ensure MACOSX_SDK_VERSION is at least c_stdlib_version

conda_smithy/configure_feedstock.py

@@ -439,6 +439,8 @@ def _merge_deployment_target(container_of_dicts, has_macdt):
       For now, take the maximum to populate both.
     - In any case, populate MACOSX_DEPLOYMENT_TARGET, as that is the key picked
       up by https://github.com/conda-forge/conda-forge-ci-setup-feedstock
+    - If MACOSX_SDK_VERSION is lower than the merged value from the previous step,
+      update it to match the merged value.
     """
     result = []
     for var_dict in container_of_dicts:
@@ -452,17 +454,21 @@ def _merge_deployment_target(container_of_dicts, has_macdt):
         # case where we need to do processing
         v_stdlib = var_dict["c_stdlib_version"]
         macdt = var_dict.get("MACOSX_DEPLOYMENT_TARGET", v_stdlib)
+        sdk = var_dict.get("MACOSX_SDK_VERSION", v_stdlib)
         # error out if someone puts in a range of versions; we need a single version
         try:
-            cond_update = VersionOrder(v_stdlib) < VersionOrder(macdt)
+            stdlib_lt_macdt = VersionOrder(v_stdlib) < VersionOrder(macdt)
+            sdk_lt_stdlib = VersionOrder(sdk) < VersionOrder(v_stdlib)
+            sdk_lt_macdt = VersionOrder(sdk) < VersionOrder(macdt)
         except InvalidVersionSpec:
             raise ValueError(
-                "both and c_stdlib_version/MACOSX_DEPLOYMENT_TARGET need to be a "
-                "single version, not a version range!"
+                "all of c_stdlib_version/MACOSX_DEPLOYMENT_TARGET/"
+                "MACOSX_SDK_VERSION need to be a single version, "
+                "not a version range!"
             )
         if v_stdlib != macdt:
             # determine maximum version and use it to populate both
-            v_stdlib = macdt if cond_update else v_stdlib
+            v_stdlib = macdt if stdlib_lt_macdt else v_stdlib
             msg = (
                 "Conflicting specification for minimum macOS deployment target!\n"
                 "If your conda_build_config.yaml sets `MACOSX_DEPLOYMENT_TARGET`, "
@@ -474,6 +480,18 @@ def _merge_deployment_target(container_of_dicts, has_macdt):
             if has_macdt:
                 warn_once(msg)
 
+        if sdk_lt_stdlib or sdk_lt_macdt:
+            sdk_lt_merged = VersionOrder(sdk) < VersionOrder(v_stdlib)
+            sdk = v_stdlib if sdk_lt_merged else sdk
+            msg = (
+                "Conflicting specification for minimum macOS SDK version!\n"
+                "If your conda_build_config.yaml sets `MACOSX_SDK_VERSION`, "
+                "it must be larger or equal than `c_stdlib_version` "
+                "(which is also influenced by the global pinning)!\n"
+                f"Using {sdk}=max(c_stdlib_version, MACOSX_SDK_VERSION)."
+            )
+            warn_once(msg)
+
         # we set MACOSX_DEPLOYMENT_TARGET to match c_stdlib_version,
         # for ease of use in conda-forge-ci-setup;
         # use new dictionary to avoid mutating existing var_dict in place
@@ -482,6 +500,7 @@ def _merge_deployment_target(container_of_dicts, has_macdt):
                 **var_dict,
                 "c_stdlib_version": v_stdlib,
                 "MACOSX_DEPLOYMENT_TARGET": v_stdlib,
+                "MACOSX_SDK_VERSION": sdk,
             }
         )
         result.append(new_dict)

news/1928-fix-macos-sdk-merge.rst

@@ -0,0 +1,23 @@
+**Added:**
+
+* <news item>
+
+**Changed:**
+
+* <news item>
+
+**Deprecated:**
+
+* <news item>
+
+**Removed:**
+
+* <news item>
+
+**Fixed:**
+
+* Ensure MACOSX_SDK_VERSION does not end up lower than `c_stdlib_version` in variant configs (#1927 via #1928)
+
+**Security:**
+
+* <news item>

tests/conftest.py

@@ -253,6 +253,9 @@ def stdlib_deployment_target_recipe(config_yaml, stdlib_recipe):
 MACOSX_DEPLOYMENT_TARGET:       # [osx]
   - 10.14                       # [osx and x86_64]
   - 12.0                        # [osx and arm64]
+MACOSX_SDK_VERSION:             # [osx]
+  - 10.12                       # [osx and x86_64]
+  - 12.0                        # [osx and arm64]
 """
         )
     return RecipeConfigPair(

tests/test_configure_feedstock.py

@@ -271,6 +271,8 @@ def test_stdlib_deployment_target(
     assert re.match(
         r"(?s).*MACOSX_DEPLOYMENT_TARGET:\s*- ['\"]?10\.14", content
     )
+    # MACOSX_SDK_VERSION gets updated as well if it's below the other two
+    assert re.match(r"(?s).*MACOSX_SDK_VERSION:\s*- ['\"]?10\.14", content)
 
 
 def test_upload_on_branch_azure(upload_on_branch_recipe, jinja_env):