From 9e2a7c6780974c1084e6cb9faee81cb68a7ca682 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:46:51 +0200
Subject: [PATCH 01/10] bitwarden-desktop: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/bi/bitwarden-desktop/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 3dfd2513b7ee..5bbbbae658e8 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -95,9 +95,6 @@ buildNpmPackage rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # make electron-builder not attempt to codesign the app on darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   nativeBuildInputs = [
     cargo
     dart-sass

From dd7d6f1134602bde2ade04b818ce6f45c8136c21 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:47:14 +0200
Subject: [PATCH 02/10] drawio: remove usage of CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/dr/drawio/package.nix | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix
index f93da550e2cd..a494d80edfeb 100644
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -64,19 +64,18 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    cp -R ${electron.dist}/Electron.app Electron.app
-    chmod -R u+w Electron.app
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
+
     sed -i "/afterSign/d" electron-builder-linux-mac.json
-  ''
-  + ''
+
     npm exec electron-builder -- \
       --dir \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json --config.mac.identity=null"} \
-      -c.electronDist=${if stdenv.hostPlatform.isDarwin then "." else electron.dist} \
-      -c.electronVersion=${electron.version}
+      --config electron-builder-linux-mac.json \
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
 
     runHook postBuild
   '';

From 74fa738dc84877048189274a466f3780061634b0 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:47:25 +0200
Subject: [PATCH 03/10] gridtracker2: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY, refactor

---
 pkgs/by-name/gr/gridtracker2/package.nix | 28 +++++++++---------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/gr/gridtracker2/package.nix b/pkgs/by-name/gr/gridtracker2/package.nix
index aba9890cff20..338ec428b897 100644
--- a/pkgs/by-name/gr/gridtracker2/package.nix
+++ b/pkgs/by-name/gr/gridtracker2/package.nix
@@ -50,28 +50,20 @@ buildNpmPackage (finalAttrs: {
 
   buildPhase = ''
     runHook preBuild
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # electronDist needs to be modifiable on Darwin
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
 
-    # Disable code signing during build on macOS.
-    # https://github.com/electron-userland/electron-builder/blob/fa6fc16/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    # the electronDist directory needs to be outside of the working directory
+    # otherwise the electron-builder config accidentally includes it inside the .asar file
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    npm exec electron-builder -- \
-      --dir \
-      -c.electronDist=${electron.dist} \
-      -c.electronVersion=${electron.version}
-  ''
-  + ''
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable codesigning on Darwin
+
     runHook postBuild
   '';
 

From eac6f84bdc31200d76282bdcfe8c04e91c01c2d8 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:47:43 +0200
Subject: [PATCH 04/10] kando: remove usage of CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/ka/kando/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/ka/kando/package.nix b/pkgs/by-name/ka/kando/package.nix
index 86a4d4d372f8..d4963a5d5eeb 100644
--- a/pkgs/by-name/ka/kando/package.nix
+++ b/pkgs/by-name/ka/kando/package.nix
@@ -69,8 +69,6 @@ buildNpmPackage.override { inherit nodejs; } rec {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     # use our own node headers since we skip downloading them
     NIX_CFLAGS_COMPILE = "-I${nodejs}/include/node";
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = lib.optionalString stdenv.hostPlatform.isDarwin "false";
   };
 
   postConfigure = ''

From 0d9c3cc57e8e9ac471f541c29cffba62865f37ea Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:47:56 +0200
Subject: [PATCH 05/10] mqtt-explorer: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/mq/mqtt-explorer/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix
index 1f09774684f6..8471ece5d4a7 100644
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -56,12 +56,6 @@ stdenv.mkDerivation rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on macos
-  # https://github.com/electron-userland/electron-builder/blob/77f977435c99247d5db395895618b150f5006e8f/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-  postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
-  '';
-
   configurePhase = ''
     runHook preConfigure
 
@@ -100,7 +94,9 @@ stdenv.mkDerivation rec {
 
     yarn --offline run electron-builder --dir \
       -c.electronDist="$electron_dist" \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable code signing on macos
 
     runHook postBuild
   '';

From cd3edd505edadee81a5e7cd69ddd8c6eb890fab5 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:48:06 +0200
Subject: [PATCH 06/10] opencode-desktop: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/op/opencode-desktop/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/op/opencode-desktop/package.nix b/pkgs/by-name/op/opencode-desktop/package.nix
index 2af9b61a87bb..87b15e49ed0d 100644
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@@ -54,12 +54,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     OPENCODE_CHANNEL = "prod";
     MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
     OPENCODE_DISABLE_MODELS_FETCH = true;
-  }
-  # Disable code signing on macOS. Public build hosts don't have Apple Developer
-  # certificates, so electron-builder's `security find-identity` spawns produce
-  # EPERM inside the nix sandbox.
-  // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin {
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   postPatch = ''

From 524f9353a2fc45c4fe8d71510e0147370f0bde53 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:48:13 +0200
Subject: [PATCH 07/10] signal-desktop: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/si/signal-desktop/package.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index d84055a39297..de8764171560 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -181,10 +181,6 @@ stdenv.mkDerivation (finalAttrs: {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
     SOURCE_DATE_EPOCH = 1780508208;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Disable code signing during local macOS builds.
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   preBuild = ''

From 92c17ecc75c7bc3ee6f5a4b2b99033d5f2ec80b6 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:48:24 +0200
Subject: [PATCH 08/10] super-productivity: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/su/super-productivity/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 9584cc17b9c7..77f6c9bd3525 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -78,7 +78,6 @@ buildNpmPackage rec {
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     CHROMEDRIVER_SKIP_DOWNLOAD = "true";
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   nativeBuildInputs = [ copyDesktopItems ];

From 730875f9e64eab47ac2cc999eb0155c1c4255d8d Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:48:36 +0200
Subject: [PATCH 09/10] teams-for-linux: remove usage of
 CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/te/teams-for-linux/package.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index d6c919d4c068..6533308cff6b 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -37,11 +37,7 @@ buildNpmPackage rec {
 
   doInstallCheck = stdenv.hostPlatform.isLinux;
 
-  env = {
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
-    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-  };
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   makeCacheWritable = true;
 

From f701f68ba0db315505da52c243e007922328de05 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 24 May 2026 15:48:43 +0200
Subject: [PATCH 10/10] voicevox: remove usage of CSC_IDENTITY_AUTO_DISCOVERY

---
 pkgs/by-name/vo/voicevox/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index e40181d50996..49346e310642 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -86,9 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on Darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   buildPhase = ''
     runHook preBuild
 
@@ -106,7 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
       --dir \
       --config ./build/electronBuilderConfigLoader.cjs \
       -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable codesigning on Darwin
 
     runHook postBuild
   '';