fix(release): grant V8 the JIT entitlements the Hardened Runtime requires

[amondnet]

v0.2.0 is published and crashes on launch

Reported from a real install on macOS 15.6.1 / Intel: EXC_BREAKPOINT (SIGTRAP) on the Deno runtime thread (RuntimeLoader::RuntimeThread → laufey_runtime_start), with V8 worker threads alive alongside it.

I caused this in #18. To satisfy the notary service I signed everything with --options runtime, but passed no entitlements. The Hardened Runtime denies a JIT its executable memory, so V8 aborts before the window opens. deno desktop had never enabled the Hardened Runtime — a plain build is flags=0x2(adhoc) — so the problem only appeared once signing was fixed.

Proof

Same binaries, only the signature differs:

Variant	Result
Shipped build (runtime, no entitlements)	exits 133 (SIGTRAP)
Re-signed with JIT entitlements	stays up, Runtime started, Listening on http://127.0.0.1:56287/

Fix

packaging/macos/entitlements.plist grants the standard V8/CEF Hardened Runtime exceptions — allow-jit, allow-unsigned-executable-memory, disable-library-validation, allow-dyld-environment-variables — applied to every bundle that hosts V8: the app and the five CEF helper apps. Libraries are signed without entitlements; they inherit the host process's.

Why my verification missed it

I verified checksums, spctl, stapling and the cask, and called the release "genuinely installable". spctl --assess only says Gatekeeper will permit execution — it says nothing about whether the app runs. I never launched it.

Two checks close that gap:

• The signing step asserts allow-jit on every V8 host and names the offending bundle.
• A new smoke test launches the signed app, requires it to stay up for 15s and to log Listening on, and calls out exit 133 as a likely Hardened Runtime JIT denial. Cross-arch runs emit a ::warning:: saying the build is not launch-verified rather than passing silently.

The workflow header comment is corrected too — it asserted that deno desktop applies the Hardened Runtime, which is the belief that produced this bug.

---

Summary by cubic

Fixes the macOS launch crash by granting V8 the JIT entitlements required by the Hardened Runtime and verifying app startup in the release workflow. This ensures v0.2.0+ builds run instead of aborting with SIGTRAP.

• Bug Fixes
  • Added packaging/macos/entitlements.plist with allow-jit, allow-unsigned-executable-memory, disable-library-validation, and allow-dyld-environment-variables; applied to the app and CEF helper apps (libraries inherit).
  • Re-signed all nested Mach-O binaries with the Hardened Runtime; assert allow-jit on all V8 hosts during signing.
  • Introduced a smoke test that launches the signed app, waits up to 15s for “Listening on”, flags exit 133 as a likely JIT denial, and runs wait outside errexit so failures report the exit code and logs (cross-arch runs warn and skip).
  • Moved macOS signing to the workflow, then rebuild/sign the DMG before notarization; updated comments to reflect the new flow.

^{Written for commit fe76ba0. Summary will update on new commits.}

[gemini-code-assist]

Code Review

This pull request adds a new entitlements.plist file for macOS packaging to define Hardened Runtime exceptions required by the embedded V8 and CEF runtimes, including permissions for JIT compilation, unsigned executable memory, disabled library validation, and DYLD environment variables. I have no feedback to provide on these changes.

[greptile-apps]

Greptile Summary

This PR repairs the signed macOS release path and adds launch verification.

• Adds Hardened Runtime JIT entitlements for the main application and CEF helper applications.
• Re-signs nested code and validates that every V8-hosting bundle has allow-jit.
• Smoke-tests native-architecture builds for startup and the expected listening log.
• Rebuilds and signs the disk image from the newly signed application bundle.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Reworks macOS signing to apply JIT entitlements, validates V8 hosts, adds native-architecture launch testing, and rebuilds the disk image from the signed bundle; the previously reported wait diagnostic issue is fixed by temporarily disabling errexit.
packaging/macos/entitlements.plist	Defines the Hardened Runtime exceptions required by the embedded Deno and CEF V8 processes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Build macOS app bundle] --> B[Sign nested libraries]
    B --> C[Sign V8 host bundles with entitlements]
    C --> D[Verify signatures and allow-jit]
    D --> E{Runner matches target architecture?}
    E -->|Yes| F[Launch smoke test]
    E -->|No| G[Warn that launch is unverified]
    F --> H[Require process survival and Listening on log]
    G --> I[Rebuild disk image]
    H --> I
    I --> J[Sign disk image]
    J --> K[Notarize and staple]

Loading

_{Reviews (2): Last reviewed commit: "chore: apply AI code review suggestions" | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud