Following the PR discussion, everything makes now sense:
So adding darwin.sigtool was indeed the key for the builder to access codesign.
Coming back to my original questions:
- Is it some kind of bug in upstream nixpkgs: Yes since Qt6.9
codesign was required in the build but missing.
- Or is there an extra undocumented step to codesign: I haven’t tried that on my system but maybe sandboxing should be disabled?