removeReferencesToVendoredSources: manually sign on aarch64-darwin

ipetkov · Oct 13, 2023 · 14d48cf · 14d48cf
1 parent 25c0d96
commit 14d48cf
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 2 deletions.
diff --git a/lib/setupHooks/removeReferencesToVendoredSources.nix b/lib/setupHooks/removeReferencesToVendoredSources.nix
@@ -1,10 +1,17 @@
-{ makeSetupHook
+{ darwin
+, lib
+, makeSetupHook
+, stdenv
 }:
 
+let
+  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
+in
 makeSetupHook
 {
   name = "removeReferencesToVendoredSourcesHook";
   substitutions = {
     storeDir = builtins.storeDir;
+    signingUtils = if darwinCodeSign then darwin.signingUtils else null;
   };
 } ./removeReferencesToVendoredSourcesHook.sh
diff --git a/lib/setupHooks/removeReferencesToVendoredSourcesHook.sh b/lib/setupHooks/removeReferencesToVendoredSourcesHook.sh
@@ -26,13 +26,23 @@ removeReferencesToVendoredSources() {
 
       echo -n '\)!@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee!g'
     )
+
+    # Sign modified binaries on aarch64-darwin
+    if [ -n "${signingUtils}" ]; then
+      signIfRequired "${installedFile}"
+    fi
   done < <(find "${installLocation}" -type f)
 }
 
 if [ -n "${doNotRemoveReferencesToVendorDir-}" ]; then
   echo "removeReferencesToVendoredSources disabled"
 elif [ -n "${cargoVendorDir-}" ]; then
-  fixupHooks+=(removeReferencesToVendoredSources)
+  signingUtils="@signingUtils@"
+  if [ -n "${signingUtils}" ]; then
+    source "${signingUtils}"
+  fi
+
+  postFixupHooks+=(removeReferencesToVendoredSources)
 else
   echo "cargoVendorDir not set, will not attempt to remove any references"
 fi