hammer-editor/desktop/runtime-entitlements.plist
Wavesonics 5c4da8909c Add Mac App Store packaging for the desktop module
Pass -PmacOsAppStoreRelease=true -PbuildNumber=N to produce a sandboxed,
signed .pkg ready for TestFlight upload via Transporter / iTMSTransporter.
Apple Silicon only for v1; JBR runtime stays.

- Sandbox-friendly entitlements (network.client + user-selected files
  for the app; JIT/unsigned-mem/disable-library-validation for the JVM).
- JNA libjnidispatch.jnilib is pre-extracted into desktop/resources/macos/
  and located via -Djna.boot.library.path so JNA never tries to extract
  to a temp dir at runtime (which would hang silently in the sandbox).
- com.apple.application-identifier / team-identifier baked into the app
  signature so it matches the embedded provisioning profile.
- UrlLauncher drops the Runtime.exec("open") fallback in favor of the
  Desktop API only.
- Projects-directory picker is hidden in App Store builds; the sandbox
  container's ~/Documents is the only writable location for v1.
- unquarantineMacApp Gradle task strips com.apple.quarantine xattrs
  before pkg packaging to avoid App Store validation errors.
- New helper: desktop/scripts/build-appstore.sh — pre-flight checks,
  one-shot build, codesign + pkgutil signature verification.

Signing assets and API key live in desktop/{embedded,runtime}.provisionprofile
and desktop/secrets/ (both gitignored).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-19 17:46:07 -07:00

16 lines
515 B
Text

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
</dict>
</plist>