Issue Station
Sign In
Tools hereToolbox

hermes - ✅(Solved) Fix [Bug]: nix build fails on aarch64-darwin — av pythonImportsCheck SIGKILLed by codesigning bug [2 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#15776•Fetched 2026-04-26 05:25:06
View on GitHub
Comments
0
Participants
1
Timeline
5
Reactions
0
Author
jerome-benoitjerome-benoit
Participants
jerome-benoitjerome-benoit
Timeline (top)
labeled ×3cross-referenced ×1referenced ×1

Root Cause

The nix daemon's RewritingSink in derivation-builder.cc rewrites sibling-output store-path bytes inside ffmpeg-headless dylibs after the builder exits. This invalidates the linker-signed ad-hoc code signature page hashes, causing cs_invalid_page SIGKILL on load.

Known nix bug: NixOS/nix#15638, NixOS/nixpkgs#511265. Only aarch64-darwin. Linux unaffected.

Fix Action

Fixed

PR fix notes

PR #15777: fix(nix): skip av pythonImportsCheck on aarch64-darwin

Description (problem / solution / changelog)

What does this PR do?

Disables pythonImportsCheck on the av package override in nix/python.nix for aarch64-darwin. The nix daemon's RewritingSink corrupts Mach-O ad-hoc code signatures on ffmpeg-headless multi-output derivation, causing macOS to SIGKILL the python process during the import check phase.

Related Issue

Fixes #15776

Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

  • nix/python.nix: override pythonImportsCheck = [] on python312.pkgs.av before passing to mkPrebuiltOverride. The check is redundant since mkPrebuiltOverride already pulls a known-good nixpkgs build — it only fails due to the nix daemon bug, not a broken av package.

How to Test

  1. nix build .#packages.aarch64-darwin.default on macOS ARM64
  2. Build succeeds (previously failed with exit code 137 / Killed: 9)

Checklist

Code

  • I've read the Contributing Guide
  • My commit messages follow Conventional Commits
  • I searched for existing PRs to make sure this isn't a duplicate
  • My PR contains only changes related to this fix (no unrelated commits)
  • I've run pytest tests/ -q and all tests pass
  • I've added tests for my changes
  • I've tested on my platform: macOS 26.4.1 aarch64-darwin

Documentation & Housekeeping

  • N/A — nix packaging only, no docs impact

Context

Changed files

  • nix/python.nix (modified, +6/-1)

Code Example

nix build github:NousResearch/hermes-agent --system aarch64-darwin

---

pythonImportsCheckPhase
Check whether the following modules can be imported: av av.audio ...
Killed: 9
builder failed with exit code 137

---

av = mkPrebuiltOverride final (python312.pkgs.av.overrideAttrs (_: {
  pythonImportsCheck = [];
})) { };
RAW_BUFFERClick to expand / collapse

Bug Description

nix build of hermes-agent fails on aarch64-darwin because python3.12-av-16.1.0 is killed during pythonImportsCheckPhase. The macOS kernel SIGKILLs the process with Code Signature Invalid when it dlopens ffmpeg-headless dylibs whose Mach-O page hashes were corrupted by the nix daemon's RewritingSink.

Steps to Reproduce

nix build github:NousResearch/hermes-agent --system aarch64-darwin

Expected Behavior

Build succeeds.

Actual Behavior

pythonImportsCheckPhase
Check whether the following modules can be imported: av av.audio ...
Killed: 9
builder failed with exit code 137

Affected Component

Setup / Installation

Debug Report

N/A — build-time failure, hermes never runs.

Operating System

macOS 26.4.1 (25E253), aarch64-darwin

Python Version

3.12.13

Hermes Version

0.11.0 (from nix flake)

Root Cause Analysis

The nix daemon's RewritingSink in derivation-builder.cc rewrites sibling-output store-path bytes inside ffmpeg-headless dylibs after the builder exits. This invalidates the linker-signed ad-hoc code signature page hashes, causing cs_invalid_page SIGKILL on load.

Known nix bug: NixOS/nix#15638, NixOS/nixpkgs#511265. Only aarch64-darwin. Linux unaffected.

Proposed Fix

Disable pythonImportsCheck on the av override in nix/python.nix for aarch64-darwin. The check is redundant here since mkPrebuiltOverride pulls a known-good nixpkgs build — it only fails because of the nix daemon bug, not because av is broken.

av = mkPrebuiltOverride final (python312.pkgs.av.overrideAttrs (_: {
  pythonImportsCheck = [];
})) { };

PR incoming.

extent analysis

TL;DR

Disable pythonImportsCheck on the av override in nix/python.nix for aarch64-darwin to workaround the nix daemon bug.

Guidance

  • The issue is caused by the nix daemon's RewritingSink corrupting the Mach-O page hashes of ffmpeg-headless dylibs, leading to a Code Signature Invalid error.
  • To verify the issue, try building the hermes-agent with the nix build command and observe the Killed: 9 error message.
  • To mitigate the issue, apply the proposed fix by disabling pythonImportsCheck on the av override in nix/python.nix for aarch64-darwin.
  • Note that this workaround is specific to aarch64-darwin and does not affect Linux builds.

Example

av = mkPrebuiltOverride final (python312.pkgs.av.overrideAttrs (_: {
  pythonImportsCheck = [];
})) { };

This code snippet demonstrates the proposed fix, which disables pythonImportsCheck on the av override.

Notes

  • This issue is specific to aarch64-darwin and is caused by a known nix bug (NixOS/nix#15638, NixOS/nixpkgs#511265).
  • The proposed fix is a workaround and not a permanent solution, as it disables a check that may be useful in other scenarios.

Recommendation

Apply workaround: Disable pythonImportsCheck on the av override in nix/python.nix for aarch64-darwin, as this is a known issue with a pending PR fix.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#installation#LLM response#prompt template#agent execution#callback error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING