opencode: killed due to invalid signature (aarch64-darwin, macOS 27 Beta 4)

[sudoer777]

Nixpkgs version

• Unstable (26.11)

Describe the bug

OpenCode immediately gets killed when opened. .opencode-wrapped has an invalid signature, and macOS logs shows this as the reason. I suspect this only occurs on the recent beta versions of macOS because it builds/tests pass on hydra, whereas the tests fail when built locally (the binary crashes for the same reason), and the local build also has an invalid signature.

Steps to reproduce

Run:

codesign --verify --strict --verbose=4 /nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped

Result:

/nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped: invalid signature (code or signature have been modified)
In architecture: arm64

Kernel logs when running OpenCode:

CODE SIGNING: cs_invalid_page(0x10dbc8000): p=10015[.opencode-wrappe] final status 0x23020200, denying page sending SIGKILL
CODE SIGNING: process 10015[.opencode-wrappe]: rejecting invalid page at address 0x10dbc8000 from offset 0x82b4000 in file "/nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped" (cs_mtime:1.0 == mtime:1.0) (signed:1 validated:0 tainted:1 nx:1 wpmapped:0 dirty:0 depth:0)

Workaround:

sudo codesign --force --sign - /nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped

Expected behaviour

Should have a correct signature, and not get killed when run.

Screenshots

No response

Relevant log output

Additional context

I do not know if this issue revolves around Nixpkgs or something upstream. I do not see any current issues for OpenCode or Bun relating to this. I do know that upstream Bun has had signing issues in the past (anomalyco/opencode#15124), and there is another Bun AI tool that recently had similar problems (cline/cline#12042).

I tried running the official OpenCode binary downloaded from GitHub releases, and that one also has an invalid signature but was able to run after xattr -d com.apple.quarantine opencode.

System metadata

• system: "aarch64-darwin"
• host os: Darwin 27.0.0, macOS 27.0
• multi-user?: yes
• sandbox: no
  System type: aarch64-darwin
  Additional system types: x86_64-darwin
  Features: gc, signed-caches
  System configuration file: /etc/nix/nix.conf
  User configuration files: /Users/ethanreece/.config/nix/nix.conf:/Users/ethanreece/.nix-profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/ethanreece/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf
  Store directory: /nix/store
  State directory: /nix/var/nix
  Data directory: /nix/store/j2z3ik2pgycjsqflhjyrnzdkgcrk1vn4-lix-2.95.2/share`
• nixpkgs: /nix/store/p9br0y2kmil5j5k85jczva3kdqy6hmnj-source

Are you using nix-darwin?

Yes, I am using nix-darwin.

Notify maintainers

@delafthi @DuskyElf @graham33

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.
• I assert that I have read the automation/AI policy and that this issue report complies with it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[delafthi]

Thanks, for the report. This could be related to #549496. In that case the fix has been merged in #549498, could you maybe test with the recent version on master and report back if the issue persists?

[sudoer777]

Thanks, for the report. This could be related to #549496. In that case the fix has been merged in #549498, could you maybe test with the recent version on master and report back if the issue persists?

I tried a couple hours ago with nix run "github:NixOS/nixpkgs/master#opencode" and had the same problem.

[delafthi]

I opened an update PR (#550458) and added a final signing step. Could you check if that fixes the issue for you? Could you also check opencode-desktop just to make sure that works on macos27 as well.

[sudoer777]

Could you check if that fixes the issue for you?

Unfortunately the test still fails the same way

In case it's helpful, it fails here:

dist/assets/dz-DaQkHxRa.js                                  123.94 kB <E2><94><82> gzip:  21.61 kB <E2><94><82> map:    149.66 kB
dist/assets/asciidoc-Ve4PFQV2.js                            131.57 kB <E2><94><82> gzip:   9.36 kB <E2><94><82> map:    189.14 kB
dist/assets/mdx-Cmh6b_Ma.js                                 136.16 kB <E2><94><82> gzip:  23.62 kB <E2><94><82> map:    176.74 kB
dist/assets/objective-cpp-CLxacb5B.js                       172.02 kB <E2><94><82> gzip:  30.78 kB <E2><94><82> map:    218.56 kB
dist/assets/javascript-wDzz0qaB.js                          174.88 kB <E2><94><82> gzip:  16.64 kB <E2><94><82> map:    236.09 kB
dist/assets/tsx-COt5Ahok.js                                 175.58 kB <E2><94><82> gzip:  16.63 kB <E2><94><82> map:    236.76 kB
dist/assets/jsx-g9-lgVsj.js                                 177.83 kB <E2><94><82> gzip:  16.75 kB <E2><94><82> map:    239.01 kB
dist/assets/typescript-BPQ3VLAy.js                          181.13 kB <E2><94><82> gzip:  16.15 kB <E2><94><82> map:    244.43 kB
dist/assets/angular-ts-DtEQuh-b.js                          183.86 kB <E2><94><82> gzip:  16.73 kB <E2><94><82> map:    249.41 kB
dist/assets/vue-vine-BoDAl6tE.js                            190.10 kB <E2><94><82> gzip:  18.08 kB <E2><94><82> map:    255.17 kB
dist/assets/dialog-select-directory-v2-DYhQXPhc.js          258.48 kB <E2><94><82> gzip:  74.27 kB <E2><94><82> map:    804.71 kB
dist/assets/wolfram-lXgVvXCa.js                             262.44 kB <E2><94><82> gzip:  77.10 kB <E2><94><82> map:    279.68 kB
dist/assets/wasm-CG6Dc4jp.js                                622.38 kB <E2><94><82> gzip: 231.20 kB <E2><94><82> map:    622.93 kB
dist/assets/cpp-UfJy6YNI.js                                 626.12 kB <E2><94><82> gzip:  44.93 kB <E2><94><82> map:    816.15 kB
dist/assets/emacs-lisp-CXvaQtF9.js                          779.93 kB <E2><94><82> gzip: 196.58 kB <E2><94><82> map:    789.87 kB
dist/assets/ghostty-web-BprCwH4t.js                       1,381.53 kB <E2><94><82> gzip: 426.02 kB <E2><94><82> map:  1,527.16 kB
dist/assets/index-RNwfRk2J.js                             2,738.33 kB <E2><94><82> gzip: 813.23 kB <E2><94><82> map: 11,559.20 kB
<E2><9C><93> built in 12.37s
building opencode-darwin-arm64
Running smoke test: dist/opencode-darwin-arm64/bin/opencode --version
Smoke test failed for opencode-darwin-arm64: ShellError: Failed with exit code 137
 exitCode: 137,
   stdout: "",
   stderr: "",

      at ShellPromise (unknown:75:16)
      at BunShell (unknown:191:35)

[sudoer777]

I also tried moving the signing to postBuild like so, and it still failed:

{
  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
      installShellCompletion --cmd opencode \
        --bash <($out/bin/opencode completion) \
        --zsh <(SHELL=/bin/zsh $out/bin/opencode completion)
    '';

  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
    codesign --force --sign - $out/bin/opencode
  '';
}

I don't see any indication of it exiting the build stage before running whatever the "smoke test" is.

EDIT: It looks like it fails here, so maybe it's an upstream issue?: https://github.com/anomalyco/opencode/blob/0bff28de09105088ff5bdefab91413d55c28dff1/packages/opencode/script/build.ts#L207

[delafthi]

Ah yeah, I forgot the smoke test🙄. That is executed by the build script and fails since the binary isn't signed yet.

[delafthi]

@sudoer777 I've updated the PR to skip the smoke test. Could you test again?

[sudoer777]

@delafthi Change the codesign line to:

- codesign --force --sign - $out/bin/opencode
+ codesign --force --sign - $out/bin/.opencode-wrapped

Then it works.

[delafthi]

Ahh sure, my bad 🤦

[sudoer777]

As for OpenCode desktop, it builds now too, but I get the output:

[0810/094847.988053:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[0810/094847.988493:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094848.318616:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[0810/094848.375005:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094848.670382:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service.
[0810/094848.726450:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094849.014632:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[0810/094849.071724:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094849.363215:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service.
[0810/094849.418633:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094849.726927:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[0810/094849.782808:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094850.110934:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service.
[0810/094850.208344:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094850.564512:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[0810/094850.648120:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094850.944171:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service.
[0810/094851.002383:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094851.276575:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[0810/094851.332075:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094851.599356:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service.
[0810/094851.653460:FATAL:electron/shell/app/electron_main_delegate_mac.mm:66] Unable to find helper app
[38731:0810/094851.926596:ERROR:content/browser/gpu/gpu_process_host.cc:998] GPU process exited unexpectedly: exit_code=5
[38731:0810/094851.926619:FATAL:content/browser/gpu/gpu_data_manager_impl_private.cc:418] GPU process isn't usable. Goodbye.

But that seems like a different issue.

EDIT: Nvmd I had to run bash -c 'open /nix/store/84lkviihd9swa0kjv9cwv0j7lqh3whv1-opencode-desktop-1.18.16/Applications/OpenCode.app'