nixos-generators relies on NixOS's make-disk-image which relies on QEMU. It can be a bit slow without KVM.

Building images with systemd-repart is probably preferred and allows for more flexibility: https://nixos.org/manual/nixos/stable/#sec-image-repart

nixos-generators relies on NixOS's make-disk-image which relies on QEMU VMs. It can be a bit slow without KVM.

Building images with systemd-repart is probably preferred and allows for more flexibility: https://nixos.org/manual/nixos/stable/#sec-image-repart

a new podman-desktop bumped electron 36->37 and now fails on arm with

       >   • copying Electron  source=/private/tmp/nix-build-podman-desktop-1.20.0.drv-0/source/electron-dist/Electron.app destination=/private/tmp/nix-build-podman-desktop-1.20.0.drv-0/source/dist/mac-arm64/Electron.app
       >   • falling back to ad-hoc signature for macOS application code signing
       >   • signing         file=dist/mac-arm64/Podman Desktop.app platform=darwin type=distribution identityName=- identityHash=none provisioningProfile=none
       >   • Above command failed, retrying 3 more times
       >   • Above command failed, retrying 3 more times
       >   • Above command failed, retrying 3 more times
       >   • Above command failed, retrying 3 more times
       >   ⨯ spawn codesign ENOENT  failedTask=build stackTrace=Error: spawn codesign ENOENT
       >     at Process.ChildProcess._handle.onexit (node:internal/child_process:285:19)
       >     at onErrorNT (node:internal/child_process:483:16)
       >     at processTicksAndRejections (node:internal/process/task_queues:90:21)

even though we set CSC_IDENTITY_AUTO_DISCOVERY = lib.optionals stdenv.hostPlatform.isDarwin "false";

and apparently there was some change in electron-builder lately that attempts to apply some "ad-hoc" signature to arm apps: https://github.com/electron-userland/electron-builder/pull/9007 because they are "damaged" otherwise.

in Console.app I see these messages around the time of signing failure:

error	12:53:11.368210-0400	syspolicyd	os_unix.c:49448: (2) open(/private/var/db/DetachedSignatures) - No such file or directory
error	12:53:11.369669-0400	syspolicyd	os_unix.c:49448: (2) open(/private/var/db/DetachedSignatures) - No such file or directory
...
default	12:53:12.579237-0400	launchservicesd	[0x574044500] activating connection: mach=false listener=false peer=false name=com.apple.CodeSigningHelper
default	12:53:12.579324-0400	com.apple.CodeSigningHelper	[0xb6a0e8000] activating connection: mach=false listener=false peer=true name=com.apple.CodeSigningHelper.peer[663].0xb6a0e8000
default	12:53:12.579683-0400	com.apple.CodeSigningHelper	[0xb6a0e8000] invalidated because the client process (pid 663) either cancelled the connection or exited
default	12:53:12.631917-0400	launchservicesd	[0x574045f00] activating connection: mach=false listener=false peer=false name=com.apple.CodeSigningHelper
default	12:53:12.632026-0400	com.apple.CodeSigningHelper	[0xb6a0e8000] activating connection: mach=false listener=false peer=true name=com.apple.CodeSigningHelper.peer[663].0xb6a0e8000
default	12:53:12.632412-0400	com.apple.CodeSigningHelper	[0xb6a0e8000] invalidated because the client process (pid 663) either cancelled the connection or exited
...
default	12:53:20.149167-0400	kernel	AMFI: '/private/tmp/nix-build-podman-desktop-1.20.0.drv-0/source/node_modules/app-builder-bin/mac/app-builder_arm64': Unrecoverable CT signature issue, bailing out.
default	12:53:20.149169-0400	kernel	AMFI: code signature validation failed.

oh and I see similar messages coming from other apps in the same log (like my git-sync daemons)

default	12:53:28.652167-0400	kernel	AMFI: '/nix/store/4dssl7vf761w4jz4r6nyqfnsnrrajby9-git-sync-0-unstable-2025-06-26/bin/git-sync': Unrecoverable CT signature issue, bailing out.
default	12:53:28.652173-0400	kernel	AMFI: code signature validation failed.

any bells ringing?