Skip to content

Commit

Permalink
build(macos): Disable 'Hardend Runtime' security option (#3357)
Browse files Browse the repository at this point in the history
Turn off the 'Hardend Runtime' security option to allow users to load
external libraries (signed with a different team id or unsigned).

But in this case Apple does not allow notarization.
So GateKeeper will block the execution.

Reference:
https://developer.apple.com/documentation/security/hardened_runtime
https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web

Resolve: #3357
  • Loading branch information
lucydodo committed Dec 6, 2023
1 parent e39ea5d commit 8d91e1e
Showing 1 changed file with 2 additions and 9 deletions.
11 changes: 2 additions & 9 deletions .github/actions/notarize-macos/action.yml
Expand Up @@ -107,7 +107,7 @@ runs:
codesign --sign "${{ inputs.DEV_ID }}" --deep --force --options=runtime --strict --timestamp "$TARGET/Contents/Extensions/fileio.dylib"
codesign --sign "${{ inputs.DEV_ID }}" --deep --force --options=runtime --strict --timestamp "$TARGET/Contents/Extensions/formats.dylib"
codesign --sign "${{ inputs.DEV_ID }}" --deep --force --options=runtime --strict --timestamp "$TARGET/Contents/Extensions/math.dylib"
codesign --sign "${{ inputs.DEV_ID }}" --deep --force --options=runtime --strict --timestamp "$TARGET"
codesign --sign "${{ inputs.DEV_ID }}" --deep --force --strict --timestamp "$TARGET"
done
- name: Move app bundle to installer folder for DMG creation
Expand Down Expand Up @@ -144,13 +144,6 @@ runs:
appdmg --quiet installer/macos/nightly.json "$TARGET"
fi
codesign --sign "${{ inputs.DEV_ID }}" --verbose --options=runtime --timestamp "$TARGET"
codesign --sign "${{ inputs.DEV_ID }}" --verbose --timestamp "$TARGET"
codesign -vvv --deep --strict --verbose=4 "$TARGET"
- name: Notarize the dmg
shell: bash
run: xcrun notarytool submit *.dmg --apple-id "${{ inputs.APPLE_ID }}" --password "${{ inputs.APPLE_PW }}" --team-id "${{ inputs.TEAM_ID }}" --wait

- name: Staple the notarization ticket
shell: bash
run: xcrun stapler staple *.dmg

0 comments on commit 8d91e1e

Please sign in to comment.