Repository navigation
[BUG]: macOS release binaries fail codesign verification #46313
Description
Description
The macOS binaries in v1.18.25 fail codesign --verify. The embedded signature doesn't match the file contents.
$ codesign --verify --verbose=2 ./opencode
./opencode: invalid signature (code or signature have been modified)
Both opencode-darwin-arm64.zip and opencode-darwin-x64.zip are affected. I compared the sha256 of my install against the release asset and they match, so this isn't a corrupted download.
The x64 build points at the cause. It still carries Bun's own Developer ID:
Identifier=bun
TeamIdentifier=7FRXF46ZSN
flags=0x10000(runtime)
-> invalid signature
So the payload goes into the binary after Bun's signed executable is built, and nothing re-signs it afterwards. arm64 shows the same thing with the linker's adhoc signature (Identifier=a.out).
On a normal Mac this goes unnoticed. On a machine running an Endpoint Security agent (corporate EDR), macOS revalidates on every exec. Validation fails, so nothing gets cached, and the next launch re-hashes all 34,914 pages again. Timings for opencode --version, which does nothing but start the process:
as shipped 1.43 10.41 0.79 10.85 0.79 10.75 s
re-signed 12.34 0.33 0.33 0.32 0.31 0.31 s
For reference, claude --version (188 MB, Developer ID signed) takes 0.01s on the same machine.
Running codesign -s - -f ./opencode after the compile step fixes it. I re-signed my copy locally and it works normally (--version prints 1.18.25, codesign --verify passes). A real Developer ID signature plus notarization would be better, but the adhoc re-sign is enough to make the signature valid and cacheable.
Plugins
None
OpenCode version
1.18.25
Steps to reproduce
Steps to reproduce
- Download
opencode-darwin-arm64.zipfrom the v1.18.25 release unzip opencode-darwin-arm64.zipcodesign --verify --verbose=2 ./opencode
Screenshot and/or share link
No response
Operating System
macOS 26.5 (25F71)
Terminal
Ghostty
Activity
[-]macOS release binaries fail codesign verification[/-][+][BUG]: macOS release binaries fail codesign verification[/+]github-actions commentedon Aug 30, 2026
This issue might be a duplicate of existing issues that cover the same macOS codesigning root cause. Please check:
codesign -s - -f)Those issues are closed, so if the problem has regressed in v1.18.25 this may warrant a new report, but it would be helpful to reference them and confirm whether the fixes applied there were not carried forward.
nekonora commentedon Aug 31, 2026
+1
I can reproduce this with OpenCode
1.18.25on arm64 macOS 27.0 (26A5421a). No third-party Endpoint Security/EDR is installed.Connecting OpenCode to Xcode 27 Beta 6’s headless MCP consistently crashes Xcode Service with
SIGKILL (Code Signature Invalid) / CODESIGNING: Invalid Page. The stack showsProcessSecurity.sha256Hash(of:) → HeadlessPermissionGate.evaluate(...), and Xcode identifies the binary as/opt/homebrew/Cellar/opencode/1.18.25/bin/opencode(in my case installed via homebrew).codesign --verify --strictreports:invalid signature (code or signature have been modified). This also occurs with--unsafe-always-allow-all-agentsenabled.ntcho commentedon Aug 31, 2026
Adding another +1 for this. On macOS, Full Disk Access permissions should survive normal OpenCode updates. A stable code-signing identity or equivalent packaging approach would prevent users from having to reauthorize FDA after each release.
shawal-mba commentedon Sep 15, 2026
Adding a nother +1 on this, the binary installed with brew, the current latest version seemed to have a codesign issue, manually fixed this issue and now I get a server error when i attempt sending a message," mesage send error check server logs" installed an alternative opencode binary that seems to work on the same machine.
brew bin
curl installed bin that works
shawal-mbalire commentedon Sep 17, 2026
This issue was resolved for. me on the latest homebrew opencode build. Thanks
fix(ci): sign macOS CLI with Developer ID
fix(ci): sign macOS CLI with Developer ID