = "zoom";
   version = versions.${system} or throwSystem;
-
   src = srcs.${system} or throwSystem;
-
-  dontUnpack = stdenv.isLinux;
-  unpackPhase = lib.optionalString stdenv.isDarwin ''
-    xar -xf $src
-    zcat < zoomus.pkg/Payload | cpio -i
-  '';
-
-  nativeBuildInputs = [
-    makeWrapper
-  ]
-  ++ lib.optionals stdenv.isDarwin [
-    xar
-    cpio
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    ${rec {
-      aarch64-darwin = ''
-        mkdir -p $out/Applications
-        cp -R zoom.us.app $out/Applications/
-      '';
-      # darwin steps same on both architectures
-      x86_64-darwin = aarch64-darwin;
-      x86_64-linux = ''
-        mkdir $out
-        tar -C $out -xf $src
-        mv $out/usr/* $out/
-      '';
-    }.${system} or throwSystem}
-    runHook postInstall
-  '';
-
-  postFixup = lib.optionalString stdenv.isLinux ''
-    # Desktop File
-    substituteInPlace $out/share/applications/Zoom.desktop \
-        --replace "Exec=/usr/bin/zoom" "Exec=$out/bin/zoom"
-
-    for i in aomhost zopen zoom ZoomLauncher; do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/zoom/$i
-    done
-
-    # ZoomLauncher sets LD_LIBRARY_PATH before execing zoom
-    # IPC breaks if the executable name does not end in 'zoom'
-    mv $out/opt/zoom/zoom $out/opt/zoom/.zoom
-    makeWrapper $out/opt/zoom/.zoom $out/opt/zoom/zoom \
-      --prefix LD_LIBRARY_PATH ":" ${libs}
-
-    rm $out/bin/zoom
-    # Zoom expects "zopen" executable (needed for web login) to be present in CWD. Or does it expect
-    # everybody runs Zoom only after cd to Zoom package directory? Anyway, :facepalm:
-    # Clear Qt paths to prevent tripping over "foreign" Qt resources.
-    # Clear Qt screen scaling settings to prevent over-scaling.
-    makeWrapper $out/opt/zoom/ZoomLauncher $out/bin/zoom \
-      --chdir "$out/opt/zoom" \
-      --unset QML2_IMPORT_PATH \
-      --unset QT_PLUGIN_PATH \
-      --unset QT_SCREEN_SCALE_FACTORS \
-      --prefix PATH : ${lib.makeBinPath [ coreutils glib.dev pciutils procps util-linux ]} \
-      --prefix LD_LIBRARY_PATH ":" ${libs}
-
-    # Backwards compatiblity: we used to call it zoom-us
-    ln -s $out/bin/{zoom,zoom-us}
-  '';
-
-  # already done
-  dontPatchELF = true;
-
-  passthru.updateScript = ./update.sh;
+  updateScript = ./update.sh;
 
   meta = with lib; {
     homepage = "https://zoom.us/";
@@ -197,4 +125,62 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ danbst tadfisher ];
     mainProgram = "zoom";
   };
-}
+
+  linux = stdenv.mkDerivation {
+    dontUnpack = true;
+    dontPatchELF = true; # already done
+
+    nativeBuildInputs = [ makeWrapper ];
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      tar -C $out -xf $src
+      mv $out/usr/* $out/
+      runHook postInstall
+    '';
+
+    postFixup = lib.optionalString stdenv.isLinux ''
+      # Desktop File
+      substituteInPlace $out/share/applications/Zoom.desktop \
+          --replace "Exec=/usr/bin/zoom" "Exec=$out/bin/zoom"
+
+      for i in aomhost zopen zoom ZoomLauncher; do
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/zoom/$i
+      done
+
+      # ZoomLauncher sets LD_LIBRARY_PATH before execing zoom
+      # IPC breaks if the executable name does not end in 'zoom'
+      mv $out/opt/zoom/zoom $out/opt/zoom/.zoom
+      makeWrapper $out/opt/zoom/.zoom $out/opt/zoom/zoom \
+        --prefix LD_LIBRARY_PATH ":" ${libs}
+
+      rm $out/bin/zoom
+      # Zoom expects "zopen" executable (needed for web login) to be present in CWD. Or does it expect
+      # everybody runs Zoom only after cd to Zoom package directory? Anyway, :facepalm:
+      # Clear Qt paths to prevent tripping over "foreign" Qt resources.
+      # Clear Qt screen scaling settings to prevent over-scaling.
+      makeWrapper $out/opt/zoom/ZoomLauncher $out/bin/zoom \
+        --chdir "$out/opt/zoom" \
+        --unset QML2_IMPORT_PATH \
+        --unset QT_PLUGIN_PATH \
+        --unset QT_SCREEN_SCALE_FACTORS \
+        --prefix PATH : ${lib.makeBinPath [ coreutils glib.dev pciutils procps util-linux ]} \
+        --prefix LD_LIBRARY_PATH ":" ${libs}
+
+      # Backwards compatiblity: we used to call it zoom-us
+      ln -s $out/bin/{zoom,zoom-us}
+    '';
+
+    passthru.updateScript = updateScript;
+  };
+
+  darwin' = darwin.installBinaryPackage {
+    inherit pname version src meta;
+    appName = "zoom.us.app";
+    passthru.updateScript = updateScript;
+  };
+in
+if stdenv.isDarwin
+then darwin'
+else linux

From 3c51197c4cacfacd63cdd6da6bd553b3c3d195f9 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 11:59:37 +0100
Subject: [PATCH 10/13] treewide: refactor to use darwin.installBinaryPackage
 (karabiner-elements)

---
 .../darwin/karabiner-elements/default.nix     | 31 ++++++++-----------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/pkgs/os-specific/darwin/karabiner-elements/default.nix b/pkgs/os-specific/darwin/karabiner-elements/default.nix
index f42ce5b5be2fc..057da2ea630c2 100644
--- a/pkgs/os-specific/darwin/karabiner-elements/default.nix
+++ b/pkgs/os-specific/darwin/karabiner-elements/default.nix
@@ -1,43 +1,39 @@
-{ lib, stdenv, fetchurl, cpio, xar, undmg }:
+{ lib, stdenvNoCC, fetchurl, darwin }:
 
-stdenv.mkDerivation rec {
+darwin.installBinaryPackage rec {
   pname = "karabiner-elements";
   version = "14.13.0";
 
   src = fetchurl {
     url = "https://github.com/pqrs-org/Karabiner-Elements/releases/download/v${version}/Karabiner-Elements-${version}.dmg";
-    sha256 = "sha256-gmJwoht/Tfm5qMecmq1N6PSAIfWOqsvuHU8VDJY8bLw=";
+    hash = "sha256-gmJwoht/Tfm5qMecmq1N6PSAIfWOqsvuHU8VDJY8bLw=";
   };
 
   outputs = [ "out" "driver" ];
 
-  nativeBuildInputs = [ cpio xar undmg ];
-
-  unpackPhase = ''
-    undmg $src
-    xar -xf Karabiner-Elements.pkg
-    cd Installer.pkg
-    zcat Payload | cpio -i
-    cd ../Karabiner-DriverKit-VirtualHIDDevice.pkg
-    zcat Payload | cpio -i
-    cd ..
+  postUnpack = ''
+    pushd ''${sourceRoot}
+    unpackPkg Karabiner-Elements-${version}/Karabiner-Elements.pkg .
+    bsdtar -xf Installer.pkg/Payload -C Installer.pkg
+    bsdtar -xf Karabiner-DriverKit-VirtualHIDDevice.pkg/Payload -C Karabiner-DriverKit-VirtualHIDDevice.pkg
+    popd
   '';
 
-  sourceRoot = ".";
-
+  dontPatch = false;
   postPatch = ''
     for f in *.pkg/Library/Launch{Agents,Daemons}/*.plist; do
       substituteInPlace $f \
-        --replace "/Library/" "$out/Library/"
+        --replace-fail "/Library/" "$out/Library/"
     done
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out $driver
     cp -R Installer.pkg/Applications Installer.pkg/Library $out
     cp -R Karabiner-DriverKit-VirtualHIDDevice.pkg/Applications Karabiner-DriverKit-VirtualHIDDevice.pkg/Library $driver
-
     cp "$out/Library/Application Support/org.pqrs/Karabiner-Elements/package-version" "$out/Library/Application Support/org.pqrs/Karabiner-Elements/version"
+    runHook postInstall
   '';
 
   passthru.updateScript = ./updater.sh;
@@ -45,7 +41,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later.";
     homepage = "https://karabiner-elements.pqrs.org/";
-    platforms = platforms.darwin;
     maintainers = with maintainers; [ Enzime ];
     license = licenses.unlicense;
   };

From 3bd57b8e96bb6399c0cae09db34119ad17cc077d Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 12:11:31 +0100
Subject: [PATCH 11/13] treewide: refactor to use darwin.installBinaryPackage
 (nosql-workbench)

---
 pkgs/by-name/no/nosql-workbench/package.nix | 36 ++++++---------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/pkgs/by-name/no/nosql-workbench/package.nix b/pkgs/by-name/no/nosql-workbench/package.nix
index 1b96328b211b4..340676b92d7f5 100644
--- a/pkgs/by-name/no/nosql-workbench/package.nix
+++ b/pkgs/by-name/no/nosql-workbench/package.nix
@@ -1,10 +1,9 @@
-{
-  appimageTools,
-  lib,
-  fetchurl,
-  jdk21,
-  stdenv,
-  _7zz
+{ lib
+, appimageTools
+, fetchurl
+, jdk21
+, stdenvNoCC
+, darwin
 }:
 let
   pname = "nosql-workbench";
@@ -23,7 +22,7 @@ let
       url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-linux-${version}.AppImage";
       hash = "sha256-cDOSbhAEFBHvAluxTxqVpva1GJSlFhiozzRfuM4MK5c=";
     };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  }.${stdenvNoCC.system} or (throw "Unsupported system: ${stdenvNoCC.system}");
 
   meta = {
     description = "Visual tool that provides data modeling, data visualization, and query development features to help you design, create, query, and manage DynamoDB tables";
@@ -34,27 +33,10 @@ let
     platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ];
   };
 in
-if stdenv.isDarwin then stdenv.mkDerivation {
+if stdenvNoCC.isDarwin then darwin.installBinaryPackage {
   inherit pname version src meta;
-
-  sourceRoot = ".";
-
-  # DMG file is using APFS which is unsupported by "undmg".
-  # Instead, use "7zz" to extract the contents.
-  # "undmg" issue: https://github.com/matthewbauer/undmg/issues/4
-  nativeBuildInputs = [ _7zz ];
-
+  appName = "NoSQL Workbench.app";
   buildInputs = [ jdk21 ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/Applications"
-    mv NoSQL\ Workbench.app $out/Applications/
-
-    runHook postInstall
-  '';
-
 } else appimageTools.wrapType2 {
   inherit pname version src meta;
 

From 795d0137a07a10e68bd3d48ace0d1828ad7cac16 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 13:25:36 +0100
Subject: [PATCH 12/13] treewide: refactor to use darwin.installBinaryPackage
 (utm)

---
 pkgs/os-specific/darwin/utm/default.nix | 20 +++++++-------------
 pkgs/top-level/all-packages.nix         |  2 --
 pkgs/top-level/darwin-packages.nix      |  2 ++
 3 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/pkgs/os-specific/darwin/utm/default.nix b/pkgs/os-specific/darwin/utm/default.nix
index 50f84a254dfc2..be6b2f69a14ec 100644
--- a/pkgs/os-specific/darwin/utm/default.nix
+++ b/pkgs/os-specific/darwin/utm/default.nix
@@ -1,11 +1,11 @@
 { lib
-, undmg
 , makeWrapper
 , fetchurl
 , stdenvNoCC
+, darwin
 }:
 
-stdenvNoCC.mkDerivation rec {
+darwin.installBinaryPackage rec {
   pname = "utm";
   version = "4.4.5";
 
@@ -14,23 +14,18 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-FlIPSWqY2V1akd/InS6BPEBfc8pomJ8jgDns7wvaOm8=";
   };
 
-  nativeBuildInputs = [ undmg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
-  sourceRoot = ".";
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications
-    cp -r *.app $out/Applications
+  appName = "UTM.app";
+  sourceRoot = "UTM";
 
+  postaInstall = ''
     mkdir -p $out/bin
     for bin in $out/Applications/UTM.app/Contents/MacOS/*; do
       # Symlinking `UTM` doesn't work; seems to look for files in the wrong
       # place
       makeWrapper $bin "$out/bin/$(basename $bin)"
     done
-
-    runHook postInstall
   '';
 
   meta = with lib; {
@@ -57,11 +52,10 @@ stdenvNoCC.mkDerivation rec {
       See https://docs.getutm.app/ for more information.
     '';
     homepage = "https://mac.getutm.app/";
-    changelog = "https://github.com/utmapp/${pname}/releases/tag/v${version}";
+    changelog = "https://github.com/utmapp/utm/releases/tag/v${version}";
     mainProgram = "UTM";
     license = licenses.asl20;
     platforms = platforms.darwin; # 11.3 is the minimum supported version as of UTM 4.
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ rrbutani wegank ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 480f53800aaf6..cc92117f36b6c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -35702,8 +35702,6 @@ with pkgs;
 
   uwimap = callPackage ../tools/networking/uwimap { };
 
-  utm = callPackage ../os-specific/darwin/utm { };
-
   utox = callPackage ../applications/networking/instant-messengers/utox { };
 
   valentina = libsForQt5.callPackage ../applications/misc/valentina { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 8f7fbb956b7c2..090b2ba876365 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -192,6 +192,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   trash = callPackage ../os-specific/darwin/trash { };
 
+  utm = callPackage ../os-specific/darwin/utm { };
+
   xattr = pkgs.python3Packages.callPackage ../os-specific/darwin/xattr { };
 
   inherit (pkgs.callPackages ../os-specific/darwin/xcode { })

From 8b89c2cbbd1de539370cfd02b08ef3d019ba7523 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Mar 2024 13:51:58 +0100
Subject: [PATCH 13/13] treewide: refactor to use darwin.installBinaryPackage
 (monitorcontrol)

---
 .../darwin}/monitorcontrol/default.nix            | 15 +++------------
 pkgs/top-level/all-packages.nix                   |  2 --
 pkgs/top-level/darwin-packages.nix                |  2 ++
 3 files changed, 5 insertions(+), 14 deletions(-)
 rename pkgs/{applications/misc => os-specific/darwin}/monitorcontrol/default.nix (70%)

diff --git a/pkgs/applications/misc/monitorcontrol/default.nix b/pkgs/os-specific/darwin/monitorcontrol/default.nix
similarity index 70%
rename from pkgs/applications/misc/monitorcontrol/default.nix
rename to pkgs/os-specific/darwin/monitorcontrol/default.nix
index b5a6935958e23..09fc5e7538c1f 100644
--- a/pkgs/applications/misc/monitorcontrol/default.nix
+++ b/pkgs/os-specific/darwin/monitorcontrol/default.nix
@@ -1,9 +1,9 @@
-{ lib, fetchurl, stdenv, _7zz }:
+{ lib, fetchurl, darwin }:
 
 # This cannot be built from source due to the problematic nature of XCode - so
 # this is what it's like when doves cry?
 
-stdenv.mkDerivation rec {
+darwin.installBinaryPackage rec {
   pname = "MonitorControl";
   version = "4.2.0";
 
@@ -13,15 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "Q96uK6wVe1D2uLvWL+pFR6LcmrU7cgmr2Y5tPvvTDgI=";
   };
 
-  # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
-  nativeBuildInputs = [ _7zz ];
-
-  sourceRoot = "MonitorControl.app";
-
-  installPhase = ''
-    mkdir -p "$out/Applications/MonitorControl.app"
-    cp -R . "$out/Applications/MonitorControl.app"
-  '';
+  appName = "MonitorControl.app";
 
   meta = with lib; {
     description = "A macOS system extension to control brightness and volume of external displays with native OSD";
@@ -29,6 +21,5 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/MonitorControl/MonitorControl#readme";
     license = licenses.mit;
     maintainers = with maintainers; [ cbleslie cottand ];
-    platforms = platforms.darwin;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cc92117f36b6c..c366f020c1c96 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33367,8 +33367,6 @@ with pkgs;
 
   mod-distortion = callPackage ../applications/audio/mod-distortion { };
 
-  monitorcontrol = callPackage ../applications/misc/monitorcontrol { };
-
   xmr-stak = callPackage ../applications/misc/xmr-stak { };
 
   xmrig = darwin.apple_sdk_11_0.callPackage ../applications/misc/xmrig { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 090b2ba876365..26d904601fea5 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -182,6 +182,8 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     inherit (pkgs.darwin) cctools sigtool;
   };
 
+  monitorcontrol = callPackage ../os-specific/darwin/monitorcontrol { };
+
   opencflite = callPackage ../os-specific/darwin/opencflite { };
 
   openwith = pkgs.darwin.apple_sdk_11_0.callPackage ../os-specific/darwin/openwith {