I'm trying to update xcodegen in nixpkgs. the update bot was able to get the new version and hash, but the package isn't available on linux so it didn't get farther than that. Locally I get the same hash that the update bot, but when trying to build it, I get into the swift build, and then it errors like this:

xcodegen> Fetching https://github.com/yonaskolb/JSONUtilities.git
xcodegen> Fetching https://github.com/jakeheis/SwiftCLI.git
xcodegen> Fetching https://github.com/kylef/Spectre.git
xcodegen> Fetching https://github.com/tadija/AEXML.git
xcodegen> Fetching https://github.com/kylef/PathKit.git
xcodegen> Fetching https://github.com/onevcat/Rainbow.git
xcodegen> Fetching https://github.com/mxcl/Version
xcodegen> Fetching https://github.com/tuist/XcodeProj.git
xcodegen> Fetching https://github.com/jpsim/Yams.git
xcodegen> Fetching https://github.com/freddi-kit/ArtifactBundleGen
xcodegen> Fetching https://github.com/kylef/Spectre.git
xcodegen> Fetching https://github.com/onevcat/Rainbow.git
xcodegen> Fetching https://github.com/yonaskolb/JSONUtilities.git
xcodegen> Fetching https://github.com/mxcl/Version
xcodegen> Fetching https://github.com/tuist/XcodeProj.git
xcodegen> Fetching https://github.com/kylef/PathKit.git
xcodegen> Fetching https://github.com/jpsim/Yams.git
xcodegen> Fetching https://github.com/jakeheis/SwiftCLI.git
xcodegen> Fetching https://github.com/freddi-kit/ArtifactBundleGen
xcodegen> error: Failed to clone repository https://github.com/yonaskolb/JSONUtilities.git:
xcodegen>     Cloning into bare repository '/nix/var/nix/builds/nix-46814-58828094/source/.build/repositories/JSONUtilities-1696c737'...
xcodegen>     fatal: unable to access 'https://github.com/yonaskolb/JSONUtilities.git/': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

It's not consistent which dependency generates this error, and I get it on two separate machines. AFAIK we haven't changed the nixpkgs Swift packaging recently, nor have I updates these machines, but this smells like a darwin-specific problem to me. Has anyone experienced anything like this before?

or wanna try applying this diff to nixpkgs and then trying nix-build -A xcodgen?

Commit ID: 74e6051a426fecd38ec62c07967c3b81fc4bf0cc
Change ID: yzzplknuuvrllxzqqomzwywmrmopzpky
Author   : Sam <30577766+Samasaur1@users.noreply.github.com> (2026-03-13 19:42:16)
Committer: Sam <30577766+Samasaur1@users.noreply.github.com> (2026-03-13 19:44:31)

    (no description set)

diff --git a/pkgs/by-name/xc/xcodegen/package.nix b/pkgs/by-name/xc/xcodegen/package.nix
index dff37b0ff8..ca4171d92b 100644
--- a/pkgs/by-name/xc/xcodegen/package.nix
+++ b/pkgs/by-name/xc/xcodegen/package.nix
@@ -16,13 +16,13 @@
 
 swiftPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "xcodegen";
-  version = "2.44.1";
+  version = "2.45.3";
 
   src = fetchFromGitHub {
     owner = "yonaskolb";
     repo = "XcodeGen";
     tag = finalAttrs.version;
-    hash = "sha256-RQlmQfmrLZRrgIA09fE84JuqmYkkrz4KSw2dvYXw0Rs=";
+    hash = "sha256-ExuzmiH4d07rSXr3ygqF3sfJP8NMOTlfEmEYwmH3FVY=";
   };
 
   # Including SwiftPM as a nativeBuildInput provides a buildPhase for you.

I reproduced it on my machine (aarch64-darwin)

       > Did not find version 2021.01 in the output of the command /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --version
       >
       > Did not find version 2021.01 in the output of the command /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --help
       >
       For full logs, run:
         nix log /nix/store/qdyhkilahqf4ks8h0799f3jwyjagjdnb-openscad-2021.01.drv

for whatever reason it seems openscad --version is writing to stderr instead of stdout. I don't know the internals of versionCheckHook, but I suspect it wants the output in stderr

❯ /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --version > stdout 2> stderr
❯ cat stdout
❯ cat stderr
OpenSCAD version 2021.01

I observed the same with ...openscad --help, although this flag does not output the version

I reproduced it on my machine (aarch64-darwin)

       > Did not find version 2021.01 in the output of the command /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --version
       >
       > Did not find version 2021.01 in the output of the command /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --help
       >
       For full logs, run:
         nix log /nix/store/qdyhkilahqf4ks8h0799f3jwyjagjdnb-openscad-2021.01.drv

for whatever reason it seems openscad --version is writing to stderr instead of stdout. I don't know the internals of versionCheckHook, but I suspect it wants the output in stdout

❯ /nix/store/vamzzqsav4nnyakgcq15v4z5gpqnvmw4-openscad-2021.01/bin/openscad --version > stdout 2> stderr
❯ cat stdout
❯ cat stderr
OpenSCAD version 2021.01

I observed the same with ...openscad --help, although this flag does not output the version

i get same behavior on my machine, weird.

       > Fetching https://github.com/kylef/PathKit.git
       > Fetching https://github.com/kylef/Spectre.git
       > Fetching https://github.com/onevcat/Rainbow.git
       > Fetching https://github.com/mxcl/Version
       > error: Failed to clone repository https://github.com/onevcat/Rainbow.git:
       >     Cloning into bare repository '/nix/var/nix/builds/nix-13475-1657500268/source/.build/repositories/Rainbow-64aa5363'...
       >     fatal: unable to access 'https://github.com/onevcat/Rainbow.git/': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
       For full logs, run:
         nix log /nix/store/bqpd1d51vvg0g5nbj6ddj52plx5m1zfn-xcodegen-2.45.3.drv

versionCheckHook is supposed to check both streams (note the 2>&1)

versionOutput="$(@envCommand@ \
    --chdir=/ \
    --argv0="$(basename "${command[0]}")" \
    "${envArgs[@]}" \
    "${command[@]}" 2>&1 \
    | sed -e 's|@storeDir@/[^/ ]*/|{{storeDir}}/|g' \
    || true)"