Strip versioned Xcode path from build flags (#414)

## Summary

We get reports of users failing to build extension modules on macOS due to the presence of a hardcoded Xcode path. Here's one example:

![bafkreih5iht5nuyhkuzrs3npkio5smggpcrwmwirjr7cq7wiftyx6f77xe-1](https://github.com/user-attachments/assets/7062ab4e-0bbe-4547-a983-0d58b5bf5c2c)

I wasn't able to reproduce this locally... until I set `CFLAGS` in my environment (to anything). It turns out that CPython already strips `-isysroot` on macOS, but _not_ if `CFLAGS` is set. See: https://github.com/python/cpython/blob/a03efb533a58fd13fb0cc7f4a5c02c8406a407bd/Lib/_osx_support.py#L331.

(I find this a bit surprising -- it should probably _still_ strip the values that are provided via `_sysconfigdata_t_darwin_darwin.py`, and only _not_ strip values that are set explicitly via a `CFLAGS` environment variable? But alas.)

This PR modifies our macOS builds to always strip `-isysroot`. We're effectively already doing this for users that _don't_ have any `CFLAGS` set globally, and the current value is almost always going to be wrong.

## Test Plan

I confirmed that `CFLAGS="-Wunreachable-code" uv pip install cffi==1.17.1 --python 3.13t --no-cache --verbose` succeeds with a build from this branch, but fails on `main`.

Author: charliermarsh

cpython-unix/build-cpython.sh

@@ -587,6 +587,7 @@ fi
 # that a) it works on as many machines as possible b) doesn't leak details
 # about the build environment, which is non-portable.
 cat > ${ROOT}/hack_sysconfig.py << EOF
+import json
 import os
 import sys
 import sysconfig
@@ -628,6 +629,41 @@ def replace_in_all(search, replace):
     replace_in_file(SYSCONFIGDATA, search, replace)
 
 
+def format_sysconfigdata():
+    """Reformat the sysconfigdata file to avoid implicit string concatenations.
+
+    In some Python versions, the sysconfigdata file contains implicit string
+    concatenations that extend over multiple lines, which make string replacement
+    much harder. This function reformats the file to avoid this issue.
+
+    See: https://github.com/python/cpython/blob/a03efb533a58fd13fb0cc7f4a5c02c8406a407bd/Mac/BuildScript/build-installer.py#L1360C1-L1385C15.
+    """
+    with open(SYSCONFIGDATA, "rb") as fh:
+        data = fh.read()
+
+    globals_dict = {}
+    locals_dict = {}
+    exec(data, globals_dict, locals_dict)
+    build_time_vars = locals_dict['build_time_vars']
+
+    with open(SYSCONFIGDATA, "wb") as fh:
+        fh.write(b'# system configuration generated and used by the sysconfig module\n')
+        fh.write(('build_time_vars = %s' % json.dumps(build_time_vars, indent=4)).encode("utf-8"))
+        fh.close()
+
+
+# Format sysconfig to ensure that string replacements take effect.
+format_sysconfigdata()
+
+# Remove the Xcode path from the compiler flags.
+#
+# CPython itself will drop this from `sysconfig.get_config_var("CFLAGS")` and
+# similar calls, but _not_ if `CFLAGS` is set in the environment (regardless of
+# the `CFLAGS` value). It will almost always be wrong, so we drop it unconditionally.
+xcode_path = os.getenv("APPLE_SDK_PATH")
+if xcode_path:
+    replace_in_all("-isysroot %s" % xcode_path, "")
+
 # -fdebug-default-version is Clang only. Strip so compiling works on GCC.
 replace_in_all("-fdebug-default-version=4", "")
 

cpython-unix/build.py

@@ -186,6 +186,8 @@ def add_target_env(env, build_platform, target_triple, build_env):
         if not os.path.exists(sdk_path):
             raise Exception("macOS SDK path %s does not exist" % sdk_path)
 
+        env["APPLE_SDK_PATH"] = sdk_path
+
         # Grab the version from the SDK so we can put it in PYTHON.json.
         sdk_settings_path = pathlib.Path(sdk_path) / "SDKSettings.json"
         with sdk_settings_path.open("rb") as fh: