bd20988fa0
The bundled whisper-cli / ggml dylibs JIT-compile Metal shaders at runtime; under the hardened runtime that needs com.apple.security.cs.allow-jit or the process gets killed. Completes the entitlement set for the notarized Developer ID build (alongside device.audio-input). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 sor
1.3 KiB
XML
29 sor
1.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Not sandboxed: WhisperDictate uses global Accessibility / synthetic
|
|
keystrokes and spawns a bundled CLI, which the App Sandbox forbids.
|
|
Distributed via Developer ID, not the Mac App Store. -->
|
|
<key>com.apple.security.app-sandbox</key>
|
|
<false/>
|
|
<!-- The app bundles whisper-cli + ggml/whisper dylibs in the app. Disabling
|
|
library validation lets the process tree load them without tripping the
|
|
hardened runtime's same-Team-ID check. -->
|
|
<key>com.apple.security.cs.disable-library-validation</key>
|
|
<true/>
|
|
<!-- Hardened-runtime resource-access entitlement. REQUIRED for microphone
|
|
access under the hardened runtime: without it tccd refuses to even
|
|
prompt and denies kTCCServiceMicrophone outright, so the app records
|
|
silence (and whisper hallucinates on the empty audio). Must be present
|
|
on any Developer ID / notarized build. -->
|
|
<key>com.apple.security.device.audio-input</key>
|
|
<true/>
|
|
<!-- whisper.cpp's Metal/ggml backend generates code at runtime; the
|
|
hardened runtime needs allow-jit so the bundled whisper-cli/dylibs
|
|
don't get killed for JIT. -->
|
|
<key>com.apple.security.cs.allow-jit</key>
|
|
<true/>
|
|
</dict>
|
|
</plist>
|