From cfe4d647b4d7cc1ae41d7e193d45d546ae15b244 Mon Sep 17 00:00:00 2001
From: Ariver <shanghai3168@gmail.com>
Date: Fri, 05 Jun 2026 02:18:56 +0800
Subject: [PATCH] Sign Mac App Store app identifier entitlement
---
privatevoice.src/app.go | 2 +-
privatevoice.src/scripts/build-macappstore-pkg-macos.sh | 35 +++++++++++++++++++++++++++++++----
privatevoice.src/build/darwin/Info.plist | 2 +-
3 files changed, 33 insertions(+), 6 deletions(-)
diff --git a/privatevoice.src/app.go b/privatevoice.src/app.go
index 6065049..05a781a 100755
--- a/privatevoice.src/app.go
+++ b/privatevoice.src/app.go
@@ -28,7 +28,7 @@
const (
appVersion = "2.1.28"
- appBuild = "20260604.2353"
+ appBuild = "20260605.0216"
appDisplayVersion = appVersion + " (build " + appBuild + ")"
appName = "PrivateVoice Dictation"
diff --git a/privatevoice.src/build/darwin/Info.plist b/privatevoice.src/build/darwin/Info.plist
index e270d77..cb55672 100755
--- a/privatevoice.src/build/darwin/Info.plist
+++ b/privatevoice.src/build/darwin/Info.plist
@@ -19,7 +19,7 @@
<key>CFBundleShortVersionString</key>
<string>2.1.28</string>
<key>CFBundleVersion</key>
- <string>20260604.2353</string>
+ <string>20260605.0216</string>
<key>LSApplicationCategoryType</key>
<string>public.app-category.productivity</string>
<key>LSMinimumSystemVersion</key>
diff --git a/privatevoice.src/scripts/build-macappstore-pkg-macos.sh b/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
index bcac3de..888f559 100755
--- a/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
+++ b/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
@@ -41,7 +41,7 @@
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
INFO_PLIST="$PROJECT_DIR/build/darwin/Info.plist"
-ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements-appstore.plist"
+BASE_ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements-appstore.plist"
GOMODCACHE="$(go env GOMODCACHE)"
SHERPA_MACOS_MODULE_VERSION="$(cd "$PROJECT_DIR" && go list -m -f '{{.Version}}' github.com/k2-fsa/sherpa-onnx-go-macos)"
@@ -116,9 +116,17 @@
codesign --force \
--options runtime \
--timestamp \
- --entitlements "$ENTITLEMENTS" \
+ --entitlements "$SIGNING_ENTITLEMENTS" \
--sign "$APPSTORE_APP_IDENTITY" \
"$item"
+}
+
+plist_set_string() {
+ local plist="$1"
+ local key="$2"
+ local value="$3"
+ /usr/libexec/PlistBuddy -c "Delete :$key" "$plist" >/dev/null 2>&1 || true
+ /usr/libexec/PlistBuddy -c "Add :$key string $value" "$plist"
}
TARGET_ARCH="${1:-$(uname -m)}"
@@ -131,7 +139,7 @@
[[ -f "$APPSTORE_PROVISIONING_PROFILE" ]] || fail "Provisioning profile not found: $APPSTORE_PROVISIONING_PROFILE"
[[ -f "$INFO_PLIST" ]] || fail "Info.plist not found at $INFO_PLIST"
[[ -n "$BUNDLE_ID" ]] || fail "CFBundleIdentifier is missing from $INFO_PLIST"
-[[ -f "$ENTITLEMENTS" ]] || fail "App Store entitlements not found at $ENTITLEMENTS"
+[[ -f "$BASE_ENTITLEMENTS" ]] || fail "App Store entitlements not found at $BASE_ENTITLEMENTS"
[[ -f "$PROJECT_DIR/build/darwin/icon.icns" ]] || fail "icon.icns not found"
[[ -d "$SHERPA_LIB_DIR" ]] || fail "sherpa-onnx dylibs not found at $SHERPA_LIB_DIR"
ONNXRUNTIME_DYLIB="$(find "$SHERPA_LIB_DIR" -maxdepth 1 -type f -name 'libonnxruntime.*.dylib' | sort | tail -n 1)"
@@ -145,13 +153,26 @@
command -v pkgutil >/dev/null || fail "pkgutil not found"
PROFILE_PLIST="$(mktemp)"
-trap 'rm -f "$PROFILE_PLIST"' EXIT
+SIGNING_ENTITLEMENTS="$(mktemp)"
+trap 'rm -f "$PROFILE_PLIST" "$SIGNING_ENTITLEMENTS"' EXIT
security cms -D -i "$APPSTORE_PROVISIONING_PROFILE" >"$PROFILE_PLIST" ||
fail "Unable to decode provisioning profile: $APPSTORE_PROVISIONING_PROFILE"
PROFILE_APP_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.application-identifier" "$PROFILE_PLIST" 2>/dev/null || true)"
+PROFILE_TEAM_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.developer.team-identifier" "$PROFILE_PLIST" 2>/dev/null || true)"
+PROFILE_KEYCHAIN_GROUP="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:keychain-access-groups:0" "$PROFILE_PLIST" 2>/dev/null || true)"
PROFILE_BUNDLE_ID="${PROFILE_APP_IDENTIFIER#*.}"
[[ "$PROFILE_BUNDLE_ID" == "$BUNDLE_ID" ]] ||
fail "Provisioning profile bundle ID mismatch: profile has $PROFILE_BUNDLE_ID, app has $BUNDLE_ID"
+[[ -n "$PROFILE_TEAM_IDENTIFIER" ]] || fail "Provisioning profile missing com.apple.developer.team-identifier entitlement"
+
+cp "$BASE_ENTITLEMENTS" "$SIGNING_ENTITLEMENTS"
+plist_set_string "$SIGNING_ENTITLEMENTS" "com.apple.application-identifier" "$PROFILE_APP_IDENTIFIER"
+plist_set_string "$SIGNING_ENTITLEMENTS" "com.apple.developer.team-identifier" "$PROFILE_TEAM_IDENTIFIER"
+if [[ -n "$PROFILE_KEYCHAIN_GROUP" ]]; then
+ /usr/libexec/PlistBuddy -c "Delete :keychain-access-groups" "$SIGNING_ENTITLEMENTS" >/dev/null 2>&1 || true
+ /usr/libexec/PlistBuddy -c "Add :keychain-access-groups array" "$SIGNING_ENTITLEMENTS"
+ /usr/libexec/PlistBuddy -c "Add :keychain-access-groups:0 string $PROFILE_KEYCHAIN_GROUP" "$SIGNING_ENTITLEMENTS"
+fi
step "Cleaning old Mac App Store build"
rm -rf "$BUILD_DIR"
@@ -206,6 +227,12 @@
step "Verifying app signature and entitlements"
codesign -vvv --deep --strict "$APP_BUNDLE"
codesign -d --entitlements :- "$APP_BUNDLE"
+SIGNED_ENTITLEMENTS="$(mktemp)"
+codesign -d --entitlements :- "$APP_BUNDLE" >"$SIGNED_ENTITLEMENTS" 2>/dev/null
+SIGNED_APP_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :com.apple.application-identifier" "$SIGNED_ENTITLEMENTS" 2>/dev/null || true)"
+rm -f "$SIGNED_ENTITLEMENTS"
+[[ "$SIGNED_APP_IDENTIFIER" == "$PROFILE_APP_IDENTIFIER" ]] ||
+ fail "Signed app application-identifier mismatch: signed has $SIGNED_APP_IDENTIFIER, profile has $PROFILE_APP_IDENTIFIER"
step "Creating signed installer package"
productbuild \
--
Gitblit v1.9.3