From 782aea76f95312a511cc174085de2c6dc960a283 Mon Sep 17 00:00:00 2001 From: OmikronApex Date: Fri, 10 Jul 2026 14:03:15 +0200 Subject: [PATCH 1/3] fix(nightly): preserve mac entitlements through Velopack re-sign MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vpk pack re-signs the .app; without --signEntitlements the codesign strips electron-builder's entitlements (com.apple.security.device.audio-input et al). Hardened-runtime app then gets microphone auto-denied by TCC with no prompt — root cause of silent-input nightly reports. Co-Authored-By: Claude Fable 5 --- .github/workflows/nightly.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 5bba85e..98cc7e0 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -287,6 +287,11 @@ jobs: # first, then hand vpk --notaryProfile. Do NOT pass --keychain: # notarytool defaults to the login keychain, matching vpk's own # internal notarytool call. + # --signEntitlements is mandatory: vpk re-signs the bundle, and a + # codesign without an entitlements file STRIPS the ones + # electron-builder applied (audio-input, allow-jit, ...) — the + # hardened-runtime app then gets mic access auto-denied with no + # TCC prompt. xcrun notarytool store-credentials "velopack-notary" \ --apple-id "$APPLE_ID" \ --password "$APPLE_APP_SPECIFIC_PASSWORD" \ @@ -299,6 +304,7 @@ jobs: --mainExe "$mainexe" \ -o release/velopack \ --signAppIdentity "$APPLE_SIGNING_IDENTITY" \ + --signEntitlements resources/entitlements.mac.plist \ --notaryProfile "velopack-notary" fi From 077309cf003e4dbed33ffb8d00efcbfcd7d561c3 Mon Sep 17 00:00:00 2001 From: OmikronApex Date: Fri, 10 Jul 2026 14:04:45 +0200 Subject: [PATCH 2/3] fix(build): preserve mac entitlements through Velopack re-sign Same gap as nightly.yml: vpk pack --signAppIdentity without --signEntitlements strips electron-builder's entitlements (audio-input, allow-jit, ...) from the release feed's .app. Co-Authored-By: Claude Fable 5 --- .github/workflows/build.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c4ed6b0..82e705a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -432,6 +432,11 @@ jobs: # leaving --keychain off keeps both sides pointing at the same # store. (build.keychain only holds the signing cert, which # codesign finds via the keychain search list.) + # --signEntitlements is mandatory: vpk re-signs the bundle, and a + # codesign without an entitlements file STRIPS the ones + # electron-builder applied (audio-input, allow-jit, ...) — the + # hardened-runtime app then gets mic access auto-denied with no + # TCC prompt. xcrun notarytool store-credentials "velopack-notary" \ --apple-id "$APPLE_ID" \ --password "$APPLE_APP_SPECIFIC_PASSWORD" \ @@ -444,6 +449,7 @@ jobs: --mainExe "$mainexe" \ -o release/velopack \ --signAppIdentity "$APPLE_SIGNING_IDENTITY" \ + --signEntitlements resources/entitlements.mac.plist \ --notaryProfile "velopack-notary" fi From 1046b71f34e783081ce11107e12b25215d8a7d4a Mon Sep 17 00:00:00 2001 From: OmikronApex Date: Fri, 10 Jul 2026 14:18:47 +0200 Subject: [PATCH 3/3] fix(ci): anchor --signEntitlements path with $PWD vpk signing docs recommend absolute paths; relative path breaks if vpk changes cwd internally. CodeRabbit review nit on #93. Co-Authored-By: Claude Fable 5 --- .github/workflows/build.yml | 2 +- .github/workflows/nightly.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 82e705a..588bfbe 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -449,7 +449,7 @@ jobs: --mainExe "$mainexe" \ -o release/velopack \ --signAppIdentity "$APPLE_SIGNING_IDENTITY" \ - --signEntitlements resources/entitlements.mac.plist \ + --signEntitlements "$PWD/resources/entitlements.mac.plist" \ --notaryProfile "velopack-notary" fi diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 98cc7e0..999243b 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -304,7 +304,7 @@ jobs: --mainExe "$mainexe" \ -o release/velopack \ --signAppIdentity "$APPLE_SIGNING_IDENTITY" \ - --signEntitlements resources/entitlements.mac.plist \ + --signEntitlements "$PWD/resources/entitlements.mac.plist" \ --notaryProfile "velopack-notary" fi