From ac183b4e3c63479d30e424fabb446a0df63c16b8 Mon Sep 17 00:00:00 2001
From: Nexmoe <16796652+nexmoe@users.noreply.github.com>
Date: Mon, 12 Jan 2026 21:19:18 +0800
Subject: [PATCH] build(mac): sign bundled tools (#85)

---
 build/after-sign.cjs         | 58 ++++++++++++++++++++++++++++++++++++
 build/entitlements.mac.plist |  2 ++
 electron-builder.yml         |  1 +
 3 files changed, 61 insertions(+)
 create mode 100644 build/after-sign.cjs

diff --git a/build/after-sign.cjs b/build/after-sign.cjs
new file mode 100644
index 0000000..2f83afb
--- /dev/null
+++ b/build/after-sign.cjs
@@ -0,0 +1,58 @@
+const { execFileSync } = require('node:child_process')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const BINARIES = ['yt-dlp_macos', 'ffmpeg_macos', 'deno']
+
+const findAppBundle = (appOutDir) => {
+  const entries = fs.readdirSync(appOutDir)
+  const app = entries.find((entry) => entry.endsWith('.app'))
+  return app ? path.join(appOutDir, app) : null
+}
+
+const resolveSigningIdentity = () =>
+  process.env.CSC_NAME || process.env.APPLE_SIGNING_IDENTITY || '-'
+
+const signBinary = (targetPath, entitlementsPath) => {
+  const identity = resolveSigningIdentity()
+  const args = ['--force', '--sign', identity, '--entitlements', entitlementsPath]
+
+  if (identity !== '-') {
+    args.push('--options', 'runtime', '--timestamp')
+  }
+
+  args.push(targetPath)
+  execFileSync('codesign', args, { stdio: 'inherit' })
+}
+
+exports.default = async function afterSign(context) {
+  if (context.electronPlatformName !== 'darwin') {
+    return
+  }
+
+  const appBundle = findAppBundle(context.appOutDir)
+  if (!appBundle) {
+    console.warn('afterSign: No .app bundle found, skipping yt-dlp signing.')
+    return
+  }
+
+  const resourcesPath = path.join(
+    appBundle,
+    'Contents',
+    'Resources',
+    'app.asar.unpacked',
+    'resources'
+  )
+
+  const entitlementsPath = path.resolve(__dirname, 'entitlements.mac.plist')
+
+  for (const binary of BINARIES) {
+    const targetPath = path.join(resourcesPath, binary)
+    if (!fs.existsSync(targetPath)) {
+      console.warn(`afterSign: Missing ${binary}, skipping.`)
+      continue
+    }
+    console.log(`afterSign: Signing ${binary} with entitlements.`)
+    signBinary(targetPath, entitlementsPath)
+  }
+}
diff --git a/build/entitlements.mac.plist b/build/entitlements.mac.plist
index 38c887b..6bc22e9 100644
--- a/build/entitlements.mac.plist
+++ b/build/entitlements.mac.plist
@@ -8,5 +8,7 @@
     <true/>
     <key>com.apple.security.cs.allow-dyld-environment-variables</key>
     <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
   </dict>
 </plist>
diff --git a/electron-builder.yml b/electron-builder.yml
index 5427e4c..ee9e655 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -2,6 +2,7 @@ appId: com.vidbee
 productName: VidBee
 directories:
   buildResources: build
+afterSign: build/after-sign.cjs
 protocols:
   - name: VidBee
     schemes: