_osx_support._default_sysroot is dead in CPython but used downstream with no public replacement

[gaborbernat]

_osx_support._default_sysroot(cc) has no caller inside CPython, yet several downstream projects import it directly and there is no public replacement to send them to.

Lifecycle

• bpo-41116: Ensure system supplied libraries are found on macOS 11 #23301 (bpo-41116) added it to locate the macOS 11 SDK sysroot when building extensions.
• Its only in-tree caller lived in distutils. gh-92584: Remove the distutils package #99061 (PEP 632: Remove the distutils package (Python 3.12) #92584) removed distutils, so nothing in CPython calls it now.

Downstream use

A GitHub code search finds live callers: pyston (setup.py), PyOxidizer (vendored distutils/unixccompiler.py), and the macports and fink Python patches. They call it to discover the SDK sysroot when compiling extensions.

No public replacement

sysconfig does not expose the SDK sysroot and distutils is gone, so a downstream user has nowhere supported to move. They would shell out to xcrun --show-sdk-path or copy the function body.

Question

For this private helper with live downstream use and no public equivalent, which way do we go:

1. Keep it as-is and document that it is unsupported.
2. Add a supported public equivalent first, then deprecate and remove.
3. Remove it now under the "private API carries no guarantee" rule and accept the breakage.

[ned-deily]

cc @python/macos-team