cc-wrapper: Fortran: disable stackprotector hardening on darwin aarch64

pkgs/build-support/cc-wrapper/default.nix

@@ -245,12 +245,19 @@ stdenv.mkDerivation {
       wrap ${targetPrefix}gdc $wrapper $ccPath/${targetPrefix}gdc
     ''
 
-    + optionalString cc.langFortran or false ''
+    + optionalString cc.langFortran or false (''
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
       export named_fc=${targetPrefix}gfortran
     ''
+    # Darwin aarch64 fortran compilations seem to fail otherwise, see:
+    # https://github.com/NixOS/nixpkgs/issues/140041
+    + (if (stdenvNoCC.isDarwin && stdenvNoCC.isAarch64) then ''
+      export fortran_hardening="pic strictoverflow relro bindnow"
+    '' else ''
+      export fortran_hardening="pic strictoverflow relro bindnow stackprotector"
+    ''))
 
     + optionalString cc.langJava or false ''
       wrap ${targetPrefix}gcj $wrapper $ccPath/${targetPrefix}gcj

pkgs/build-support/cc-wrapper/fortran-hook.sh

@@ -5,7 +5,7 @@ export FC${role_post}=@named_fc@
 
 # If unset, assume the default hardening flags.
 # These are different for fortran.
-: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@fortran_hardening@"}
 export NIX_HARDENING_ENABLE
 
 unset -v role_post