fix(ci): normalize macOS binary dependencies (#3006)

Closes #2997

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Author: SDAChess

.github/actions/build-rust-binary/action.yml

@@ -71,6 +71,36 @@ runs:
         INPUTS_EXTRA_CARGO_FLAGS: ${{ inputs.extra-cargo-flags }}
       run: GIT_DIR=/nonexistent cargo auditable build --release --package "${INPUTS_PACKAGE}" --bin "${INPUTS_BINARY}" ${INPUTS_EXTRA_CARGO_FLAGS}
 
+    - name: Normalize Darwin dynamic binary
+      if: endsWith(inputs.triple, '-apple-darwin')
+      shell: bash -euo pipefail {0}
+      env:
+        INPUTS_BINARY: ${{ inputs.binary }}
+      run: |
+        binary=target/release/${INPUTS_BINARY}
+        nix_iconv_paths=$(otool -L "$binary" | awk '$1 ~ "^/nix/store/.*/lib/libiconv\\.2\\.dylib$" { print $1 }')
+        if [[ -n "$nix_iconv_paths" ]]; then
+          while IFS= read -r nix_iconv_path; do
+            install_name_tool -change "$nix_iconv_path" /usr/lib/libiconv.2.dylib "$binary"
+          done <<< "$nix_iconv_paths"
+          codesign --force --sign - "$binary"
+        fi
+
+    - name: Verify Darwin portability
+      if: endsWith(inputs.triple, '-apple-darwin')
+      shell: bash -euo pipefail {0}
+      env:
+        INPUTS_BINARY: ${{ inputs.binary }}
+      run: |
+        binary=target/release/${INPUTS_BINARY}
+        nix_dependencies=$(otool -L "$binary" | awk '$1 ~ "^/nix/store/" { print $1 }')
+        if [[ -n "$nix_dependencies" ]]; then
+          echo "error: $binary has non-portable Nix store dependencies:" >&2
+          printf '  %s\n' "$nix_dependencies" >&2
+          exit 1
+        fi
+        codesign --verify --verbose=2 "$binary"
+
     - name: Verify ${{ inputs.binary }}
       shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
       env:

architecture/build.md

@@ -145,8 +145,12 @@ The shared binary build action compiles release artifacts with `cargo auditable`
 Branch E2E, Release Dev, and Release Tag image jobs stage those same artifacts
 instead of rebuilding binaries in Docker. Each binary build scans its output with
 Syft and requires at least one decoded Cargo package before uploading the
-artifact. The CI image gains the pinned `cargo-auditable` tool through
-`mise install --locked` but ships no auditable OpenShell binary of its own.
+artifact. Darwin builds replace Nix's `libiconv` load command with the macOS
+system install name, ad-hoc sign the modified binary, and fail if `otool -L`
+reports any remaining `/nix/store` dependency. Runtime and Syft verification
+run after that normalization. The CI image gains the pinned `cargo-auditable`
+tool through `mise install --locked` but ships no auditable OpenShell binary of
+its own.
 
 Pushed Docker images carry minimal SLSA provenance and a per-platform SPDX SBOM
 generated by BuildKit's default Syft scanner. The registry exporter uses OCI