From a1fcfb6d83b30d987bd727013def82cdf9f27976 Mon Sep 17 00:00:00 2001 From: Ihar Hrachyshka Date: Sat, 12 Jul 2025 14:04:09 -0400 Subject: [PATCH] podman-desktop: force disable electron-builder signing on arm64 Even with CSC_IDENTITY_AUTO_DISCOVERY=false, latest builder attempts to sign if on arm64 unless identity is forcefully set to `null`. The problem that builder tries to solve with falling back to an ad-hoc signature doesn't affect us because we later sign binaries with our own hook. So it should be safe to disable builder's signature logic. --- pkgs/by-name/po/podman-desktop/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix index 409d40d90adf..7efcd298c5c7 100644 --- a/pkgs/by-name/po/podman-desktop/package.nix +++ b/pkgs/by-name/po/podman-desktop/package.nix @@ -70,10 +70,6 @@ stdenv.mkDerivation (finalAttrs: { ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; - # Don't attempt to sign the darwin app bundle. - # It's impure and may fail in some restricted environments. - CSC_IDENTITY_AUTO_DISCOVERY = lib.optionals stdenv.hostPlatform.isDarwin "false"; - nativeBuildInputs = [ nodejs @@ -94,9 +90,13 @@ stdenv.mkDerivation (finalAttrs: { chmod -R u+w electron-dist pnpm build + + # Explicitly set identity to null to avoid signing on arm64 macs with newer electron-builder. + # See: https://github.com/electron-userland/electron-builder/pull/9007 ./node_modules/.bin/electron-builder \ --dir \ --config .electron-builder.config.cjs \ + -c.mac.identity=null \ -c.electronDist=electron-dist \ -c.electronVersion=${electron.version}