Fix some stuff, add AppEntitlements

Build/AppEntitlements.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.automation.apple-events</key>
+        <true/>
+    </dict>
+</plist>

Build/codesign_macos.sh

@@ -2,6 +2,8 @@
 
 echo "Signing file: $1"
 
+# Setup keychain in CI
+if [ -n "$CI" ]; then
     # Turn our base64-encoded certificate back to a regular .p12 file
     
     echo "$MACOS_CERTIFICATE" | base64 --decode -o certificate.p12
@@ -15,7 +17,19 @@ security default-keychain -s build.keychain
     security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
     security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
     security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+fi
 
-# We finally codesign our app bundle, specifying the Hardened runtime option
+# Sign all files
 
-/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime "$1" -v
+ENTITLEMENTS="AppEntitlements.entitlements"
+
+find "$1/Contents/MacOS/"|while read fname; do
+    if [[ -f $fname ]]; then
+        echo "[INFO] Signing $fname"
+        codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$fname"
+    fi
+done
+
+echo "[INFO] Signing app file"
+
+codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$1" -v

Build/notarize_macos.sh

@@ -7,9 +7,9 @@ echo "Notarizing file: $1"
 
 echo "Create keychain profile"
 xcrun notarytool store-credentials "notarytool-profile" \
---apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" \
---team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" \
---password "$PROD_MACOS_NOTARIZATION_PWD"
+--apple-id "$MACOS_NOTARIZATION_APPLE_ID" \
+--team-id "$MACOS_NOTARIZATION_TEAM_ID" \
+--password "$MACOS_NOTARIZATION_PWD"
 
 # We can't notarize an app bundle directly, but we need to compress it as an archive.
 # Therefore, we create a zip file containing our app bundle, so that we can send it to the