fergalmoran/picard
1
0
Fork 0
mirror of https://github.com/fergalmoran/picard.git synced 2026-01-06 08:34:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

PICARD-1653: Enable macOS "Hardened Runtime"

Browse Source
This commit is contained in:
Philipp Wolfer
2019-11-05 12:25:16 +01:00
parent de3a6f46b4
commit 97331ce7bd
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/package/entitlements.plist Normal file
View File

@@ -0,0 +1,6 @@
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
</dict>
</plist>

5
scripts/package/package-osx.sh
View File

@@ -42,7 +42,10 @@ cd dist
ditto -rsrc --arch x86_64 'MusicBrainz Picard.app' 'MusicBrainz Picard.tmp'
rm -r 'MusicBrainz Picard.app'
mv 'MusicBrainz Picard.tmp' 'MusicBrainz Picard.app'
[ "$CODESIGN" = '1' ] && codesign --keychain $KEYCHAIN_PATH --verify --verbose --deep --sign "$CERTIFICATE_NAME" 'MusicBrainz Picard.app'
[ "$CODESIGN" = '1' ] && codesign --verify --verbose --deep \
--options runtime --entitlements scripts/package/entitlements.plist \
--keychain $KEYCHAIN_PATH --sign "$CERTIFICATE_NAME" \
"MusicBrainz Picard.app"
# Verify Picard executable works and required dependencies are bundled
VERSIONS=$("MusicBrainz Picard.app/Contents/MacOS/picard-run" --long-version)