[BUG]: macOS release binaries fail codesign verification #46313

Description

The macOS binaries in v1.18.25 fail codesign --verify. The embedded signature doesn't match the file contents.

$ codesign --verify --verbose=2 ./opencode
./opencode: invalid signature (code or signature have been modified)

Both opencode-darwin-arm64.zip and opencode-darwin-x64.zip are affected. I compared the sha256 of my install against the release asset and they match, so this isn't a corrupted download.

The x64 build points at the cause. It still carries Bun's own Developer ID:

Identifier=bun
TeamIdentifier=7FRXF46ZSN
flags=0x10000(runtime)
-> invalid signature

So the payload goes into the binary after Bun's signed executable is built, and nothing re-signs it afterwards. arm64 shows the same thing with the linker's adhoc signature (Identifier=a.out).

On a normal Mac this goes unnoticed. On a machine running an Endpoint Security agent (corporate EDR), macOS revalidates on every exec. Validation fails, so nothing gets cached, and the next launch re-hashes all 34,914 pages again. Timings for opencode --version, which does nothing but start the process:

as shipped   1.43  10.41   0.79  10.85   0.79  10.75  s
re-signed   12.34   0.33   0.33   0.32   0.31   0.31  s

For reference, claude --version (188 MB, Developer ID signed) takes 0.01s on the same machine.

Running codesign -s - -f ./opencode after the compile step fixes it. I re-signed my copy locally and it works normally (--version prints 1.18.25, codesign --verify passes). A real Developer ID signature plus notarization would be better, but the adhoc re-sign is enough to make the signature valid and cacheable.

Plugins

None

OpenCode version

1.18.25

Steps to reproduce

Steps to reproduce

1. Download opencode-darwin-arm64.zip from the v1.18.25 release
2. unzip opencode-darwin-arm64.zip
3. codesign --verify --verbose=2 ./opencode

Screenshot and/or share link

No response

Operating System

macOS 26.5 (25F71)

Terminal

Ghostty