macOS codesign hook: use nix-compatible CLI flags

[anmonteiro]

Signed-off-by: Antonio Nuno Monteiro anmonteiro@gmail.com

Looks like Nix exposes a darwin.sigtool binary that is compatible with /usr/bin/codesign, but it doesn't support --sign. We also need to pass -f because the binary might already be signed.

This is how dune 3.5 will be able to be packaged for nix: nix-ocaml/nix-overlays@db5f507

[emillon]

Thanks. I'll merge that without the -f part that we can discuss separately for 3.6.

[anmonteiro]

The error I get without -f is:

ocaml5.0.0+alpha1-conan-cli> libc++abi: terminating with uncaught exception of type std::runtime_error: file is already signed. pass -f to sign regardless.