scripts: check macOS SDK version is set

Clangs Darwin driver should infer the SDK version used during compilation, and
forward that through to the linker. Add a check that this has been done, and the
expected SDK version is set.

Should help prevent issues like #21771 in future.

contrib/devtools/symbol-check.py

@@ -218,6 +218,12 @@ def check_MACHO_min_os(filename) -> bool:
         return True
     return False
 
+def check_MACHO_sdk(filename) -> bool:
+    binary = lief.parse(filename)
+    if binary.build_version.sdk == [10, 15, 6]:
+        return True
+    return False
+
 def check_PE_libraries(filename) -> bool:
     ok: bool = True
     binary = lief.parse(filename)
@@ -244,6 +250,7 @@ CHECKS = {
 'MACHO': [
     ('DYNAMIC_LIBRARIES', check_MACHO_libraries),
     ('MIN_OS', check_MACHO_min_os),
+    ('SDK', check_MACHO_sdk),
 ],
 'PE' : [
     ('DYNAMIC_LIBRARIES', check_PE_libraries),

contrib/devtools/test-symbol-check.py

@@ -98,7 +98,7 @@ class TestSymbolChecks(unittest.TestCase):
 
         self.assertEqual(call_symbol_check(cc, source, executable, ['-lexpat']),
             (1, 'libexpat.1.dylib is not in ALLOWED_LIBRARIES!\n' +
-                executable + ': failed DYNAMIC_LIBRARIES MIN_OS'))
+                f'{executable}: failed DYNAMIC_LIBRARIES MIN_OS SDK'))
 
         source = 'test2.c'
         executable = 'test2'
@@ -114,7 +114,7 @@ class TestSymbolChecks(unittest.TestCase):
         ''')
 
         self.assertEqual(call_symbol_check(cc, source, executable, ['-framework', 'CoreGraphics']),
-                (1, executable + ': failed MIN_OS'))
+                (1, f'{executable}: failed MIN_OS SDK'))
 
         source = 'test3.c'
         executable = 'test3'
@@ -127,7 +127,7 @@ class TestSymbolChecks(unittest.TestCase):
         ''')
 
         self.assertEqual(call_symbol_check(cc, source, executable, ['-mmacosx-version-min=10.14']),
-                (0, ''))
+                (1, f'{executable}: failed SDK'))
 
     def test_PE(self):
         source = 'test1.c'