From 7b596a54ccc5e4eb612cbbf0db0ee3a783a0715f Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:46:51 +0200 Subject: [PATCH 01/11] bitwarden-desktop: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit 9e2a7c6780974c1084e6cb9faee81cb68a7ca682) --- pkgs/by-name/bi/bitwarden-desktop/package.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix index dec25773ddc9..1d8189ec5892 100644 --- a/pkgs/by-name/bi/bitwarden-desktop/package.nix +++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix @@ -101,9 +101,6 @@ buildNpmPackage' rec { env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; - # make electron-builder not attempt to codesign the app on darwin - env.CSC_IDENTITY_AUTO_DISCOVERY = "false"; - nativeBuildInputs = [ cargo dart-sass From 753be3371f11f481fd7d01e44a9a74184f8f8561 Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:47:14 +0200 Subject: [PATCH 02/11] drawio: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit dd7d6f1134602bde2ade04b818ce6f45c8136c21) --- pkgs/by-name/dr/drawio/package.nix | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix index f93da550e2cd..a494d80edfeb 100644 --- a/pkgs/by-name/dr/drawio/package.nix +++ b/pkgs/by-name/dr/drawio/package.nix @@ -64,19 +64,18 @@ stdenv.mkDerivation (finalAttrs: { buildPhase = '' runHook preBuild - '' - + lib.optionalString stdenv.hostPlatform.isDarwin '' - cp -R ${electron.dist}/Electron.app Electron.app - chmod -R u+w Electron.app - export CSC_IDENTITY_AUTO_DISCOVERY=false + electron_dist="$(mktemp -d)" + cp -r ${electron.dist}/. "$electron_dist" + chmod -R u+w "$electron_dist" + sed -i "/afterSign/d" electron-builder-linux-mac.json - '' - + '' + npm exec electron-builder -- \ --dir \ - ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json --config.mac.identity=null"} \ - -c.electronDist=${if stdenv.hostPlatform.isDarwin then "." else electron.dist} \ - -c.electronVersion=${electron.version} + --config electron-builder-linux-mac.json \ + -c.electronDist="$electron_dist" \ + -c.electronVersion=${electron.version} \ + -c.mac.identity=null runHook postBuild ''; From 809081a90804aa2c9db2ef5e8c4c4cbd64ad6a1e Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:47:25 +0200 Subject: [PATCH 03/11] gridtracker2: remove usage of CSC_IDENTITY_AUTO_DISCOVERY, refactor (cherry picked from commit 74fa738dc84877048189274a466f3780061634b0) --- pkgs/by-name/gr/gridtracker2/package.nix | 28 +++++++++--------------- 1 file changed, 10 insertions(+), 18 deletions(-) diff --git a/pkgs/by-name/gr/gridtracker2/package.nix b/pkgs/by-name/gr/gridtracker2/package.nix index aba9890cff20..338ec428b897 100644 --- a/pkgs/by-name/gr/gridtracker2/package.nix +++ b/pkgs/by-name/gr/gridtracker2/package.nix @@ -50,28 +50,20 @@ buildNpmPackage (finalAttrs: { buildPhase = '' runHook preBuild - '' - + lib.optionalString stdenv.hostPlatform.isDarwin '' - # electronDist needs to be modifiable on Darwin - cp -r ${electron.dist} electron-dist - chmod -R u+w electron-dist - # Disable code signing during build on macOS. - # https://github.com/electron-userland/electron-builder/blob/fa6fc16/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos - export CSC_IDENTITY_AUTO_DISCOVERY=false + # the electronDist directory needs to be outside of the working directory + # otherwise the electron-builder config accidentally includes it inside the .asar file + electron_dist="$(mktemp -d)" + cp -r ${electron.dist}/. "$electron_dist" + chmod -R u+w "$electron_dist" npm exec electron-builder -- \ --dir \ - -c.electronDist=electron-dist \ - -c.electronVersion=${electron.version} - '' - + lib.optionalString stdenv.hostPlatform.isLinux '' - npm exec electron-builder -- \ - --dir \ - -c.electronDist=${electron.dist} \ - -c.electronVersion=${electron.version} - '' - + '' + -c.electronDist="$electron_dist" \ + -c.electronVersion=${electron.version} \ + -c.mac.identity=null + # ^ disable codesigning on Darwin + runHook postBuild ''; From 5662b5742936a680ea1c8ed1193286639e1b8d71 Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:47:43 +0200 Subject: [PATCH 04/11] kando: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit eac6f84bdc31200d76282bdcfe8c04e91c01c2d8) --- pkgs/by-name/ka/kando/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/by-name/ka/kando/package.nix b/pkgs/by-name/ka/kando/package.nix index 9ac58eaeaeb1..e9530e9f599c 100644 --- a/pkgs/by-name/ka/kando/package.nix +++ b/pkgs/by-name/ka/kando/package.nix @@ -69,8 +69,6 @@ buildNpmPackage.override { inherit nodejs; } rec { ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; # use our own node headers since we skip downloading them NIX_CFLAGS_COMPILE = "-I${nodejs}/include/node"; - # disable code signing on Darwin - CSC_IDENTITY_AUTO_DISCOVERY = lib.optionalString stdenv.hostPlatform.isDarwin "false"; }; postConfigure = '' From 261edf05ff456d12c929c15c8fe0490dcbdb25fa Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:47:56 +0200 Subject: [PATCH 05/11] mqtt-explorer: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit 0d9c3cc57e8e9ac471f541c29cffba62865f37ea) --- pkgs/by-name/mq/mqtt-explorer/package.nix | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix index 1f09774684f6..8471ece5d4a7 100644 --- a/pkgs/by-name/mq/mqtt-explorer/package.nix +++ b/pkgs/by-name/mq/mqtt-explorer/package.nix @@ -56,12 +56,6 @@ stdenv.mkDerivation rec { env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; - # disable code signing on macos - # https://github.com/electron-userland/electron-builder/blob/77f977435c99247d5db395895618b150f5006e8f/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos - postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin '' - export CSC_IDENTITY_AUTO_DISCOVERY=false - ''; - configurePhase = '' runHook preConfigure @@ -100,7 +94,9 @@ stdenv.mkDerivation rec { yarn --offline run electron-builder --dir \ -c.electronDist="$electron_dist" \ - -c.electronVersion=${electron.version} + -c.electronVersion=${electron.version} \ + -c.mac.identity=null + # ^ disable code signing on macos runHook postBuild ''; From 2a67c06e169fc0e8f0cc769e3b4f1ace48909869 Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:48:06 +0200 Subject: [PATCH 06/11] opencode-desktop: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit cd3edd505edadee81a5e7cd69ddd8c6eb890fab5) --- pkgs/by-name/op/opencode-desktop/package.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/by-name/op/opencode-desktop/package.nix b/pkgs/by-name/op/opencode-desktop/package.nix index 2af9b61a87bb..87b15e49ed0d 100644 --- a/pkgs/by-name/op/opencode-desktop/package.nix +++ b/pkgs/by-name/op/opencode-desktop/package.nix @@ -54,12 +54,6 @@ stdenvNoCC.mkDerivation (finalAttrs: { OPENCODE_CHANNEL = "prod"; MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json"; OPENCODE_DISABLE_MODELS_FETCH = true; - } - # Disable code signing on macOS. Public build hosts don't have Apple Developer - # certificates, so electron-builder's `security find-identity` spawns produce - # EPERM inside the nix sandbox. - // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin { - CSC_IDENTITY_AUTO_DISCOVERY = "false"; }; postPatch = '' From 04579a34b0af1a873d749b20d180f666c2317de2 Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:48:13 +0200 Subject: [PATCH 07/11] signal-desktop: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit 524f9353a2fc45c4fe8d71510e0147370f0bde53) --- pkgs/by-name/si/signal-desktop/package.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix index d84055a39297..de8764171560 100644 --- a/pkgs/by-name/si/signal-desktop/package.nix +++ b/pkgs/by-name/si/signal-desktop/package.nix @@ -181,10 +181,6 @@ stdenv.mkDerivation (finalAttrs: { ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; SIGNAL_ENV = "production"; SOURCE_DATE_EPOCH = 1780508208; - } - // lib.optionalAttrs stdenv.hostPlatform.isDarwin { - # Disable code signing during local macOS builds. - CSC_IDENTITY_AUTO_DISCOVERY = "false"; }; preBuild = '' From a9fe2c892876175a36a98dc728f36119178fffed Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:48:24 +0200 Subject: [PATCH 08/11] super-productivity: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit 92c17ecc75c7bc3ee6f5a4b2b99033d5f2ec80b6) --- pkgs/by-name/su/super-productivity/package.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix index 9584cc17b9c7..77f6c9bd3525 100644 --- a/pkgs/by-name/su/super-productivity/package.nix +++ b/pkgs/by-name/su/super-productivity/package.nix @@ -78,7 +78,6 @@ buildNpmPackage rec { env = { ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; CHROMEDRIVER_SKIP_DOWNLOAD = "true"; - CSC_IDENTITY_AUTO_DISCOVERY = "false"; }; nativeBuildInputs = [ copyDesktopItems ]; From d037cb1c3560b08348909363a828585bbc988cd6 Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:48:36 +0200 Subject: [PATCH 09/11] teams-for-linux: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit 730875f9e64eab47ac2cc999eb0155c1c4255d8d) --- pkgs/by-name/te/teams-for-linux/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix index d6c919d4c068..6533308cff6b 100644 --- a/pkgs/by-name/te/teams-for-linux/package.nix +++ b/pkgs/by-name/te/teams-for-linux/package.nix @@ -37,11 +37,7 @@ buildNpmPackage rec { doInstallCheck = stdenv.hostPlatform.isLinux; - env = { - # disable code signing on Darwin - CSC_IDENTITY_AUTO_DISCOVERY = "false"; - ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; - }; + env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; makeCacheWritable = true; From e322fe3f240939fddcd9ddd08bf6f8882fe18ebf Mon Sep 17 00:00:00 2001 From: TomaSajt <62384384+TomaSajt@users.noreply.github.com> Date: Sun, 24 May 2026 15:48:43 +0200 Subject: [PATCH 10/11] voicevox: remove usage of CSC_IDENTITY_AUTO_DISCOVERY (cherry picked from commit f701f68ba0db315505da52c243e007922328de05) --- pkgs/by-name/vo/voicevox/package.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix index e40181d50996..49346e310642 100644 --- a/pkgs/by-name/vo/voicevox/package.nix +++ b/pkgs/by-name/vo/voicevox/package.nix @@ -86,9 +86,6 @@ stdenv.mkDerivation (finalAttrs: { env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; - # disable code signing on Darwin - env.CSC_IDENTITY_AUTO_DISCOVERY = "false"; - buildPhase = '' runHook preBuild @@ -106,7 +103,9 @@ stdenv.mkDerivation (finalAttrs: { --dir \ --config ./build/electronBuilderConfigLoader.cjs \ -c.electronDist=electron-dist \ - -c.electronVersion=${electron.version} + -c.electronVersion=${electron.version} \ + -c.mac.identity=null + # ^ disable codesigning on Darwin runHook postBuild ''; From 4315267b9d45e39b756c9b4596293e27145c65e2 Mon Sep 17 00:00:00 2001 From: Michael Hoang Date: Wed, 10 Jun 2026 14:40:35 +0200 Subject: [PATCH 11/11] bitwarden-desktop: don't sign builds on macOS Assisted-by: Claude Opus 4.8 via Claude Code (cherry picked from commit 35cc9d8c793ffce34dd9bd9e822d5ce8d0dc453b) --- pkgs/by-name/bi/bitwarden-desktop/package.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix index 1d8189ec5892..0fc2eb51bda4 100644 --- a/pkgs/by-name/bi/bitwarden-desktop/package.nix +++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix @@ -150,7 +150,8 @@ buildNpmPackage' rec { npm exec electron-builder -- \ --dir \ -c.electronDist=electron-dist \ - -c.electronVersion=${electron.version} + -c.electronVersion=${electron.version} \ + ${lib.optionalString stdenv.hostPlatform.isDarwin "-c.mac.identity=null"} popd '';