`nix run github:rustfs/rustfs` fails on macOS (darwin) due to removed `darwin.apple_sdk` API in nixpkgs

[etak64n]

Summary

nix run github:rustfs/rustfs fails on macOS (aarch64-darwin / x86_64-darwin) because flake.nix references pkgs.darwin.apple_sdk.frameworks.Security and pkgs.darwin.apple_sdk.frameworks.SystemConfiguration, which have been removed from nixpkgs.

Environment

• OS: macOS 15.x (aarch64-darwin)
• Nix: 2.33.3
• RustFS: 0.0.5 (flake revision: 583377d2a5b458beb5043495e4b38f642a36f23a)
• nixpkgs: 2343bbb58f99267223bc2aac4fc9ea301a155a16 (2026-02-11, nixpkgs-unstable)

Steps to Reproduce

1. Run the following command on macOS:

   nix run github:rustfs/rustfs

2. The build fails during Nix evaluation with the following error:

   error:
          … while calling the 'derivationStrict' builtin
            at «nix-internal»/derivation-internal.nix:37:12:
              36|
              37|   strict = derivationStrict drvAttrs;
                |            ^
              38|
   
          … while evaluating derivation 'rustfs-0.0.5'
            whose name attribute is located at
            «github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16
            ?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D»
            /pkgs/stdenv/generic/make-derivation.nix:536:13
   
          … while evaluating attribute '__impureHostDeps' of derivation 'rustfs-0.0.5'
            at «github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16
            ?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D»
            /pkgs/stdenv/generic/make-derivation.nix:688:15:
             687|               );
             688|               __impureHostDeps =
                |               ^
             689|                 computedImpureHostDeps
   
          (stack trace truncated; use '--show-trace' to show the full, detailed trace)
   
          error: darwin.apple_sdk_11_0 has been removed as it was a legacy
          compatibility stub; see
          <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks>
          for migration instructions
   

Expected Behavior

RustFS should build and start successfully on macOS via nix run.

Actual Behavior

The build fails during Nix evaluation before compilation begins. This affects both packages.default and devShells.default.

What I Tried

• Pinning nixpkgs to nixos-25.05 via --override-input:
  • Result: Build succeeds with deprecation warnings
  • This confirms the issue is specific to the nixpkgs revision pinned in flake.lock

  nix run github:rustfs/rustfs \
    --override-input nixpkgs github:NixOS/nixpkgs/nixos-25.05

• Removing darwin.apple_sdk.frameworks.* from buildInputs locally:
  • Result: Not tested (would require forking the repo)

Root Cause

The flake.nix references pkgs.darwin.apple_sdk.frameworks.Security and pkgs.darwin.apple_sdk.frameworks.SystemConfiguration in buildInputs:

https://github.com/rustfs/rustfs/blob/583377d/flake.nix

buildInputs = with pkgs; [
  openssl
] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
  pkgs.darwin.apple_sdk.frameworks.Security
  pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
];

nixpkgs has replaced darwin.apple_sdk with a throw expression in pkgs/top-level/darwin-aliases.nix (NixOS/nixpkgs#346043):

apple_sdk = apple_sdk_11_0;
apple_sdk_11_0 = mkThrow "apple_sdk_11_0";

The flake.lock pins nixpkgs to 2343bbb (2026-02-11), which is after this removal. On nixpkgs 25.05, the stubs still exist but print deprecation warnings. On the current nixpkgs-unstable, they throw.

Tracking issue for the Darwin SDK migration: NixOS/nixpkgs#354146

Suggested Fix

Remove the explicit framework references from buildInputs. The new Darwin stdenv includes all standard frameworks (Security, SystemConfiguration, etc.) by default via $SDKROOT. Rust crates that link against these frameworks via -framework linker flags will work without explicit buildInputs.

 buildInputs = with pkgs; [
   openssl
-] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
-  pkgs.darwin.apple_sdk.frameworks.Security
-  pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
 ];

This change is needed in both packages.default and devShells.default.

If a specific SDK version is required, the new API is:

buildInputs = with pkgs; [
  openssl
] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
  pkgs.apple-sdk_11
];

I can submit a PR if this approach looks correct.

Workaround

Until this is fixed, users can pin nixpkgs to nixos-25.05:

nix run github:rustfs/rustfs \
  --override-input nixpkgs github:NixOS/nixpkgs/nixos-25.05

This produces deprecation warnings but builds successfully.

References

• darwin: change the SDK pattern, update the SDKs, and update source releases NixOS/nixpkgs#346043 - darwin: change the SDK pattern, update the SDKs
• Tracking: New Darwin SDK pattern migration NixOS/nixpkgs#354146 - Tracking: New Darwin SDK pattern migration
• https://discourse.nixos.org/t/the-darwin-sdks-have-been-updated/55295
• https://nixos.org/manual/nixpkgs/stable/#sec-darwin

[etak64n]

Details

Problem Summary

The RustFS Nix Flake fails to build on macOS (aarch64-darwin / x86_64-darwin) when running nix run github:rustfs/rustfs.
The cause is that pkgs.darwin.apple_sdk, which RustFS's flake.nix references, has been removed from nixpkgs.

As of 2026-02-20, no issue for this problem exists on the RustFS repository.

Reproducing the Error

The environment used to reproduce the error is as follows.

• OS: macOS 15.5 (aarch64-darwin)
• Nix: 2.33.3
• RustFS: 0.0.5 (revision: 583377d)

Running the following command on macOS produces the error.

# Run RustFS via Nix
nix run github:rustfs/rustfs

The error message is as follows.

error:
       … while calling the 'derivationStrict' builtin
         at «nix-internal»/derivation-internal.nix:37:12:
           36|
           37|   strict = derivationStrict drvAttrs;
             |            ^
           38|

       … while evaluating derivation 'rustfs-0.0.5'
         whose name attribute is located at
         «github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16
         ?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D»
         /pkgs/stdenv/generic/make-derivation.nix:536:13

       … while evaluating attribute '__impureHostDeps' of derivation 'rustfs-0.0.5'
         at «github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16
         ?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D»
         /pkgs/stdenv/generic/make-derivation.nix:688:15:
          687|               );
          688|               __impureHostDeps =
             |               ^
          689|                 computedImpureHostDeps

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: darwin.apple_sdk_11_0 has been removed as it was a legacy
       compatibility stub; see
       <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks>
       for migration instructions

The error occurs during the Nix evaluation phase.
Since it fails before compilation begins, both packages.default and devShells.default are affected.

Root Cause Investigation

Identifying the Reference

The error message contains darwin.apple_sdk_11_0, so we first searched for this name in RustFS's flake.nix.
However, the string apple_sdk_11_0 does not exist in RustFS's code.

Searching for apple_sdk instead, we found the following references in the macOS buildInputs.

# flake.nix (RustFS repository)
buildInputs = with pkgs; [
  openssl
] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
  pkgs.darwin.apple_sdk.frameworks.Security
  pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
];

These references are present in both packages.default and devShells.default.

RustFS references darwin.apple_sdk, but the error message refers to darwin.apple_sdk_11_0.
pkgs is generated from nixpkgs in the following line of flake.nix.

# flake.nix (RustFS repository)
pkgs = import nixpkgs { inherit system overlays; };

Therefore, the definition of pkgs.darwin.apple_sdk is in the nixpkgs repository (https://github.com/NixOS/nixpkgs).
To resolve this name mismatch, we investigated the definition of darwin.apple_sdk on the nixpkgs side.

Resolving the Name Mismatch

We examined pkgs/top-level/darwin-aliases.nix in nixpkgs.

# pkgs/top-level/darwin-aliases.nix (nixpkgs)
mkThrow = name:
  throw "darwin.${name} has been removed as it was a legacy
  compatibility stub; see
  <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks>
  for migration instructions";

apple_sdk_11_0 = mkThrow "apple_sdk_11_0";
apple_sdk_12_3 = mkThrow "apple_sdk_12_3";
apple_sdk = apple_sdk_11_0;

In the current nixpkgs implementation, apple_sdk_11_0 still exists as an attribute, but its value has been replaced with a throw expression instead of the actual SDK.
Evaluating apple_sdk_11_0 produces an error message instead of returning the SDK.
The last line, apple_sdk = apple_sdk_11_0, makes apple_sdk an alias for apple_sdk_11_0.

The error occurs as follows.

1. RustFS's flake.nix references pkgs.darwin.apple_sdk.frameworks.Security
2. Nix evaluates darwin.apple_sdk
3. The alias resolves to apple_sdk_11_0
4. The throw expression in apple_sdk_11_0 is evaluated, producing an error
5. Execution stops before reaching the .frameworks.Security access

This is why the error message displays darwin.apple_sdk_11_0 even though RustFS references darwin.apple_sdk.

This change was introduced in nixpkgs PR #346043 (NixOS/nixpkgs#346043).
The PR title is "darwin: change the SDK pattern, update the SDKs, and update source releases".
The PR description states the following.

There are currently three different SDKs in nixpkgs, which are all built slightly differently.
...
Adding a new SDK version is a non-trivial amount of work.
...
Knowing which frameworks to use is not obvious, especially if you do not have access to Darwin hardware.

This PR fundamentally changed the Darwin SDK structure and removed the following legacy APIs.

1. darwin.apple_sdk (alias for apple_sdk_11_0)
2. darwin.apple_sdk_11_0
3. darwin.apple_sdk_12_3

According to the NixOS Discourse announcement (https://discourse.nixos.org/t/the-darwin-sdks-have-been-updated/55295), these were replaced with new hyphenated APIs.
The announcement lists the following new SDK names.

• apple-sdk (default SDK)
• apple-sdk_10_12
• apple-sdk_13
• apple-sdk_15

This migration is tracked in nixpkgs issue #354146 (NixOS/nixpkgs#354146).

Timeline of the Breaking Change

From the investigation so far, we determined that the error is caused by darwin.apple_sdk, which RustFS references, being replaced with a throw expression on the nixpkgs side.
When was this replacement made?
By checking whether the nixpkgs revision pinned in RustFS's flake.lock falls before or after the removal, we can determine which version to pin to as a workaround.

We examined RustFS's flake.lock (https://github.com/rustfs/rustfs/blob/583377d/flake.lock) at the latest revision 583377d as of the investigation date (2026-02-20).
The nixpkgs input is pinned as follows.

// flake.lock (RustFS repository)
"locked": {
  "lastModified": 1770843696,
  "narHash": "sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8=",
  "owner": "NixOS",
  "repo": "nixpkgs",
  "rev": "2343bbb58f99267223bc2aac4fc9ea301a155a16",
  "type": "github"
},
"original": {
  "owner": "NixOS",
  "ref": "nixpkgs-unstable",
  "repo": "nixpkgs",
  "type": "github"
}

• Revision: 2343bbb58f99267223bc2aac4fc9ea301a155a16
• Date: 2026-02-11 (calculated from the lastModified UNIX timestamp)
• Branch: nixpkgs-unstable

We checked the darwin-aliases.nix at revision 2343bbb, which is pinned in RustFS's flake.lock (https://github.com/NixOS/nixpkgs/blob/2343bbb/pkgs/top-level/darwin-aliases.nix), and confirmed that it contains the throw expression as shown in the previous section.
This is the direct cause of the RustFS build failure.

As a workaround until RustFS releases a fix, we looked for a version of nixpkgs that does not contain the throw.
We checked the same file on the latest stable branch, nixpkgs 25.05 (https://github.com/NixOS/nixpkgs/blob/nixos-25.05/pkgs/top-level/darwin-aliases.nix), and confirmed that the legacy APIs remain as stubs.
Therefore, we determined that pinning nixpkgs to 25.05 would serve as a workaround.

We verified this by running with --override-input to pin nixpkgs to 25.05. The build succeeded and the RustFS binary started.

(๑>ᴗ<) < nix run github:rustfs/rustfs --override-input nixpkgs github:NixOS/nixpkgs/nixos-25.05 --no-eval-cache
warning: not writing modified lock file of flake 'github:rustfs/rustfs':
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D' (2026-02-11)
  → 'github:NixOS/nixpkgs/ac62194c3917d5f474c1a844b6fd6da2db95077d?narHash=sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w%3D' (2026-01-02)
evaluation warning: darwin.apple_sdk_11_0.Security: these stubs do nothing and will be removed in Nixpkgs 25.11; see <https://nixos.org/manual/nixpkgs/stable/#sec-darwin> for documentation and migration instructions.
evaluation warning: darwin.apple_sdk_11_0.SystemConfiguration: these stubs do nothing and will be removed in Nixpkgs 25.11; see <https://nixos.org/manual/nixpkgs/stable/#sec-darwin> for documentation and migration instructions.
error: the following required arguments were not provided:
  <VOLUMES>...

Usage: rustfs <VOLUMES>...

For more information, try '--help'.

The Usage: rustfs <VOLUMES>... at the end is a usage error from RustFS itself.
This indicates that the Nix build completed successfully and the RustFS binary was executed.

Proposed Fix

Pinning to nixpkgs 25.05 is a temporary workaround.
As stated in the warning message, the stubs will be removed in Nixpkgs 25.11.
Therefore, a permanent fix is needed: removing the legacy API references from RustFS's flake.nix.

Remove the darwin conditional from buildInputs.

# Before (causes error)
buildInputs = with pkgs; [
  openssl
] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
  pkgs.darwin.apple_sdk.frameworks.Security
  pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
];

# After (remove darwin conditional)
buildInputs = with pkgs; [
  openssl
];

If a specific SDK version is required, use the new API.

# After (when a specific SDK version is required)
buildInputs = with pkgs; [
  openssl
] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
  pkgs.apple-sdk_11
];

Rationale for the Fix

This section provides evidence that removing the framework references will not break the build.

The nixpkgs manual (https://nixos.org/manual/nixpkgs/stable/#sec-darwin) states that references to the legacy API should be deleted.

You may see references to darwin.apple_sdk.frameworks. This is the legacy SDK pattern, and it is being phased out.
All packages in darwin.apple_sdk, darwin.apple_sdk_11_0, and darwin.apple_sdk_12_3 have been removed.
If your derivation references them, you should delete those references, as the default SDK should be enough to build your package.

The migration tracking issue #354146 (NixOS/nixpkgs#354146) provides a concrete migration example.

Some examples of the migration are:

• Removing the following from packages when using the default (unversioned) SDK, as it is now in the Darwin stdenv

{
  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.Security
  ];
}

This migration example matches the case of RustFS's flake.nix.

The mechanism by which frameworks work without explicit specification is as follows.
The body of PR #346043 (NixOS/nixpkgs#346043) states that the new SDK is included in stdenv by default.

A default SDK is provided as an extraBuildInput in the Darwin stdenv.

The same PR body states that frameworks are placed under $SDKROOT.

Frameworks can be found at SDKROOT/System/Library/Frameworks

The nixpkgs manual states that Darwin compilers and linkers refer to the SDK sysroot.

Compilers and binutils targeting Darwin look for system paths in the SDK sysroot.
Some of them (such as Zig or bindgen for Rust) depend on it.

RustFS's dependency crates reference frameworks via linker flags (e.g., -framework Security).
Since the linker searches $SDKROOT for frameworks, explicit specification in buildInputs is not needed.

Temporary Workaround

Until RustFS releases a fix, users can work around the issue by pinning nixpkgs to a version where the legacy API still exists.

# Pin nixpkgs to 25.05 and run
nix run github:rustfs/rustfs \
  --override-input nixpkgs github:NixOS/nixpkgs/nixos-25.05

This produces deprecation warnings, but the build succeeds.

Resources Used in This Investigation

• RustFS repository
  • https://github.com/rustfs/rustfs
• RustFS flake.nix
  • https://github.com/rustfs/rustfs/blob/583377d/flake.nix
• nixpkgs PR #346043 (Darwin SDK structure change)
  • darwin: change the SDK pattern, update the SDKs, and update source releases NixOS/nixpkgs#346043
• nixpkgs issue #354146 (Darwin SDK migration tracking)
  • Tracking: New Darwin SDK pattern migration NixOS/nixpkgs#354146
• NixOS Discourse (Darwin SDK update announcement)
  • https://discourse.nixos.org/t/the-darwin-sdks-have-been-updated/55295
• nixpkgs manual (Darwin platform notes)
  • https://nixos.org/manual/nixpkgs/stable/#sec-darwin

[loverustfs]

Hello @etak64n ,

Thank you for your contribution. #1884 is merged.