From bd20988fa0625028d391660bb100ae6879c40d33 Mon Sep 17 00:00:00 2001
From: hariel1985 <ariel.hartung@gmail.com>
Date: Fri, 26 Jun 2026 13:41:51 +0200
Subject: [PATCH] Add cs.allow-jit entitlement for whisper.cpp Metal backend

The bundled whisper-cli / ggml dylibs JIT-compile Metal shaders at
runtime; under the hardened runtime that needs com.apple.security.cs.allow-jit
or the process gets killed. Completes the entitlement set for the
notarized Developer ID build (alongside device.audio-input).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 macos/WhisperDictate.entitlements | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/macos/WhisperDictate.entitlements b/macos/WhisperDictate.entitlements
index d6f9fed..cbd6748 100644
--- a/macos/WhisperDictate.entitlements
+++ b/macos/WhisperDictate.entitlements
@@ -19,5 +19,10 @@
 	     on any Developer ID / notarized build. -->
 	<key>com.apple.security.device.audio-input</key>
 	<true/>
+	<!-- whisper.cpp's Metal/ggml backend generates code at runtime; the
+	     hardened runtime needs allow-jit so the bundled whisper-cli/dylibs
+	     don't get killed for JIT. -->
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
 </dict>
 </plist>