Uh oh!
There was an error while loading. Please reload this page.
fix(nix): re-inherit patches in desktop, ad-hoc sign .app on darwin - #27869
Merged
rekram1-node merged 8 commits intoMay 23, 2026
Merged
Conversation
Two regressions from anomalyco#16163: 1. The Tauri-era derivation inherited 'patches' from opencode; the Electron derivation dropped it. Flake consumers' overrideAttrs patches no longer reach the desktop build, even though packages/desktop/scripts/prepare.ts imports @opencode-ai/script and so depends on patches landed on packages/script/. 2. electron-builder is invoked with --config.mac.identity=null, which skips signing entirely (no ad-hoc fallback). macOS rejects unsigned binaries with code signature invalid. Re-sign ad-hoc in postFixup on darwin. Linux unaffected: postFixup is darwin-only; re-inheriting patches is a no-op when no patches are layered on opencode. Closesanomalyco#27868
Contributor
There was a problem hiding this comment.
Pull request overview
Restores patches inheritance and adds an ad-hoc codesign step on darwin to nix/desktop.nix, fixing two regressions introduced by the Tauri→Electron migration in #16163.
Changes:
- Re-inherit
patchesfromopencodeso consumer-layered patches reach the desktop build. - Add a darwin-only
postFixupthat ad-hoc signs the produced.appbundle, since--config.mac.identity=nullleaves it unsigned.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
gigamonster256
commented
May 16, 2026
Contributor
patches addition looks good, perhaps use darwin.autoSignDarwinBinariesHook instead of non-standard signing fixup |
…esign Per review feedback (gigamonster256): replace the ad-hoc `/usr/bin/codesign --force --deep --sign -` postFixup with the standard nixpkgs hook `darwin.autoSignDarwinBinariesHook`. The hook walks the output and ad-hoc signs every Mach-O via `codesign -f -s -` (through sigtool / signIfRequired), which is the established pattern for electron-builder source builds on darwin (see e.g. bitwarden-desktop). The bundle seal that `--deep` produces (Contents/_CodeSignature/ CodeResources) is not required here: Gatekeeper does not enforce it for ad-hoc signatures on binaries without the quarantine xattr, which is always the case under /nix/store.
ContributorAuthor
Thanks @gigamonster256 — pushed d158ba3 using |
6 tasks
rekram1-node
commented
May 23, 2026
Collaborator
/review |
Contributor
lgtm |
Uh oh!
There was an error while loading. Please reload this page.
AIALRA-0 pushed a commit
to AIALRA-0/opencode-turn-engine
that referenced
this pull request
Jun 10, 2026
AIALRA-0 pushed a commit
to AIALRA-0/opencode-turn-engine
that referenced
this pull request
Jun 10, 2026
avion23 pushed a commit
to avion23/opencode
that referenced
this pull request
Jun 10, 2026
isaacfinnegan pushed a commit
to isaacfinnegan/whispercode
that referenced
this pull request
Jun 15, 2026
MarsQiu007 referenced
this pull request
in MarsQiu007/openNovel
Jul 31, 2026
banlanzs pushed a commit
to banlanzs/opencode
that referenced
this pull request
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes#27868
Type of change
What does this PR do?
Two fixes to
nix/desktop.nixfor regressions from #16163:Re-add
patchestoinherit (opencode) .... Lost in the Tauri→Electron rewrite.packages/desktop/scripts/prepare.tsimports@opencode-ai/script, so consumers'overrideAttrspatches onpackages/script/need to reach the desktop build'spatchPhase.Ad-hoc sign the
.appon darwin viadarwin.autoSignDarwinBinariesHook. electron-builder's--config.mac.identity=nullproduces an unsigned bundle; macOS refuses to launch it. Same pattern asbitwarden-desktop. No-op on Linux.How did you verify your code works?
overrideAttrsonopencode-desktopin my home-manager config: builds and launches onaarch64-darwin(macOS 14, Apple Silicon).packages/script/viaoverrideAttrsand confirming the desktop derivation'spatchPhaseapplies it.Screenshots / recordings
N/A — build fix.
Checklist