opencode: killed due to invalid signature (aarch64-darwin, macOS 27 Beta 4)

### Nixpkgs version - Unstable (26.11) ### Describe the bug OpenCode immediately gets killed when opened. `.opencode-wrapped` has an invalid signature, and macOS logs shows this as the reason. I suspect this only occurs on the recent beta versions of macOS because it builds/tests pass on hydra, whereas the tests fail when built locally (the binary crashes for the same reason), and the local build also has an invalid signature. ### Steps to reproduce Run: ```bash codesign --verify --strict --verbose=4 /nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped ``` Result: ``` /nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped: invalid signature (code or signature have been modified) In architecture: arm64 ``` Kernel logs when running OpenCode: ``` CODE SIGNING: cs_invalid_page(0x10dbc8000): p=10015[.opencode-wrappe] final status 0x23020200, denying page sending SIGKILL CODE SIGNING: process 10015[.opencode-wrappe]: rejecting invalid page at address 0x10dbc8000 from offset 0x82b4000 in file "/nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped" (cs_mtime:1.0 == mtime:1.0) (signed:1 validated:0 tainted:1 nx:1 wpmapped:0 dirty:0 depth:0) ``` Workaround: ```bash sudo codesign --force --sign - /nix/store/cdw43d8v2b6xbmpg2hyzcdrzc5pk2rjh-opencode-1.18.11/bin/.opencode-wrapped ``` ### Expected behaviour Should have a correct signature, and not get killed when run. ### Screenshots _No response_ ### Relevant log output ```console ``` ### Additional context I do not know if this issue revolves around Nixpkgs or something upstream. I do not see any current issues for OpenCode or Bun relating to this. I do know that upstream Bun has had signing issues in the past (https://github.com/anomalyco/opencode/issues/15124), and there is another Bun AI tool that recently had similar problems (https://github.com/cline/cline/issues/12042). I tried running the official OpenCode binary downloaded from GitHub releases, and that one also has an invalid signature but was able to run after `xattr -d com.apple.quarantine opencode`. ### System metadata - system: `"aarch64-darwin"` - host os: `Darwin 27.0.0, macOS 27.0` - multi-user?: `yes` - sandbox: `no` System type: aarch64-darwin Additional system types: x86_64-darwin Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /Users/ethanreece/.config/nix/nix.conf:/Users/ethanreece/.nix-profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/ethanreece/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/j2z3ik2pgycjsqflhjyrnzdkgcrk1vn4-lix-2.95.2/share` - nixpkgs: `/nix/store/p9br0y2kmil5j5k85jczva3kdqy6hmnj-source` ### Are you using nix-darwin? Yes, I am using nix-darwin. ### Notify maintainers @delafthi @DuskyElf @graham33 --- **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.) ### I assert that this issue is relevant for Nixpkgs - [x] I assert that this is a bug and not a support request. - [x] I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+darwin%22). - [x] I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it. - [x] I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it. ### Is this issue important to you? Add a :+1: [reaction] to [issues you find important]. [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/ [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc