bundle-nix-macos.sh

bundle-macos.nix

{ pkgs }:
pkg:
pkgs.runCommand "bundle-${pkg.name}" {
  nativeBuildInputs = with pkgs; [ coreutils which darwin.binutils darwin.sigtool ];
} ''
  find '${pkg}/bin' -type f -executable -exec '${./bundle-macos.sh}' '{}' "$out" \;
''

bundle-macos.sh

#!/usr/bin/env bash

set -euo pipefail

binary="$1"
out="$2"

bin_dir="bin"
dylib_dir="Frameworks/Library.dylib"

mkdir -p "$out/$bin_dir" "$out/$dylib_dir"

# Recursively bundle the given input executable or dylib
bundleBin() {
  local file="$1"

  local real_file
  real_file=$(realpath "$file")
  local install_dir="$out/$dylib_dir"
  local rpath_prefix="@loader_path"
  if [[ ! $real_file == *.dylib ]]; then
    install_dir="$out/$bin_dir"
    rpath_prefix="@executable_path/../$dylib_dir"
  fi

  local copied_file
  copied_file="$install_dir/$(basename "$real_file")"
  if [ -f "$copied_file" ]; then
    return
  fi

  echo "Bundling $real_file to $install_dir"
  cp "$real_file" "$copied_file"
  chmod +w "$copied_file"

  local linked_libs
  linked_libs=$(otool -L "$real_file" | tail -n +2 | grep '/nix/store/' | cut -d '(' -f -1)
  for linked_lib in $linked_libs; do
    local real_lib
    real_lib=$(realpath "$linked_lib")
    local real_lib_name
    real_lib_name=$(basename "$real_lib")
    install_name_tool -change "$linked_lib" "$rpath_prefix/$real_lib_name" "$copied_file"
    bundleBin "$real_lib"
  done

  codesign -f -s - "$copied_file"
}

bundleBin "$binary"
find "$out/$bin_dir" -type f -executable -exec codesign -f -s - '{}' \;