stats: fix app bundle signing

pkgs/by-name/st/stats/package.nix

@@ -2,11 +2,11 @@
   lib,
   swiftPackages,
   fetchFromGitHub,
-  darwin,
   leveldb,
   perl,
   actool,
   makeWrapper,
+  rcodesign,
   nix-update-script,
 }:
 
@@ -80,8 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
     swift
     perl
     actool
-    darwin.autoSignDarwinBinariesHook
     makeWrapper
+    rcodesign
   ];
 
   buildInputs = [ leveldb ];
@@ -333,6 +333,12 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  postFixup = ''
+    # Stats is an app bundle with nested frameworks, so sign the bundle to
+    # generate sealed resources instead of signing only the Mach-O files
+    ${lib.getExe rcodesign} sign "$out/Applications/Stats.app"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {