fix(nix): re-inherit patches in desktop, ad-hoc sign .app on darwin#27869
Open
jerome-benoit wants to merge 7 commits into
Open
fix(nix): re-inherit patches in desktop, ad-hoc sign .app on darwin#27869jerome-benoit wants to merge 7 commits into
jerome-benoit wants to merge 7 commits into
Conversation
Two regressions from anomalyco#16163: 1. The Tauri-era derivation inherited 'patches' from opencode; the Electron derivation dropped it. Flake consumers' overrideAttrs patches no longer reach the desktop build, even though packages/desktop/scripts/prepare.ts imports @opencode-ai/script and so depends on patches landed on packages/script/. 2. electron-builder is invoked with --config.mac.identity=null, which skips signing entirely (no ad-hoc fallback). macOS rejects unsigned binaries with code signature invalid. Re-sign ad-hoc in postFixup on darwin. Linux unaffected: postFixup is darwin-only; re-inheriting patches is a no-op when no patches are layered on opencode. Closes anomalyco#27868
Contributor
There was a problem hiding this comment.
Pull request overview
Restores patches inheritance and adds an ad-hoc codesign step on darwin to nix/desktop.nix, fixing two regressions introduced by the Tauri→Electron migration in #16163.
Changes:
- Re-inherit
patchesfromopencodeso consumer-layered patches reach the desktop build. - Add a darwin-only
postFixupthat ad-hoc signs the produced.appbundle, since--config.mac.identity=nullleaves it unsigned.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
patches addition looks good, perhaps use darwin.autoSignDarwinBinariesHook instead of non-standard signing fixup |
…esign Per review feedback (gigamonster256): replace the ad-hoc `/usr/bin/codesign --force --deep --sign -` postFixup with the standard nixpkgs hook `darwin.autoSignDarwinBinariesHook`. The hook walks the output and ad-hoc signs every Mach-O via `codesign -f -s -` (through sigtool / signIfRequired), which is the established pattern for electron-builder source builds on darwin (see e.g. bitwarden-desktop). The bundle seal that `--deep` produces (Contents/_CodeSignature/ CodeResources) is not required here: Gatekeeper does not enforce it for ad-hoc signatures on binaries without the quarantine xattr, which is always the case under /nix/store.
Contributor
Author
|
Thanks @gigamonster256 — pushed d158ba3 using |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #27868
Type of change
What does this PR do?
Two fixes to
nix/desktop.nixfor regressions from #16163:Re-add
patchestoinherit (opencode) .... Lost in the Tauri→Electron rewrite.packages/desktop/scripts/prepare.tsimports@opencode-ai/script, so consumers'overrideAttrspatches onpackages/script/need to reach the desktop build'spatchPhase.Ad-hoc sign the
.appon darwin viadarwin.autoSignDarwinBinariesHook. electron-builder's--config.mac.identity=nullproduces an unsigned bundle; macOS refuses to launch it. Same pattern asbitwarden-desktop. No-op on Linux.How did you verify your code works?
overrideAttrsonopencode-desktopin my home-manager config: builds and launches onaarch64-darwin(macOS 14, Apple Silicon).packages/script/viaoverrideAttrsand confirming the desktop derivation'spatchPhaseapplies it.Screenshots / recordings
N/A — build fix.
Checklist