It seems to me that the manual extraction of MacOSX10.*.sdk.tar.gz can be a source of fragility, confusion, and non-determinism.

Perhaps what we could do going forward is to have the unmodified Xcode .xip as the Gitian input, and perform the extraction inside the Gitian environment. This has the additional benefit of the .xip being trivially deterministic (and thus easy to compare) as long as people are downloading the same version.