In #4389 and #4135 problem between dune substitutions and codesign has been raised. But unfortunately both times another bug was also the culprit. It is time for dune to call codesign -s - $binary automatically after substitution.

• applying only for architecture = arm64 and system = macosx

However I don't know on which files it should be applied:

• should we do it only for substituted files for which the source is verfied (codesign -v <path>)
• for all executables?

Also the CI doesn't check that? Could we test on M1?

@correnson