Lawrence ChenandLawrence Chen
02f741c32a
The AuthenticationServices WebAuthn / passkey path on Developer ID Mac apps requires com.apple.application-identifier in the codesigned entitlements blob of the calling process. AS does not fall back to the embedded provisioning profile and does not derive the app id from team-identifier + bundle-id; without that key the ceremony fails with AuthorizationError 1004. PR #2727's nightly build signed every binary inside the bundle (main app plus Contents/Resources/bin/cmux and Contents/Resources/bin/ghostty) with the same cmux.entitlements. Injecting application-identifier into that shared file and re-applying it with --deep pushed the main app's app id onto the CLI helpers, whose code identifiers are 'cmux' and 'ghostty'. That mismatch is what amfi on notarized macOS 26 Tahoe rejects with Launchd job spawn failed / errno 163. Local un-notarized Developer-ID builds survived because amfi is less strict on those. Split into two entitlements files and sign inside-out: - cmux-helper.entitlements: minimal hardened-runtime only (disable-library-validation, allow-jit, allow-unsigned-executable-memory). Used for CLI helpers, which never need app-id, WebAuthn, camera, mic, or AppleEvents. - cmux.entitlements: unchanged in the tree (shared base, no app-id). At sign time the workflow copies it and injects application-identifier and team-identifier for the bundle being built (com.cmuxterm.app for release, com.cmuxterm.app.nightly for nightly). Signing order in both workflows: 1. CLI helpers (bin/cmux, bin/ghostty) signed with cmux-helper.entitlements. 2. Main app bundle signed last with the full injected entitlements, WITHOUT --deep. --deep would overwrite the helper signatures and re-propagate the mismatch. release.yml also gains the same embedded provisioning profile step the nightly gained in #2727, so the shipped com.cmuxterm.app build is authorized to use the WebAuthn browser entitlement too. Verified locally on macOS 26.3.1: re-signed the previous broken nightly bundle using this scheme, it launches, passkey ceremony reaches ASAuthorizationController.performRequests without the 1004 error. Co-authored-by: Lawrence Chen <[email protected]>
13 lines
387 B
XML
13 lines
387 B
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>com.apple.security.cs.disable-library-validation</key>
|
|
<true/>
|
|
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
|
|
<true/>
|
|
<key>com.apple.security.cs.allow-jit</key>
|
|
<true/>
|
|
</dict>
|
|
</plist>
|