Skip to content

fix(opencode): ad-hoc re-sign darwin binaries after local compile #52183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rekram1-node merged 1 commit into from
Sep 30, 2026
Merged

fix(opencode): ad-hoc re-sign darwin binaries after local compile #52183

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
fix(opencode): re-sign darwin binaries ad-hoc after compile 
Bun's compile embeds the bundle after the linker has ad-hoc signed the
executable, leaving the signature invalid. macOS 27 enforces code page
validation and SIGKILLs the binary on launch (exit 137), so local builds
(build.ts --single) fail the smoke test and cannot run.

Re-sign darwin outputs with an ad-hoc identity when building on macOS.
Release CI builds on Linux and re-signs with Developer ID in
sign-cli-macos, so published binaries are unaffected.
  • Loading branch information
Ryan Wyler
Ryan Wyler committed Sep 29, 2026
commit 606f338062b8eb0604ff62d76dca3c1faef699e4
6 changes: 6 additions & 0 deletions packages/opencode/script/build.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,12 @@ for (const item of targets) {
},
})

// Embedding the bundle invalidates the linker's ad-hoc signature, and macOS 27+
// SIGKILLs binaries with invalid pages. Re-sign ad-hoc; release CI re-signs with Developer ID.
if (item.os === "darwin" && process.platform === "darwin") {
await $`codesign --force --sign - dist/${name}/bin/opencode`
}

// Smoke test: only run if binary is for current platform
if (item.os === process.platform && item.arch === process.arch && !item.abi) {
const binaryPath = `dist/${name}/bin/opencode`
Expand Down
Loading