Enable runtime hardening for macOS builds

This commit is contained in:
Dominik Schmidt 2019-01-28 14:20:43 +01:00 committed by Markus Goetz
parent 6b7ac286e1
commit 3f38484470

View File

@ -6,14 +6,14 @@ src_app="$1"
identity="$2"
team_identifier="$3"
codesign -s "$identity" --force --preserve-metadata=entitlements --verbose=4 --deep "$src_app"
codesign -s "$identity" --force --preserve-metadata=entitlements --verbose=4 --options runtime --deep "$src_app"
# Verify the signature
codesign -dv $src_app
codesign --verify -v $src_app
codesign --verify -v --strict $src_app
spctl -a -t exec -vv $src_app
# Validate that the key used for signing the binary matches the expected TeamIdentifier
# needed to pass the SocketApi through the sandbox
codesign -dv $src_app 2>&1 | grep "TeamIdentifier=$team_identifier"
exit $?
exit $?