From b0533f85f0fb061846b54e93d05e716548b61f46 Mon Sep 17 00:00:00 2001
From: hariel1985 <ariel.hartung@gmail.com>
Date: Fri, 5 Jun 2026 21:28:29 +0200
Subject: [PATCH] Add entitlements for Developer ID signing + notarization

WhisperDictate.entitlements: non-sandboxed hardened-runtime entitlements
(app-sandbox=false; cs.disable-library-validation for the bundled whisper-cli
+ ggml/whisper dylibs). Used to deep-sign the app with the company Developer ID
identity before notarization. Also ignore the stray Contents/CodeResources
signing artifact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitignore                        |  1 +
 macos/WhisperDictate.entitlements | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 macos/WhisperDictate.entitlements

diff --git a/.gitignore b/.gitignore
index 542ac53..c1e94a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@ macos/build/
 macos/WhisperDictate.app/Contents/MacOS/
 macos/WhisperDictate.app/Contents/Frameworks/
 macos/WhisperDictate.app/Contents/_CodeSignature/
+macos/WhisperDictate.app/Contents/CodeResources
 WhisperDictate
 *.o
 *.dSYM/
diff --git a/macos/WhisperDictate.entitlements b/macos/WhisperDictate.entitlements
new file mode 100644
index 0000000..8454dbf
--- /dev/null
+++ b/macos/WhisperDictate.entitlements
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- Not sandboxed: WhisperDictate uses global Accessibility / synthetic
+	     keystrokes and spawns a bundled CLI, which the App Sandbox forbids.
+	     Distributed via Developer ID, not the Mac App Store. -->
+	<key>com.apple.security.app-sandbox</key>
+	<false/>
+	<!-- The app bundles whisper-cli + ggml/whisper dylibs in the app. Disabling
+	     library validation lets the process tree load them without tripping the
+	     hardened runtime's same-Team-ID check. -->
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>