_osx_support._default_sysroot is dead in CPython but used downstream with no public replacement

_osx_support._default_sysroot(cc) has no caller inside CPython, yet several downstream projects import it directly and there is no public replacement to send them to.

Lifecycle

• GH-23301 (bpo-41116) added it to locate the macOS 11 SDK sysroot when building extensions.
• Its only in-tree caller lived in distutils. GH-99061 (gh-92584) removed distutils, so nothing in CPython calls it now.

Downstream use

A GitHub code search finds live callers: pyston (setup.py), PyOxidizer (vendored distutils/unixccompiler.py), and the macports and fink Python patches. They call it to discover the SDK sysroot when compiling extensions.

No public replacement

sysconfig does not expose the SDK sysroot and distutils is gone, so a downstream user has nowhere supported to move. They would shell out to xcrun --show-sdk-path or copy the function body.

Question

For this private helper with live downstream use and no public equivalent, which way do we go:

1. Keep it as-is and document that it is unsupported.
2. Add a supported public equivalent first, then deprecate and remove.
3. Remove it now under the "private API carries no guarantee" rule and accept the breakage.

Start by inspecting _osx_support._default_sysroot(cc) and the downstream entry points named in the issue: pyston's setup.py, PyOxidizer's vendored distutils/unixccompiler.py, and the macports and fink patches. Determine whether a supported replacement, documentation, or removal path is appropriate; the work is done when the chosen policy and downstream migration path are clear.