From 8dd574b98ee3b15a80c9a22f84bfd31db93dc22f Mon Sep 17 00:00:00 2001
From: FlameFlag <git@ps1.sh>
Date: Mon, 8 Jun 2026 13:29:53 +0300
Subject: [PATCH] stats: fix app bundle signing

---
 pkgs/by-name/st/stats/package.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index ab288d597aed..0da129d80fcb 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -2,11 +2,11 @@
   lib,
   swiftPackages,
   fetchFromGitHub,
-  darwin,
   leveldb,
   perl,
   actool,
   makeWrapper,
+  rcodesign,
   nix-update-script,
 }:
 
@@ -80,8 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
     swift
     perl
     actool
-    darwin.autoSignDarwinBinariesHook
     makeWrapper
+    rcodesign
   ];
 
   buildInputs = [ leveldb ];
@@ -333,6 +333,12 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  postFixup = ''
+    # Stats is an app bundle with nested frameworks, so sign the bundle to
+    # generate sealed resources instead of signing only the Mach-O files
+    ${lib.getExe rcodesign} sign "$out/Applications/Stats.app"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {