can1357
af33d4bfe4
- Added macOS CI signing and notarization steps when APPLE_* secrets are configured. - Added strict darwin verification checks to reject ad-hoc signatures and run smoke tests. - Added Homebrew formula publishing from release assets with SHA-256 checksums. - Added helper scripts for signing secret upload, entitlements, and release workflows.
27 lines
1.2 KiB
Plaintext
27 lines
1.2 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!--
|
|
Entitlements for the hardened-runtime Developer ID signature applied to the
|
|
compiled `omp` macOS binary (see scripts/ci-macos-sign.sh).
|
|
|
|
These are NOT optional. The binary is a Bun single-file executable, and:
|
|
* allow-jit / allow-unsigned-executable-memory — JavaScriptCore JITs at
|
|
runtime; the hardened runtime kills JIT (MAP_JIT) pages without these.
|
|
* disable-library-validation — omp extracts its native addon
|
|
(pi_natives.<triple>.node) and other optional dylibs to a runtime cache
|
|
and dlopen()s them. Those dylibs do not share the main binary's Team ID,
|
|
so without this entitlement the hardened runtime refuses to map them
|
|
("mapping process and mapped file have different Team IDs") and every
|
|
command that touches natives (i.e. effectively all of them) aborts.
|
|
-->
|
|
<key>com.apple.security.cs.allow-jit</key>
|
|
<true/>
|
|
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
|
|
<true/>
|
|
<key>com.apple.security.cs.disable-library-validation</key>
|
|
<true/>
|
|
</dict>
|
|
</plist>
|