fix: macOS binary crashes on machines without Nix

[antidmg]

Problem

When a user installs the CLI on macOS via the curl installer, it crashes immediately:

dyld[40555]: Library not loaded: /nix/store/7h6icyvqv6.../libiconv.2.dylib
  Referenced from: ...
  Reason: tried: '/nix/store/...' (no such file)
zsh: abort      statespace

Cause

The macOS binary is built with Nix, which hardcodes library paths like /nix/store/.../libiconv.2.dylib into the binary. The binary then only works on machines that have Nix installed.

The Linux builds already fix this — the GNU builds use patchelf --remove-rpath, and the musl builds are fully static. The macOS build was missing an equivalent fix.

Fix

After copying the binary, use install_name_tool to rewrite any /nix/store/... library references to /usr/lib/.... macOS ships libiconv (and other system libraries) at /usr/lib/ on every Mac, so the binary will find them there.

The fix handles all Nix store references generically, not just libiconv, so it won't break if another Nix-provided library gets pulled in later.

Summary by CodeRabbit

• Chores
  • Improved macOS release packaging: ensures packaged binaries have correct executable permissions and rewrites embedded library references to point to system libraries before creating the release tarball. Tarball creation and checksum generation remain unchanged.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 28e03523-8b0d-4986-bfc5-cf64246fd7eb

📥 Commits

Reviewing files that changed from the base of the PR and between fa10165 and 2a6d8d4.

📒 Files selected for processing (1)

• .github/workflows/build-release-binaries.yml

---

Walkthrough

Adds macOS release packaging steps to set executable permissions on the copied binary and rewrite Nix-store dynamic library references by scanning with otool and remapping them to /usr/lib via install_name_tool before tarball creation.

Changes

Cohort / File(s)	Summary
macOS Binary Release Preparation .github/workflows/build-release-binaries.yml	After copying the macOS binary, set executable mode (chmod 755) and scan the binary for /nix/store/ dylib references with otool; for each match, use install_name_tool to remap the path to /usr/lib/<basename> prior to tarball and SHA256 steps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix(ci): patchelf GNU binaries to use system dynamic linker #112: Adds chmod and Nix-store dynamic-link reference patching for the Linux release flow using patchelf, closely related to macOS install_name_tool changes.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main fix: resolving macOS binary crashes on machines without Nix by handling dylib path references.
Description check	✅ Passed	The description comprehensively covers the problem, cause, and fix, but does not follow the repository's template structure (missing Testing and Checklist sections).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/macos-nix-dylib-paths

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}