All extensions_* tasks on the IBM nightly release variants (enterprise-rhel-8/9/10-ppc64le, enterprise-rhel-8.3/9-s390x) fail during fixture setup before running any test:

  Error parsing command line: unrecognised option '--extensionsSignaturePublicKeyPath=...'
  

  mongod exits with code 2 and resmoke reports "Could not connect to mongod".

  Root cause

  SERVER-134409 (dd8768f5393) scheduled the .extensions tasks on the IBM variants. Those variants publish packages (push_bucket is set), so nightly builds there are compiled in release mode, which always defines MONGO_CONFIG_EXT_SIG_SECURE (bazel/config/BUILD.bazel) — and .bazelrc's public-release config additionally forces extensions_signature_verification_secure=True.

  In secure-mode builds:
  - The extensionsSignaturePublicKeyPath server option is compiled out (server_options_general.idl), so resmoke unconditionally passing it (SERVER-115286) crashes the server at startup.
  - Signature validation is mandatory against the production mongot-extension key embedded in the binary, while test extensions are signed with the test key — so even without the crash, test extensions could never load.

  This combination never occurs elsewhere: every other variant running extensions_* tasks is non-publishing (no push_bucket), hence a non-release insecure build where the option exists and test-key verification works. Patch builds on the IBM variants are also non-release (is_patch suppresses the release flag in bazel_evergreen_shutils.sh::maybe_release_flag), which is why PR patch testing could not catch this — the failure only manifests on the weekly nightly cron builds.

  Fix

  Config-only change to the IBM variants; no server or resmoke code changes:

  On each .extensions task entry, pass via task-level extra_test_flags:
   1) --skipExtensionsSignatureVerification — resmoke stops passing the compiled-out option (same mechanism the with_mongot_extension_* suites use via the suite-level flag).
  2) {{--mongodSetParameters='

'}}  — disables mandatory signature validation on the secure build so test-key-signed extensions load (the documented escape hatch in signature_validator.cpp).
  # Add --//bazel/config:extensions_signature_verification_secure=True to the variants' bazel_compile_flags so that patch builds match the nightly's secure mode and the configuration can be validated in a patch before merge (nightly builds are unaffected: release mode already implies secure).

   Test coverage impact

  None lost: secure/release binaries never verified test-key-signed extensions anywhere by design; test-key signature verification continues to run on the ~24 non-publishing (insecure) waterfall/nightly variants that schedule the extensions_ suites. What this adds is extension *functionality coverage (load/parse/execute) on the actual shipped ppc64le/s390x release binaries. Signature-verification logic on those platforms remains covered by the C++ unit tests (signature_validator_test, rnp_test).