darwin.postLinkSignHook: init

pkgs/top-level/darwin-packages.nix

···
     selfTargetTarget = pkgsTargetTarget.darwin or {}; # might be missing
   };
 
+  # Prefix for binaries. Customarily ends with a dash separator.
+  #
+  # TODO(@Ericson2314) Make unconditional, or optional but always true by
+  # default.
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+                                        (stdenv.targetPlatform.config + "-");
 in
 
 lib.makeScopeWithSplicing splicePackages newScope otherSplices (_: {}) (spliced: spliced.apple_sdk.frameworks) (self: let
···
   } ../os-specific/darwin/print-reexports/setup-hook.sh;
 
   sigtool = callPackage ../os-specific/darwin/sigtool { };
+
+  postLinkSignHook = pkgs.writeTextFile {
+    name = "post-link-sign-hook";
+    executable = true;
+
+    text = ''
+      CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
+        ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
+    '';
+  };
 
   maloader = callPackage ../os-specific/darwin/maloader {
   };