six-degrees 0.7.0 → 1.0.0

package/.next/standalone/scripts/build-app.mjs

@@ -21,10 +21,15 @@
 // Chromium instead would make the scanner MORE detectable, not less, which
 // defeats the point of driving the user's real browser.
 //
-// Unsigned, because notarisation needs a paid Apple Developer account. macOS
-// will refuse the first launch; the user allows it once in System Settings.
-// An ad-hoc signature is applied anyway — it costs nothing and avoids the
-// separate "app is damaged" failure that unsigned arm64 binaries otherwise hit.
+// Signing (DESKTOP.md D4, scripts/mac-sign.mjs). With a Developer ID identity
+// in SIX_DEGREES_SIGN_IDENTITY, every program and library is signed inside out
+// with the hardened runtime, and with SIX_DEGREES_NOTARY_KEY, _KEY_ID and
+// _ISSUER the app and the disk image are notarized by Apple and stapled: it
+// opens like any Mac app. Releases do this (release.yml). Without an identity
+// (forks, pull requests, a local build) the app is signed ad hoc, exactly as
+// before D4: it costs nothing and avoids the separate "app is damaged" failure
+// that unsigned arm64 binaries otherwise hit, and a copy downloaded in a
+// browser then needs one approval in System Settings.
 
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -38,6 +43,9 @@ import { fileURLToPath } from 'node:url';
 import {
   standaloneBuild, downloadVerified, machoSlices, machoSlice, megabytes, IMPORTS,
 } from '../lib/scanner-python.js';
+import {
+  signingSetup, signDeveloperId, signatureInfo, signerName, signImage, notarize, staple, stapleValid, assess, SigningError,
+} from './mac-sign.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
@@ -53,6 +61,16 @@ if (!['classic', 'electron'].includes(SHELL)) {
   console.error(`\n  ✗ --shell must be classic or electron, not ${SHELL}\n`);
   process.exit(1);
 }
+// How this build is signed: ad hoc, or Developer ID (and notarized) when the
+// environment names an identity (scripts/mac-sign.mjs). A setting that can't be
+// right stops the build here, before anything is built.
+const SIGNING = signingSetup(process.env, { exists: existsSync });
+if (SIGNING.error) {
+  console.error(`\n  ✗ ${SIGNING.error}\n`);
+  process.exit(1);
+}
+const DEVELOPER_ID = SIGNING.mode === 'developer-id';
+const NOTARIZE = Boolean(DEVELOPER_ID && SIGNING.notary);
 const APP_NAME = 'Six Degrees';
 const OUT = path.join(ROOT, 'dist');
 const APP = path.join(OUT, `${APP_NAME}.app`);
@@ -115,6 +133,9 @@ function detach(mountPoint, device) {
 rmSync(OUT, { recursive: true, force: true });
 
 step('Building the app');
+console.log(DEVELOPER_ID
+  ? `  it will be signed with Developer ID${NOTARIZE ? ' and notarized by Apple' : ', not notarized (no SIX_DEGREES_NOTARY_* settings)'}`
+  : '  it will be signed ad hoc (no SIX_DEGREES_SIGN_IDENTITY)');
 if (process.argv.includes('--fast') && existsSync(path.join(ROOT, '.next', 'standalone', 'server.js'))) {
   console.log('  --fast: reusing the existing build (make sure it is current)');
 } else {
@@ -290,7 +311,10 @@ writeFileSync(path.join(APP, 'Contents', 'Info.plist'), `<?xml version="1.0" enc
 </plist>
 `);
 
-// ---- 4. sign, ad-hoc -------------------------------------------------------
+// ---- 4. sign ---------------------------------------------------------------
+if (DEVELOPER_ID) {
+  signWithDeveloperId(APP);
+} else {
 step('Signing (ad-hoc)');
 try {
   run('codesign', ['--force', '--deep', '--sign', '-', APP]);
@@ -298,6 +322,7 @@ try {
 } catch {
   console.log('  codesign failed; the app will still run after the one-time approval');
 }
+}
 } // end of the classic shell
 
 // ---- the Electron shell (--shell=electron) -----------------------------------
@@ -348,6 +373,10 @@ async function buildElectronShell() {
   // and nothing copies them again (TRAPS §37).
   await bundlePython(path.join(APP, 'Contents', 'Resources'));
 
+  if (DEVELOPER_ID) {
+    signWithDeveloperId(APP);
+    return;
+  }
   step('Signing (ad-hoc)');
   // Electron's framework and helpers must all carry the same kind of signature,
   // or macOS refuses to load them; re-signing the whole bundle ad hoc does that.
@@ -359,6 +388,96 @@ async function buildElectronShell() {
   console.log('  signed ad-hoc and verified — no Apple account needed, still unnotarised');
 }
 
+// ---- Developer ID and notarization (DESKTOP.md D4) ----------------------------
+// Inside out with the hardened runtime (scripts/mac-sign.mjs signDeveloperId:
+// every loose program and library, then the helper apps and frameworks deepest
+// first, then the app), then the signed programs are run once to prove their
+// entitlements are enough. With the notary settings, the app goes to Apple and
+// comes back with its ticket stapled to it, and only then is the disk image made
+// from it: the app people drag to Applications carries its own ticket, and so
+// does the copy install.sh and the in-app updater put in place with ditto.
+function signWithDeveloperId(app) {
+  step('Signing with Developer ID (inside out, hardened runtime, timestamped)');
+  const { info } = guard(() => signDeveloperId(app, SIGNING));
+  checkSignedRuntime(app, info);
+  if (!NOTARIZE) return;
+  step('Notarizing the app (Apple; usually a few minutes)');
+  const zip = path.join(OUT, 'notarize-app.zip');
+  run('ditto', ['-c', '-k', '--sequesterRsrc', '--keepParent', app, zip]);
+  guard(() => notarize(zip, SIGNING.notary, { what: 'the app' }));
+  rmSync(zip, { force: true });
+  guard(() => staple(app));
+  const verdict = assess(app, 'exec');
+  if (!verdict.ok && !verdict.disabled) fail(`Gatekeeper doesn't accept the stapled app as notarized: ${oneLine(verdict.text)}`);
+  console.log(verdict.ok ? `  stapled; Gatekeeper says: ${verdict.source}` : gatekeeperOff());
+}
+
+// The signed programs, run as the app runs them: the server's Node (and sharp,
+// the one native module it loads), the scanner's Python with its packages, and
+// Playwright's driver. A missing entitlement or a library that fails library
+// validation stops the build here, minutes before notarization would, and long
+// before a user's scan. Nothing here writes into the app (no bytecode: -B and
+// PYTHONDONTWRITEBYTECODE), which the image check would catch anyway.
+function checkSignedRuntime(app, info) {
+  step('Running the signed programs under the hardened runtime');
+  if (!info.team) {
+    // A self-signed test identity has no Team ID, and library validation then
+    // refuses even the app's own libraries. A Developer ID always has one.
+    console.log('  skipped: this identity has no Team ID (a test identity, not a Developer ID)');
+    return;
+  }
+  const res = path.join(app, 'Contents', 'Resources');
+  const env = {
+    HOME: os.homedir(), TMPDIR: os.tmpdir(), PATH: '/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'en_US.UTF-8',
+    PYTHONNOUSERSITE: '1', PYTHONDONTWRITEBYTECODE: '1',
+  };
+  const server = [path.join(res, 'server'), path.join(res, 'app')].find((d) => existsSync(path.join(d, 'server.js')));
+  const sharp = server && existsSync(path.join(server, 'node_modules', 'sharp')) ? path.join(server, 'node_modules', 'sharp') : null;
+  console.log(`  the server's Node: ${mustRun(path.join(res, 'node'), ['-e',
+    `require('node:sqlite');${sharp ? ` require(${JSON.stringify(sharp)});` : ''} console.log(process.version${sharp ? ", '· sharp loads'" : ''})`],
+  env, 'The app\'s Node doesn\'t run once signed (its entitlements: scripts/entitlements/node.plist)')}`);
+  const py = path.join(res, 'python');
+  if (!existsSync(path.join(py, 'bin', 'python3'))) return;
+  console.log(`  the scanner's Python: ${mustRun(path.join(py, 'bin', 'python3'), ['-E', '-s', '-B', '-c',
+    `${IMPORTS}; import sys; print(sys.version.split()[0], "· its packages load")`],
+  env, 'The scanner\'s Python doesn\'t run once signed')}`);
+  const xy = readdirSync(path.join(py, 'lib')).find((n) => /^python3\.\d+$/.test(n));
+  const driver = path.join(py, 'lib', xy || 'python3', 'site-packages', 'playwright', 'driver');
+  if (existsSync(path.join(driver, 'node'))) {
+    console.log(`  Playwright's driver: ${mustRun(path.join(driver, 'node'), [path.join(driver, 'package', 'cli.js'), '--version'],
+      env, 'Playwright\'s driver doesn\'t start once signed')}`);
+  }
+}
+
+// A step of the signing that failed: its reason, never a credential (mac-sign.mjs
+// never puts one in a message), and the build stops.
+function guard(fn) {
+  try {
+    return fn();
+  } catch (err) {
+    fail(err instanceof SigningError ? err.message : `Signing failed: ${String(err.message || err).split('\n')[0]}`);
+  }
+  return undefined;
+}
+
+function fail(message) {
+  console.error(`\n  ✗ ${message}\n`);
+  process.exit(1);
+}
+
+// When this machine has Gatekeeper's assessments turned off, spctl accepts
+// anything and can't confirm notarization; Apple's "Accepted" and the stapled
+// tickets (validated) are what's left, and the log says so.
+function gatekeeperOff() {
+  return '  stapled; Gatekeeper\'s assessments are turned off on this machine, so it can\'t be asked: '
+    + 'the stapled tickets and Apple\'s Accepted are the check';
+}
+
+// (Function declarations, not consts: the shells call these before this line runs.)
+function oneLine(text) {
+  return String(text || '').trim().split('\n').join(' | ');
+}
+
 // ---- the scanner's Python (Electron app only; DESKTOP.md D2) ------------------
 // A standalone CPython from python-build-standalone, with the scanner's packages
 // installed, at Contents/Resources/python. desktop/main.mjs names it to the
@@ -602,9 +721,11 @@ mkdirSync(staging, { recursive: true });
 // on the build machine: anywhere else those paths do not exist (TRAPS §37).
 run('ditto', [APP, path.join(staging, `${APP_NAME}.app`)]);
 
-// The picture behind the window says what to do: drag across, then the one-time
-// Open Anyway step, since the app is unsigned. It replaces the READ ME text file
-// this image used to carry. Made by scripts/make-dmg-background.mjs from
+// The picture behind the window says what to do: drag across, and that the app
+// is signed and notarized, so it opens like any Mac app (it said Open Anyway
+// until D4). It replaces the READ ME text file this image used to carry. A build
+// signed ad hoc gets the same picture: it never left this Mac, so macOS doesn't
+// ask about it either. Made by scripts/make-dmg-background.mjs from
 // scripts/dmg/background.html; its geometry and the positions below are one
 // layout, so change them together.
 const BACKGROUND = path.join(ROOT, 'scripts', 'dmg', 'background.tiff');
@@ -742,6 +863,21 @@ detach(mount, device);
 run('hdiutil', ['convert', rw, '-format', 'UDZO', '-imagekey', 'zlib-level=9', '-o', dmg, '-ov']);
 rmSync(rw, { force: true });
 rmSync(staging, { recursive: true, force: true });
+
+// The image gets its own signature and ticket (DESKTOP.md D4): Gatekeeper judges
+// a downloaded .dmg by them before it looks at the app inside. Made from the
+// stapled app, so the app keeps its own ticket once it is copied out.
+if (DEVELOPER_ID) {
+  step('Signing the disk image');
+  guard(() => signImage(dmg, SIGNING));
+  console.log('  signed and verified');
+  if (NOTARIZE) {
+    step('Notarizing the disk image (Apple; usually a few minutes)');
+    guard(() => notarize(dmg, SIGNING.notary, { what: 'the disk image' }));
+    guard(() => staple(dmg));
+    console.log('  stapled');
+  }
+}
 checkImage(dmg);
 
 // Check the app as people will get it: inside the finished image, not the copy
@@ -763,6 +899,12 @@ function checkImage(image) {
     } catch (err) {
       problem = `its signature does not verify: ${(err.stderr || '').toString().trim().split('\n').slice(0, 2).join(' ')}`;
     }
+    // Notarized: the app inside carries its ticket, and Gatekeeper accepts it.
+    if (NOTARIZE && !problem) {
+      const verdict = assess(inside, 'exec');
+      if (!stapleValid(inside)) problem = 'it has no valid stapled notarization ticket';
+      else if (!verdict.ok && !verdict.disabled) problem = `Gatekeeper doesn't accept it as notarized (${oneLine(verdict.text)})`;
+    }
     const escaping = execFileSync('find', [inside, '-type', 'l'])
       .toString().split('\n').filter(Boolean)
       .filter((link) => {
@@ -778,10 +920,24 @@ function checkImage(image) {
     console.error(`\n  ✗ The app inside ${path.basename(image)} is broken: ${problem}\n`);
     process.exit(1);
   }
-  console.log('  signature verifies, and every link stays inside the app');
+  // And the image itself, as Gatekeeper judges a downloaded one: by its own
+  // signature (context:primary-signature) and its own ticket.
+  if (NOTARIZE) {
+    const verdict = assess(image, 'open');
+    if (!stapleValid(image)) fail(`${path.basename(image)} has no valid stapled notarization ticket.`);
+    if (!verdict.ok && !verdict.disabled) fail(`Gatekeeper doesn't accept ${path.basename(image)} as notarized: ${oneLine(verdict.text)}`);
+    if (verdict.disabled) console.log(gatekeeperOff());
+  }
+  console.log(`  signature verifies, and every link stays inside the app${NOTARIZE ? '; the app and the image are notarized and stapled, and Gatekeeper accepts both' : ''}`);
 }
 
 const size = execFileSync('du', ['-h', dmg]).toString().split('\t')[0];
 console.log(`\n✓ ${dmg}  (${size})\n`);
-console.log('  Unsigned by design: notarisation needs a paid Apple account.');
-console.log('  First launch needs one approval in System Settings > Privacy & Security.\n');
+if (DEVELOPER_ID) {
+  const who = signerName(signatureInfo(APP).authority) || 'this Developer ID';
+  if (NOTARIZE) console.log(`  Signed by ${who} and notarized by Apple: it opens like any Mac app.\n`);
+  else console.log(`  Signed by ${who}, not notarized: a copy downloaded in a browser still needs one approval\n  in System Settings > Privacy & Security.\n`);
+} else {
+  console.log('  Signed ad hoc (no Developer ID here: SIX_DEGREES_SIGN_IDENTITY). A copy downloaded in a browser');
+  console.log('  needs one approval in System Settings > Privacy & Security.\n');
+}

package/.next/standalone/scripts/build-desktop.mjs

@@ -14,8 +14,9 @@
 //            Menu and Desktop shortcuts. No admin rights asked for.
 //   Linux    @electron/packager, then a .deb (chrome-sandbox setuid root, which
 //            Electron needs on Ubuntu 24.04 and later) and a plain .tar.gz.
-// Unsigned, like the Mac app until D4: Windows shows SmartScreen's "More info →
-// Run anyway" the first time.
+// Unsigned (the Mac app is signed and notarized since D4; Windows signing is
+// D4's other half): Windows shows SmartScreen's "More info → Run anyway" the
+// first time.
 //
 // Built on the platform it is for (release.yml has a job each): pip installs
 // the Python's packages by running that Python. No new npm dependency: packager

package/.next/standalone/scripts/ci-mac-signing.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+# The Mac release's Developer ID, for .github/workflows/release.yml's Mac jobs
+# (docs/brain/DESKTOP.md D4). Two commands:
+#
+#   ci-mac-signing.sh setup VERSION DRY_RUN    before the build
+#   ci-mac-signing.sh cleanup                  after it, always (if: always())
+#
+# setup asks scripts/mac-sign.mjs whether this release signs (release-plan):
+#   - all five secrets set: it signs, dry run or not;
+#   - none set: ad hoc, as before 1.0, unless this is a real release of 1.0.0 or
+#     later, which must be signed: then it fails here, before anything is built;
+#   - some but not all: always a mistake, and it fails, naming the missing ones.
+# When it signs, it decodes the certificate (.p12, which carries Apple's
+# Developer ID G2 intermediate too) into a temporary keychain with a random
+# password, finds the "Developer ID Application" identity in it, decodes the App
+# Store Connect API key (.p8) for notarytool, and hands the build their places
+# through $GITHUB_ENV: SIX_DEGREES_SIGN_IDENTITY (the identity's SHA-1: names
+# can repeat across renewals, a hash can't), SIX_DEGREES_SIGN_KEYCHAIN and
+# SIX_DEGREES_NOTARY_KEY. The key's id and issuer reach the build step straight
+# from the secrets (release.yml), never through a file. MAC_SIGNING says which
+# it was (developer-id or ad-hoc), for the smoke test and the release notes.
+#
+# The secrets arrive as environment variables, set by release.yml from GitHub's
+# secrets and nowhere else. Nothing here prints one: values go to files made
+# under umask 077, or to `security` itself, and GitHub masks them in the log
+# besides. Never run this with `bash -x`. cleanup deletes the keychain, puts the
+# keychain search list back as it was, and removes every decoded file.
+
+set -euo pipefail
+
+work="${RUNNER_TEMP:?RUNNER_TEMP is not set (this runs in GitHub Actions)}/six-degrees-signing"
+keychain="$work/signing.keychain-db"
+here="$(cd "$(dirname "$0")" && pwd)"
+
+say() { printf '%s\n' "$*"; }
+die() { printf '::error::%s\n' "$*"; exit 1; }
+
+setup() {
+  local version="${1:?usage: ci-mac-signing.sh setup VERSION DRY_RUN}" dry_run="${2:-false}" plan
+  local genv="${GITHUB_ENV:?GITHUB_ENV is not set}"
+  # release-plan reads only whether each secret is set, never a value.
+  if ! plan="$(node "$here/mac-sign.mjs" release-plan "$version" "$dry_run")"; then
+    die "The Mac app can't be built as asked: see the line above."
+  fi
+  if [ "$plan" != developer-id ]; then
+    echo "MAC_SIGNING=ad-hoc" >> "$genv"
+    say "Signing: ad hoc."
+    return 0
+  fi
+
+  umask 077
+  rm -rf "$work"
+  mkdir -p "$work"
+
+  # The certificate, for the keychain only; its file goes as soon as it's in.
+  printf '%s' "$MACOS_SIGN_P12_BASE64" | base64 --decode > "$work/cert.p12" 2>/dev/null \
+    || die "MACOS_SIGN_P12_BASE64 isn't base64 (set it again with scripts/set-signing-secrets.sh)."
+  [ -s "$work/cert.p12" ] || die "MACOS_SIGN_P12_BASE64 decodes to nothing."
+  # The API key, for notarytool, kept until cleanup.
+  printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$work/AuthKey.p8" 2>/dev/null \
+    || die "APPLE_API_KEY_P8_BASE64 isn't base64 (set it again with scripts/set-signing-secrets.sh)."
+  grep -q -- '-----BEGIN PRIVATE KEY-----' "$work/AuthKey.p8" \
+    || die "APPLE_API_KEY_P8_BASE64 doesn't decode to an App Store Connect API key (.p8)."
+
+  # A keychain of its own, with a password nobody needs to know, unlocked for
+  # the length of the job (6 hours), and codesign allowed to use the key without
+  # asking (the partition list): there is nobody to click Allow on a runner.
+  local kc_pass
+  kc_pass="$(head -c 32 /dev/urandom | base64 | tr -d '\n=+/')"
+  security create-keychain -p "$kc_pass" "$keychain"
+  security set-keychain-settings -lut 21600 "$keychain"
+  security unlock-keychain -p "$kc_pass" "$keychain"
+  security import "$work/cert.p12" -k "$keychain" -f pkcs12 -P "$MACOS_SIGN_P12_PASSWORD" \
+    -T /usr/bin/codesign -T /usr/bin/security > /dev/null \
+    || die "The certificate wouldn't import: is MACOS_SIGN_P12_PASSWORD the .p12's password?"
+  rm -f "$work/cert.p12"
+  security set-key-partition-list -S apple-tool:,apple: -s -k "$kc_pass" "$keychain" > /dev/null
+  kc_pass=""
+
+  # codesign finds an identity only in a keychain on the search list. The list as
+  # it was is kept, for cleanup to put back.
+  security list-keychains -d user > "$work/search-list"
+  local line orig=()
+  while IFS= read -r line; do
+    line="${line#"${line%%[![:space:]]*}"}"; line="${line%\"}"; line="${line#\"}"
+    [ -n "$line" ] && orig+=("$line")
+  done < "$work/search-list"
+  security list-keychains -d user -s "$keychain" ${orig[@]+"${orig[@]}"}
+
+  # By its kind, not its full name: whatever Developer ID Application identity
+  # the certificate holds, and it must be valid (its chain reaches Apple's root).
+  local found identity name
+  found="$(security find-identity -v -p codesigning "$keychain" | grep '"Developer ID Application: ' | head -1 || true)"
+  identity="$(printf '%s\n' "$found" | awk '{print $2}')"
+  name="$(printf '%s\n' "$found" | sed -n 's/.*"\(Developer ID Application: [^"]*\)".*/\1/p')"
+  if [ -z "$identity" ]; then
+    say "The keychain holds these code-signing identities (valid or not):"
+    security find-identity -p codesigning "$keychain" | sed 's/^/  /'
+    die "No valid \"Developer ID Application\" identity in MACOS_SIGN_P12_BASE64. Export the Developer ID Application certificate with its private key (and Apple's intermediate) as the .p12."
+  fi
+  {
+    echo "SIX_DEGREES_SIGN_IDENTITY=$identity"
+    echo "SIX_DEGREES_SIGN_KEYCHAIN=$keychain"
+    echo "SIX_DEGREES_NOTARY_KEY=$work/AuthKey.p8"
+    echo "MAC_SIGNING=developer-id"
+  } >> "$genv"
+  say "Signing: $name, from a temporary keychain; notarized with the App Store Connect API key."
+}
+
+cleanup() {
+  if [ -f "$work/search-list" ]; then
+    local line orig=()
+    while IFS= read -r line; do
+      line="${line#"${line%%[![:space:]]*}"}"; line="${line%\"}"; line="${line#\"}"
+      [ -n "$line" ] && orig+=("$line")
+    done < "$work/search-list"
+    security list-keychains -d user -s ${orig[@]+"${orig[@]}"} || true
+  fi
+  if [ -e "$keychain" ]; then security delete-keychain "$keychain" || true; fi
+  rm -rf "$work"
+  say "Signing: cleaned up (no keychain, key or certificate left)."
+}
+
+case "${1:-}" in
+  setup)   shift; setup "$@" ;;
+  cleanup) cleanup ;;
+  *)       echo "usage: ci-mac-signing.sh setup VERSION DRY_RUN | cleanup" >&2; exit 2 ;;
+esac

package/.next/standalone/scripts/entitlements/electron.plist

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  Six Degrees.app and its Electron helper apps (GPU, Renderer, Plugin), signed
+  with Developer ID and the hardened runtime (scripts/mac-sign.mjs, DESKTOP.md D4).
+
+  allow-jit                          V8 compiles JavaScript as it runs; the hardened
+                                     runtime refuses that without it.
+  allow-unsigned-executable-memory   what V8 still uses where it can't use MAP_JIT
+                                     (Intel Macs). Discord's and Electron's own
+                                     templates carry the same two.
+
+  Never disable-library-validation: every library the app loads is signed by the
+  same team in the same pass, and it loads nothing from outside itself.
+-->
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>

package/.next/standalone/scripts/entitlements/node.plist

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  The Node inside the app (Contents/Resources/node), which runs the server, and
+  Playwright's driver's Node when it isn't a link to that one. Signed with
+  Developer ID and the hardened runtime (scripts/mac-sign.mjs, DESKTOP.md D4).
+
+  allow-jit                          V8 compiles JavaScript as it runs. Without it
+                                     Node 24 stops before running anything: "Failed
+                                     to reserve virtual memory for CodeRange"
+                                     (checked on this build's Node, 2026-10-04).
+  allow-unsigned-executable-memory   what V8 still uses where it can't use MAP_JIT
+                                     (Intel Macs). Node's own release signature
+                                     carries both.
+
+  Never disable-library-validation, which Node's own signature does carry so that
+  anyone's native addons load: the only native code this server loads is the
+  app's own (sharp and its libvips), signed by the same team in the same pass.
+-->
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>