Repository navigation
feat(desktop): package the signed codev-vmm helper on macOS - #204
Merged
Merged
Conversation
prebuild builds the vz helper universal (per-slice --triple builds merged with lipo, since multi-arch swift build needs full Xcode's xcbuild), mac.extraResources ships it as Resources/codev-vmm, and an afterSign hook re-signs it with the virtualization entitlement — which the app itself must not carry — under whatever identity signed the app, hardened runtime on, before built-in notarization. Verified on a real package:mac run: the packaged helper is fat (x86_64+arm64), flagged adhoc,runtime, and carries com.apple.security.virtualization. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships the Virtualization.framework helper in packaged macOS builds — the last piece keeping the vz sandbox backend dev-only.
vmmHelperPath()has expectedprocess.resourcesPath/codev-vmmsince the wiring PR; this makes it exist.Changes
scripts/prebuild.ts: on macOS, builds the helper universal before packaging.script/build-vzhelper.ts(fork-only):--universalnow builds each slice with--tripleand merges withlipo. Passing swift build multiple--archflags delegates to xcbuild, which only full Xcode ships — Command Line Tools setups (like the build Mac) fail with "xcbuild executable does not exist". Universal also matters for packaging:@electron/universalcopies an already-fat Mach-O through, where an identical thin binary in both halves would trip its identical-file check (the same onex64ArchFilesworks around for node_modules).electron-builder.config.ts:mac.extraResourcesships the helper asResources/codev-vmm, and anafterSignhook re-signs it withvzhelper.entitlements(com.apple.security.virtualization— an entitlement the Electron app itself neither has nor needs, so the app signing pass can't cover it). The hook reuses whatever identity signed the app — read fromcodesign --display— with hardened runtime, adding a timestamp only for non-ad-hoc identities, and runs before electron-builder's built-in notarization.Verification
Real
package:macrun on this branch, then inspected the produced.app:Contents/Resources/codev-vmmpresent,lipo -info→x86_64 arm64codesign --display→flags=0x10002(adhoc,runtime)(this machine has no Developer ID; a release machine's identity flows through the same path with--timestamp)com.apple.security.virtualization = trueserver-bundlealso confirmed present beside itConfig test added (mac extraResource + afterSign wired); desktop config tests 10 pass, sandbox package 71 pass; DIVERGENCES rows updated (electron-builder row extended, new prebuild row).
Notarization with a real identity has not been exercised — worth watching on the first release build.
🤖 Generated with Claude Code