Flaky CI Failure: bindings-node-js-napi-aarch64-apple-darwin references /nix/store after postFixup

## Flaky CI Failure: bindings-node-js-napi-aarch64-apple-darwin references /nix/store after postFixup **Workflow:** Cache all Nix Outputs **Failed run:** https://github.com/xmtp/libxmtp/actions/runs/24482001451 **Commit:** 796011d6359372fd354891b2e8dcd3b6670baa6d **Failed jobs:** build (warp-macos-26-arm64-12x) ### Summary The Nix build for `bindings-node-js-napi-aarch64-apple-darwin` fails during `postFixup` because the compiled `bindings_node.darwin-arm64.node` binary still contains a reference to a `/nix/store` path (`libiconv`) after fixup completes. Nix treats this as a forbidden self-reference and aborts the build. The failure was introduced by commit `796011d` (`fix(nix): add darwin.sigtool so codesign is on PATH during node fixupPhase`), which changed how the `fixupPhase` is invoked for macOS Node.js bindings. ### Error Details ``` bindings-node-js-napi-aarch64-apple-darwin> Running phase: fixupPhase bindings-node-js-napi-aarch64-apple-darwin> checking for references to /nix/var/nix/builds/nix-15163-3622870241/ in /nix/store/jbsr6yvaiirplw1ngvnghj4vhzkqq94l-bindings-node-js-napi-aarch64-apple-darwin-1.10.0... bindings-node-js-napi-aarch64-apple-darwin> patching script interpreter paths in /nix/store/jbsr6yvaiirplw1ngvnghj4vhzkqq94l-bindings-node-js-napi-aarch64-apple-darwin-1.10.0 bindings-node-js-napi-aarch64-apple-darwin> error: /nix/store/jbsr6yvaiirplw1ngvnghj4vhzkqq94l-bindings-node-js-napi-aarch64-apple-darwin-1.10.0/dist/bindings_node.darwin-arm64.node still references /nix/store after postFixup: bindings-node-js-napi-aarch64-apple-darwin> /nix/store/a85h00app701vf0ggln0r97yayszvwkk-libiconv-109.100.2/lib/libiconv.2.dylib error: Cannot build '/nix/store/pdsxpjgsfx2cykqyb99wj9ylvl10gbcm-bindings-node-js-napi-aarch64-apple-darwin-1.10.0.drv'. Reason: builder failed with exit code 1. error: Cannot build '/nix/store/cn81mrk3l1pi6bs5llbxaiacsqig82i0-devour-output.json.drv'. Reason: 1 dependency failed. error: Build failed due to failed dependency Error: `nix build` failed; exit code: Some(1) ``` ### Analysis This is a **code/configuration failure**, not an infrastructure failure. The failing derivation is `bindings-node-js-napi-aarch64-apple-darwin` — the cross-compiled aarch64 macOS Node.js native addon. Nix's `fixupPhase` on Darwin normally uses `install_name_tool` to rewrite dylib references so that the final output does not depend on any Nix store paths (or converts them to `@rpath`/`@loader_path`-relative paths). The offending reference is: ``` /nix/store/a85h00app701vf0ggln0r97yayszvwkk-libiconv-109.100.2/lib/libiconv.2.dylib ``` Commit `796011d` added `darwin.sigtool` to make `codesign` available during `fixupPhase`. A likely cause is that codesigning the `.node` file *before* `install_name_tool` rewrites its load commands (or vice versa, invalidating the signature after rewriting) has disrupted the rpath fixup flow, leaving the absolute Nix store path for `libiconv` intact. Affected area: `nix/` Nix flake / derivation for Node.js bindings, specifically the `aarch64-apple-darwin` (ARM64 macOS) variant. --- *Reported by [Flaky Failure Watcher](https://github.com/xmtp/libxmtp/blob/main/.github/workflows/flaky-failure-watcher.yml)*