config.lib.appIdentity: the home-manager and nix-darwin modules now expose stabilizeApp and mkAppBundle as config.lib.appIdentity, so a module that owns a package option (e.g. programs.kitty.package) or a launchd agent can stabilize without calling pkgs.callPackage inputs.nix-mac-app-identity { } itself. Both routes build the same derivation. (b06b60b)
Fixed
Wrapped executables (makeBinaryWrapper): applications wrapped with makeBinaryWrapper (such as pkgs.flameshot and pkgs.kitty) now retain their TCC permissions across rebuilds. Previously, Contents/MacOS/<app> was an entrypoint stub that executed an inner .app-wrapped binary pointing to the original Nix store path, leaving the actual running executable unsigned and tied to a volatile store path. All Mach-O binaries under Contents/MacOS are now signed with the bundle's designated requirement (identifier "<bundle-id>"). (598399b)
Internal store path references: references to the source derivation's store path in bundle wrapper scripts, text files, and Mach-O binaries are rewritten to the stabilized output path before signing. This prevents stabilized binaries and wrappers from executing or referencing code in the original unstabilized store path. (598399b)
Duplicate binaries in bin/: when a package provides a binary in bin/ that duplicates one in Contents/MacOS/, it is replaced with a relative symlink into the bundle rather than remaining an independent copy, ensuring both share the bundle's stable identity. (598399b)
Changed
Derivation output naming: stabilized derivations now preserve the source package's store name (keeping paths equal in length for in-place Mach-O rewriting), with pname set to <name>-stable-identity. Standalone bundles generated by mkAppBundle are named <App>.app. (598399b)
Bundle validation: bundles containing directory symlinks inside Contents/MacOS, symlinks into nested bundles, or filenames containing : or @ are rejected at build time. Nested bundles (.plugin, .framework) retain their own bundle identifiers. (598399b)
natsukium released this