Use codesign to sign patched binaries on Intel

[MikeMcQuaid]

• Since the switch to MachO.codesign! in ruby-macho 6.0, Intel macOS rejects the ad-hoc signatures on larger relocated binaries (e.g. libruby, the Python framework) and kills hardened-runtime programs such as MacVim's vim at launch with CODESIGNING, Invalid Page: ruby-macho 6.0 re-signs relocated x86_64 binaries with signatures macOS rejects (kills hardened-runtime apps) #23418
• The signatures have correct page hashes and pass codesign --verify on newer macOS, so this looks like an Intel macOS verifier quirk rather than simple corruption.
• Restore the pre-6.0 behaviour on Intel: leave unsigned binaries unsigned and use codesign to re-sign only the binaries whose existing signature our modifications have just broken, e.g. MacVim's Xcode-ad-hoc-signed hardened-runtime vim.
• Restore the fatal preinstall developer tools check, now skipped on Apple Silicon rather than gated to it, as codesign requires the Command Line Tools while ruby-macho does not.
• Keep MachO.codesign! on Apple Silicon, where it is required, proven and avoids a codesign subprocess per relocated file.

Fixes #23418

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Fable 5 max with local review and testing.

---

[Copilot]

Pull request overview

This PR adjusts macOS bottle relocation code signing to avoid Intel macOS rejecting ruby-macho ad-hoc signatures on some larger binaries, while retaining ruby-macho signing on Apple Silicon where it’s required.

Changes:

• Update Keg#codesign_patched_binary on macOS to use /usr/bin/codesign to re-sign only binaries whose existing signature is detected as broken on Intel, while continuing to use MachO.codesign! on Apple Silicon.
• Reinstate the fatal preinstall developer tools check on Intel macOS (needed for codesign), while skipping it on Apple Silicon.
• Add/update macOS-specific specs covering the new Intel vs Apple Silicon behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
Library/Homebrew/extend/os/mac/keg.rb	Implements Intel-specific codesign verify/re-sign flow and keeps ruby-macho signing on Apple Silicon.
Library/Homebrew/extend/os/mac/diagnostic.rb	Makes developer tools a fatal preinstall requirement on Intel (for codesign).
Library/Homebrew/test/os/mac/keg_spec.rb	Updates/adds specs for Intel vs Apple Silicon signing behavior.
Library/Homebrew/test/os/mac/diagnostic_spec.rb	Adds spec coverage for Intel requiring developer tools in fatal preinstall checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.