Merge #7184: build: target aarch64 over armv7, update to macOS 15.0 SDK (Xcode 16.0), add verification step to setup-sdk

PastaPastaPasta · PastaPastaPasta · commit 2e6a22560ed0 · 2026-02-28T10:46:13.000-06:00
1f64bad fix(build): include resource directory in search path for include resolution (Kittywhiskers Van Gogh) d201e43 fix(build): unset `C{,PLUS}_INCLUDE_PATH` to avoid cross-toolchain conflict (Kittywhiskers Van Gogh) 98e244a build: add verification step after downloading macOS SDK (Kittywhiskers Van Gogh) 7e9df77 build: update to macOS 15.0 SDK from Xcode 16.0 (Kittywhiskers Van Gogh) bfb638f build: make list of cross compilers more explicit, switch to ARMv8 (Kittywhiskers Van Gogh) Pull request description: ## Additional Information * Dependency for #7109 * To ensure our list of targets validated are matched with targets used for releases (see [`guix-start`](https://github.com/dashpay/dash/blob/1ea35a436d538c36380b6f3d3514091bf90bfaa8/contrib/containers/guix/scripts/guix-start#L29-L31)), we switch out `arm-linux-gnueabihf` with `aarch64-linux-gnu`, this is now reflected by changes to our GitHub CI configuration, build scripts, Guix CI action. * Additionally, since [dash#7047](#7047), we can't assume our host is x86_64 and must update packages to explicitly mention the desired arch instead of relying on that assumption. * As mentioned in [dash#6927](#6927), we need to update the macOS SDK to ensure we have standards-conformant definitions to deal with [dtolnay/cxx#1574](dtolnay/cxx#1574). * This does result in us using a higher SDK version than used upstream, requiring us to update the source URLs to our own fallback servers as upstream is not expected to host this version of the consolidated SDK. **This has no effect on the target version of macOS, which will continue to be macOS 14.** * SDKs shipped after Xcode 15.3 (15E204a) seem to have problems with Clang not able to determine the include paths correctly (see below for error). To resolve this issue, we now explicitly fetch the resource directory and add it to the includes list. <details> <summary>Build log:</summary> ``` In file included from conftest.cc:3: In file included from /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/c++/v1/iostream:43: [...] In file included from /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/machine/_types.h:34: /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/arm/_types.h:75:9: error: unknown type name 'ptrdiff_t' 75 | typedef ptrdiff_t __darwin_ptrdiff_t; /* ptr1 - ptr2 */ | ^ /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/arm/_types.h:85:9: error: unknown type name 'size_t' 85 | typedef size_t __darwin_size_t; /* sizeof() */ | ^ In file included from conftest.cc:3: [...] In file included from /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/c++/v1/__compare/three_way_comparable.h:12: /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/c++/v1/__compare/common_comparison_category.h:40:11: error: reference to unresolved using declaration 40 | template <size_t _Size> | ^ /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/c++/v1/cstddef:61:1: note: using declaration annotated with 'using_if_exists' here 61 | using ::size_t _LIBCPP_USING_IF_EXISTS; | ^ [...] In file included from conftest.cc:3: [...] In file included from /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/malloc/_malloc.h:44: /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/malloc/_malloc_type.h:54:110: error: unknown type name 'size_t'; did you mean 'sig_t'? 54 | _MALLOC_TYPE_AVAILABILITY void * __sized_by_or_null(size) malloc_type_realloc(void * __unsafe_indexable ptr, size_t size, malloc_type_id_t type_id) __result_use_check __alloc_size(2); | ^ /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/sys/signal.h:331:16: note: 'sig_t' declared here 331 | typedef void (*sig_t)(int); /* type of signal function */ | ^ ``` </summary> * Due to conflicting definitions between the native and cross toolchains, `C{,PLUS}_INCLUDE_PATH` needs to be unset to allow the cross toolchain's definitions to prevail (see build error below). <details> <summary>Build log:</summary> ``` In file included from conftest.cc:3: In file included from /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/c++/v1/iostream:43: [...] In file included from /gnu/store/8xqflpdzl6vzj3sas35q0g1ayiz0895k-gcc-toolchain-13.3.0/include/bits/types/mbstate_t.h:4: /gnu/store/8xqflpdzl6vzj3sas35q0g1ayiz0895k-gcc-toolchain-13.3.0/include/bits/types/__mbstate_t.h:21:3: error: typedef redefinition with different types ('struct __mbstate_t' vs 'union __mbstate_t') 21 | } __mbstate_t; | ^ /src/dash/depends/SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers/usr/include/i386/_types.h:94:3: note: previous definition is here 94 | } __mbstate_t; | ^ 1 error generated. configure:10623: $? = 1 failed program was: /* This test rejects g++ 2.7.2 which doesn't have <iostream>, only a pre-standard iostream.h. */ #include <iostream> ``` </summary> ## Breaking Changes None expected. ## Checklist - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas **(note: N/A)** - [x] I have added or updated relevant unit/integration/functional/e2e tests - [x] I have made corresponding changes to the documentation - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_ ACKs for top commit: UdjinM6: Compiles on macos, same hashes in Guix for ca6c6f5. Rebase to 1f64bad is clean. light ACK 1f64bad Tree-SHA512: fae43927cc72346a0eb87758c4292a329d48c4e86324fd4831a97ccea582c066d2d9aeafb0e209f2661122430d5ad0e6f3cf6d679926dbdc88945a05fc958dbd
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -63,13 +63,13 @@ jobs:
       file: ./contrib/containers/ci/ci-slim.Dockerfile
       name: dashcore-ci-slim
 
-  depends-arm-linux:
-    name: arm-linux-gnueabihf
+  depends-aarch64-linux:
+    name: aarch64-linux-gnu
     uses: ./.github/workflows/build-depends.yml
     needs: [container, cache-sources]
     if: ${{ vars.SKIP_ARM_LINUX == '' }}
     with:
-      build-target: arm-linux
+      build-target: aarch64-linux
       container-path: ${{ needs.container.outputs.path }}
 
   depends-linux64:
@@ -131,16 +131,16 @@ jobs:
     with:
       container-path: ${{ needs.container-slim.outputs.path }}
 
-  src-arm-linux:
-    name: arm-linux-build
+  src-aarch64-linux:
+    name: aarch64-linux-build
     uses: ./.github/workflows/build-src.yml
-    needs: [container, depends-arm-linux]
+    needs: [container, depends-aarch64-linux]
     with:
-      build-target: arm-linux
+      build-target: aarch64-linux
       container-path: ${{ needs.container.outputs.path }}
-      depends-key: ${{ needs.depends-arm-linux.outputs.key }}
-      depends-host: ${{ needs.depends-arm-linux.outputs.host }}
-      depends-dep-opts: ${{ needs.depends-arm-linux.outputs.dep-opts }}
+      depends-key: ${{ needs.depends-aarch64-linux.outputs.key }}
+      depends-host: ${{ needs.depends-aarch64-linux.outputs.host }}
+      depends-dep-opts: ${{ needs.depends-aarch64-linux.outputs.dep-opts }}
 
   src-linux64:
     name: linux64-build
diff --git a/.github/workflows/guix-build.yml b/.github/workflows/guix-build.yml
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     strategy:
       matrix:
-        build_target: [x86_64-linux-gnu, arm-linux-gnueabihf, aarch64-linux-gnu, riscv64-linux-gnu, powerpc64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]
+        build_target: [x86_64-linux-gnu, aarch64-linux-gnu, riscv64-linux-gnu, powerpc64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]
 
     timeout-minutes: 480
     steps:
diff --git a/ci/dash/matrix.sh b/ci/dash/matrix.sh
@@ -16,8 +16,8 @@ export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/l
 export TSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1"
 export UBSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1"
 
-if [ "$BUILD_TARGET" = "arm-linux" ]; then
-  source ./ci/test/00_setup_env_arm.sh
+if [ "$BUILD_TARGET" = "aarch64-linux" ]; then
+  source ./ci/test/00_setup_env_aarch64.sh
 elif [ "$BUILD_TARGET" = "linux64" ]; then
   source ./ci/test/00_setup_env_native_qt5.sh
 elif [ "$BUILD_TARGET" = "linux64_asan" ]; then
diff --git a/ci/test/00_setup_env.sh b/ci/test/00_setup_env.sh
@@ -71,7 +71,7 @@ export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_SCRATCH_DIR/out/$HOST}
 # Folder where the build is done (dist and out-of-tree build).
 export BASE_BUILD_DIR=${BASE_BUILD_DIR:-$BASE_SCRATCH_DIR/build-ci}
 export PREVIOUS_RELEASES_DIR=${PREVIOUS_RELEASES_DIR:-$BASE_ROOT_DIR/releases/$HOST}
-export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
+export SDK_URL=${SDK_URL:-https://s3.us-west-2.amazonaws.com/dash-depends-sources}
 export DOCKER_PACKAGES=${DOCKER_PACKAGES:-build-essential libtool autotools-dev automake pkg-config bsdmainutils curl ca-certificates ccache python3 rsync git procps}
 export GOAL=${GOAL:-install}
 export DIR_QA_ASSETS=${DIR_QA_ASSETS:-${BASE_SCRATCH_DIR}/qa-assets}
diff --git a/ci/test/00_setup_env_aarch64.sh b/ci/test/00_setup_env_aarch64.sh
@@ -6,23 +6,21 @@
 
 export LC_ALL=C.UTF-8
 
-export HOST=arm-linux-gnueabihf
+export HOST=aarch64-linux-gnu
 # The host arch is unknown, so we run the tests through qemu.
-# If the host is arm and wants to run the tests natively, it can set QEMU_USER_CMD to the empty string.
-if [ -z ${QEMU_USER_CMD+x} ]; then export QEMU_USER_CMD="${QEMU_USER_CMD:-"qemu-arm -L /usr/arm-linux-gnueabihf/"}"; fi
-export DPKG_ADD_ARCH="armhf"
-export PACKAGES="python3-zmq g++-arm-linux-gnueabihf busybox libc6:armhf libstdc++6:armhf libfontconfig1:armhf libxcb1:armhf"
+# If the host is arm64 and wants to run the tests natively, it can set QEMU_USER_CMD to the empty string.
+if [ -z ${QEMU_USER_CMD+x} ]; then export QEMU_USER_CMD="${QEMU_USER_CMD:-"qemu-aarch64 -L /usr/aarch64-linux-gnu/"}"; fi
+export DPKG_ADD_ARCH="arm64"
+export PACKAGES="python3-zmq g++-aarch64-linux-gnu busybox libc6:arm64 libstdc++6:arm64 libfontconfig1:arm64 libxcb1:arm64"
 if [ -n "$QEMU_USER_CMD" ]; then
   # Likely cross-compiling, so install the needed gcc and qemu-user
   export PACKAGES="$PACKAGES qemu-user"
 fi
-export CONTAINER_NAME=ci_arm_linux
+export CONTAINER_NAME=ci_aarch64_linux
 # Use debian to avoid 404 apt errors when cross compiling
 export CHECK_DOC=0
 export USE_BUSY_BOX=true
 export RUN_UNIT_TESTS=false
 export RUN_FUNCTIONAL_TESTS=false
 export GOAL="install"
-# -Wno-psabi is to disable ABI warnings: "note: parameter passing for argument of type ... changed in GCC 7.1"
-# This could be removed once the ABI change warning does not show up by default
-export BITCOIN_CONFIG="--enable-reduce-exports CXXFLAGS=-Wno-psabi"
+export BITCOIN_CONFIG="--enable-reduce-exports"
diff --git a/ci/test/00_setup_env_mac.sh b/ci/test/00_setup_env_mac.sh
@@ -8,9 +8,9 @@ export LC_ALL=C.UTF-8
 
 export CONTAINER_NAME=ci_macos_cross
 export HOST=x86_64-apple-darwin
-export PACKAGES="clang cmake lld llvm  zip"
-export XCODE_VERSION=15.0
-export XCODE_BUILD_ID=15A240d
+export PACKAGES="clang cmake lld llvm zip"
+export XCODE_VERSION=16.0
+export XCODE_BUILD_ID=16A242d
 export RUN_UNIT_TESTS=false
 export RUN_FUNCTIONAL_TESTS=false
 export GOAL="all deploy"
diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
@@ -19,8 +19,9 @@ RUN set -ex; \
     cmake \
     g++-11 \
     g++-14 \
-    g++-arm-linux-gnueabihf \
+    g++-aarch64-linux-gnu \
     g++-mingw-w64-x86-64 \
+    g++-x86-64-linux-gnu \
     gawk \
     gettext \
     libtool \
diff --git a/contrib/containers/deploy/Dockerfile.GitHubActions.Dispatch b/contrib/containers/deploy/Dockerfile.GitHubActions.Dispatch
@@ -9,7 +9,7 @@ RUN apt-get update && \
     build-essential \
     ca-certificates \
     curl \
-    g++-arm-linux-gnueabihf \
+    g++-aarch64-linux-gnu \
     libtool \
     pkg-config \
     python3 \
@@ -23,22 +23,22 @@ COPY . .
 ARG TARGETPLATFORM
 
 RUN case "$TARGETPLATFORM" in \
-  "linux/arm64") make HOST=arm-linux-gnueabihf -C depends -j`nproc | awk '{x=$1/2; print x}'` ;; \
+  "linux/arm64") make HOST=aarch64-linux-gnu -C depends -j`nproc | awk '{x=$1/2; print x}'` ;; \
   "linux/amd64") make HOST=x86_64-pc-linux-gnu -C depends -j`nproc | awk '{x=$1/2; print x}'` ;; \
   *) exit 1 ;; \
 esac
 
 RUN ./autogen.sh && \
   case "$TARGETPLATFORM" in \
-  "linux/arm64") ./configure --prefix=`pwd`/depends/arm-linux-gnueabihf ;; \
+  "linux/arm64") ./configure --prefix=`pwd`/depends/aarch64-linux-gnu ;; \
   "linux/amd64") ./configure --prefix=`pwd`/depends/x86_64-pc-linux-gnu ;; \
 esac
 
 RUN make -j`nproc | awk '{x=$1/2; print x}'` && make install
 
 RUN mkdir built-target && \
   case "$TARGETPLATFORM" in \
-  "linux/arm64") cp depends/arm-linux-gnueabihf/bin/dash* /home/dash/built-target ;; \
+  "linux/arm64") cp depends/aarch64-linux-gnu/bin/dash* /home/dash/built-target ;; \
   "linux/amd64") cp depends/x86_64-pc-linux-gnu/bin/dash* /home/dash/built-target ;; \
 esac
 
diff --git a/contrib/containers/guix/scripts/setup-sdk b/contrib/containers/guix/scripts/setup-sdk
@@ -7,12 +7,13 @@ export LC_ALL=C.UTF-8
 
 set -eo pipefail
 
-SDK_URL="${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}"
+SDK_URL="${SDK_URL:-https://s3.us-west-2.amazonaws.com/dash-depends-sources}"
 SDK_PATH="${SDK_PATH:-depends/SDKs}"
 SDK_SOURCES="${SDK_SOURCES:-depends/sdk-sources}"
-XCODE_VERSION="${XCODE_VERSION:-15.0}"
-XCODE_RELEASE="${XCODE_RELEASE:-15A240d}"
+XCODE_VERSION="${XCODE_VERSION:-16.0}"
+XCODE_RELEASE="${XCODE_RELEASE:-16A242d}"
 XCODE_ARCHIVE="Xcode-${XCODE_VERSION}-${XCODE_RELEASE}-extracted-SDK-with-libcxx-headers"
+XCODE_AR_HASH="${XCODE_AR_HASH:-bce59aa16560f182e44200a0b9539bd637c8b5c7089fbff13b0712730ce162ff}"
 XCODE_AR_PATH="${SDK_SOURCES}/${XCODE_ARCHIVE}.tar.gz"
 
 if [ ! -d "${SDK_PATH}/${XCODE_ARCHIVE}" ]; then
@@ -21,6 +22,11 @@ if [ ! -d "${SDK_PATH}/${XCODE_ARCHIVE}" ]; then
         mkdir -p "${SDK_SOURCES}"
         curl --location --fail "${SDK_URL}/${XCODE_ARCHIVE}.tar.gz" -o "${XCODE_AR_PATH}"
     fi
+    echo "Verifying macOS SDK..."
+    if [ "$(sha256sum "${XCODE_AR_PATH}" | cut -d' ' -f1)" != "${XCODE_AR_HASH}" ]; then
+        echo "ERROR: Checksum mismatch for ${XCODE_AR_PATH}"
+        exit 1
+    fi
     echo "Extracting macOS SDK..."
     mkdir -p "${SDK_PATH}"
     tar -C "${SDK_PATH}" -xf "${XCODE_AR_PATH}"
diff --git a/contrib/guix/README.md b/contrib/guix/README.md
@@ -249,7 +249,7 @@ details.
   Set the path where _extracted_ SDKs can be found. This is passed through to
   the depends tree. Note that this is should be set to the _parent_ directory of
   the actual SDK (e.g. `SDK_PATH=$HOME/Downloads/macOS-SDKs` instead of
-  `$HOME/Downloads/macOS-SDKs/Xcode-12.2-12B45b-extracted-SDK-with-libcxx-headers`).
+  `$HOME/Downloads/macOS-SDKs/Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers`).
 
   The path that this environment variable points to **must be a directory**, and
   **NOT a symlink to a directory**.
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
@@ -235,12 +235,12 @@ def check_MACHO_libraries(binary) -> bool:
     return ok
 
 def check_MACHO_min_os(binary) -> bool:
-    if binary.build_version.minos == [14,0,0]:
+    if binary.build_version.minos == [14, 0, 0]:
         return True
     return False
 
 def check_MACHO_sdk(binary) -> bool:
-    if binary.build_version.sdk == [14, 0, 0]:
+    if binary.build_version.sdk == [15, 0, 0]:
         return True
     return False
 
diff --git a/contrib/macdeploy/README.md b/contrib/macdeploy/README.md
@@ -15,14 +15,14 @@ When complete, it will have produced `Dash-Core.zip`.
 A free Apple Developer Account is required to proceed.
 
 Our macOS SDK can be extracted from
-[Xcode_15.xip](https://download.developer.apple.com/Developer_Tools/Xcode_15/Xcode_15.xip).
+[Xcode_16.xip](https://download.developer.apple.com/Developer_Tools/Xcode_16/Xcode_16.xip).
 
 Alternatively, after logging in to your account go to 'Downloads', then 'More'
-and search for [`Xcode 15`](https://developer.apple.com/download/all/?q=Xcode%2015).
+and search for [`Xcode 16`](https://developer.apple.com/download/all/?q=Xcode%2016).
 
 An Apple ID and cookies enabled for the hostname are needed to download this.
 
-The `sha256sum` of the downloaded XIP archive should be `4daaed2ef2253c9661779fa40bfff50655dc7ec45801aba5a39653e7bcdde48e`.
+The `sha256sum` of the downloaded XIP archive should be `4a26c3d102a55c7222fb145e0ee1503249c9c26c6e02dc64d783c8810b37b1e3`.
 
 To extract the `.xip` on Linux:
 
@@ -33,13 +33,13 @@ git clone https://github.com/bitcoin-core/apple-sdk-tools.git
 
 # Unpack the .xip and place the resulting Xcode.app in your current
 # working directory
-python3 apple-sdk-tools/extract_xcode.py -f Xcode_15.xip | cpio -d -i
+python3 apple-sdk-tools/extract_xcode.py -f Xcode_16.xip | cpio -d -i
 ```
 
 On macOS:
 
 ```bash
-xip -x Xcode_15.xip
+xip -x Xcode_16.xip
 ```
 
 ### Step 2: Generating the SDK tarball from `Xcode.app`
@@ -51,8 +51,8 @@ path to `Xcode.app` (extracted in the previous stage) as the first argument.
 ./contrib/macdeploy/gen-sdk '/path/to/Xcode.app'
 ```
 
-The generated archive should be: `Xcode-15.0-15A240d-extracted-SDK-with-libcxx-headers.tar.gz`.
-The `sha256sum` should be `c0c2e7bb92c1fee0c4e9f3a485e4530786732d6c6dd9e9f418c282aa6892f55d`.
+The generated archive should be: `Xcode-16.0-16A242d-extracted-SDK-with-libcxx-headers.tar.gz`.
+The `sha256sum` should be `bce59aa16560f182e44200a0b9539bd637c8b5c7089fbff13b0712730ce162ff`.
 
 ## Deterministic macOS App Notes
 
diff --git a/depends/hosts/darwin.mk b/depends/hosts/darwin.mk
@@ -1,7 +1,7 @@
 OSX_MIN_VERSION=14.0
-OSX_SDK_VERSION=14.0
-XCODE_VERSION=15.0
-XCODE_BUILD_ID=15A240d
+OSX_SDK_VERSION=15.0
+XCODE_VERSION=16.0
+XCODE_BUILD_ID=16A242d
 LLD_VERSION=711
 
 OSX_SDK=$(SDK_PATH)/Xcode-$(XCODE_VERSION)-$(XCODE_BUILD_ID)-extracted-SDK-with-libcxx-headers
@@ -13,8 +13,10 @@ OSX_SDK=$(SDK_PATH)/Xcode-$(XCODE_VERSION)-$(XCODE_BUILD_ID)-extracted-SDK-with-
 # distro releases.
 #
 # Source: https://lists.gnu.org/archive/html/bug-make/2017-11/msg00017.html
-clang_prog=$(shell $(SHELL) $(.SHELLFLAGS) "command -v clang")
-clangxx_prog=$(shell $(SHELL) $(.SHELLFLAGS) "command -v clang++")
+clang_prog:=$(shell $(SHELL) $(.SHELLFLAGS) "command -v clang")
+clangxx_prog:=$(shell $(SHELL) $(.SHELLFLAGS) "command -v clang++")
+
+clang_resource_dir:=$(shell $(SHELL) $(.SHELLFLAGS) "$(clang_prog) -print-resource-dir")
 
 darwin_AR=$(shell $(SHELL) $(.SHELLFLAGS) "command -v llvm-ar")
 darwin_DSYMUTIL=$(shell $(SHELL) $(.SHELLFLAGS) "command -v dsymutil")
@@ -51,13 +53,15 @@ darwin_STRIP=$(shell $(SHELL) $(.SHELLFLAGS) "command -v llvm-strip")
 #         Disable adhoc codesigning (for now) when using LLVM tooling, to avoid
 #         non-determinism issues with the Identifier field.
 
-darwin_CC=$(clang_prog) --target=$(host) \
-              -isysroot$(OSX_SDK) -nostdlibinc \
+darwin_CC=env -u C_INCLUDE_PATH -u CPLUS_INCLUDE_PATH $(clang_prog) --target=$(host) \
+              -isysroot$(OSX_SDK) -nostdinc \
+              -isystem$(clang_resource_dir)/include \
               -iwithsysroot/usr/include -iframeworkwithsysroot/System/Library/Frameworks
 
-darwin_CXX=$(clangxx_prog) --target=$(host) \
-               -isysroot$(OSX_SDK) -nostdlibinc \
+darwin_CXX=env -u C_INCLUDE_PATH -u CPLUS_INCLUDE_PATH $(clangxx_prog) --target=$(host) \
+               -isysroot$(OSX_SDK) -nostdinc -nostdinc++ \
                -iwithsysroot/usr/include/c++/v1 \
+               -isystem$(clang_resource_dir)/include \
                -iwithsysroot/usr/include -iframeworkwithsysroot/System/Library/Frameworks
 
 darwin_CFLAGS=-pipe -std=$(C_STANDARD) -mmacos-version-min=$(OSX_MIN_VERSION)
