nodejs: use sigtool's codesign in test-macos-app-sandbox

test-macos-app-sandbox uses the system-provided codesign binary
(/usr/bin/codesign) to apply entitlements to an app bundle. This fails
in the sandbox as /usr/bin/codesign is not accessible. Patch the test to
instead use the codesign binary from sigtool. The test was updated to
pass the executable path to codesign as sigtool can't handle the bundle
path.

pkgs/development/web/nodejs/nodejs.nix

@@ -28,6 +28,7 @@
   runtimeShell,
   gnupg,
   installShellFiles,
+  darwin,
 }:
 
 {
@@ -298,6 +299,11 @@ let
 
       inherit patches;
 
+      postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+        substituteInPlace test/parallel/test-macos-app-sandbox.js \
+          --subst-var-by codesign '${darwin.sigtool}/bin/codesign'
+      '';
+
       __darwinAllowLocalNetworking = true; # for tests
 
       doCheck = canExecute;
@@ -391,7 +397,7 @@ let
             ]
             ++ lib.optionals stdenv.buildPlatform.isDarwin [
               # Disable tests that don’t work under macOS sandbox.
-              "test-macos-app-sandbox"
+              # uv_os_setpriority returned EPERM (operation not permitted)
               "test-os"
               "test-os-process-priority"
 

pkgs/development/web/nodejs/use-nix-codesign.patch

@@ -0,0 +1,18 @@
+diff --git a/test/parallel/test-macos-app-sandbox.js b/test/parallel/test-macos-app-sandbox.js
+index 60ad67b3db..b6ac0dcef4 100644
+--- a/test/parallel/test-macos-app-sandbox.js
++++ b/test/parallel/test-macos-app-sandbox.js
+@@ -45,11 +45,11 @@ fs.copyFileSync(
+ 
+ // Sign the app bundle with sandbox entitlements:
+ assert.strictEqual(
+-  child_process.spawnSync('/usr/bin/codesign', [
++  child_process.spawnSync('@codesign@', [
+     '--entitlements', fixtures.path(
+       'macos-app-sandbox', 'node_sandboxed.entitlements'),
+     '--force', '-s', '-',
+-    appBundlePath,
++    appExecutablePath,
+   ]).status,
+   0);
+ 

pkgs/development/web/nodejs/v20.nix

@@ -42,6 +42,7 @@ buildNodejs {
     ./configure-armv6-vfpv2.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
+    ./use-nix-codesign.patch
 
     # TODO: remove when included in a release
     (fetchpatch2 {

pkgs/development/web/nodejs/v22.nix

@@ -59,6 +59,7 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
 
       # TODO: remove when included in a release
       (fetchpatch2 {

pkgs/development/web/nodejs/v24.nix

@@ -58,6 +58,7 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [