From 239e8e90137f053da25e5da07f4937a0712d65bc Mon Sep 17 00:00:00 2001
From: Talon <talon@iamtalon.me>
Date: Mon, 21 Sep 2026 02:14:24 +0200
Subject: [PATCH] Fix ad-hoc macOS publishing

---
 clients/apple/README.md        |  7 ++++---
 clients/apple/publish-macos.sh | 14 +++++++++++---
 2 files changed, 15 insertions(+), 6 deletions(-)
 mode change 100644 => 100755 clients/apple/publish-macos.sh

diff --git a/clients/apple/README.md b/clients/apple/README.md
index 929815b..957c645 100644
--- a/clients/apple/README.md
+++ b/clients/apple/README.md
@@ -13,9 +13,10 @@ dotnet restore clients/apple/VoiceCat.Apple.slnx
 dotnet build clients/apple/VoiceCat.Apple.slnx -c Debug --no-restore
 ```
 
-Use `publish-macos.sh --dry-run` to validate an ad-hoc macOS bundle. For distribution, set
-`VOICECAT_CODESIGN_IDENTITY`; optional notarization uses `APPLE_ID`, `APPLE_TEAM_ID`, and
-`APPLE_APP_PASSWORD`.
+Use `publish-macos.sh --dry-run` to validate a local ad-hoc macOS bundle. The dry-run build does
+not enable hardened runtime because ad-hoc signatures have no Team ID and cannot satisfy macOS
+library validation. Distribution builds remain hardened and require `VOICECAT_CODESIGN_IDENTITY`;
+optional notarization uses `APPLE_ID`, `APPLE_TEAM_ID`, and `APPLE_APP_PASSWORD`.
 
 For a physical iOS device, use `build-ios-device.sh` and `deploy-ios-device.sh`. The host and
 ReplayKit extension require signing profiles with App Group `group.me.iamtalon.voicecat`.
diff --git a/clients/apple/publish-macos.sh b/clients/apple/publish-macos.sh
old mode 100644
new mode 100755
index 7c867d0..2f4aed1
--- a/clients/apple/publish-macos.sh
+++ b/clients/apple/publish-macos.sh
@@ -19,7 +19,16 @@ if [[ ${1:-} == "--dry-run" ]]; then
   dry_run=1
 fi
 
-"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false
+publish_properties=(-p:ArchiveOnBuild=false)
+if (( dry_run )); then
+  # Hardened-runtime library validation requires the executable and every bundled dylib to
+  # have the same real Team ID. Ad-hoc signatures have no Team ID, so a hardened ad-hoc app
+  # passes codesign verification but is rejected by dyld at launch. Keep local validation
+  # ad-hoc and reserve the hardened runtime for the Developer ID distribution path below.
+  publish_properties+=(-p:UseHardenedRuntime=false)
+fi
+
+"$dotnet_host" publish "$project" -c "$configuration" --no-restore "${publish_properties[@]}"
 built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
 if [[ ! -d "$built_app" ]]; then
   print -u2 "VoiceCat.app was not produced at $built_app"
@@ -37,8 +46,7 @@ mkdir -p "$distribution"
 ditto "$built_app" "$app"
 
 if (( dry_run )); then
-  # The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the
-  # complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
+  # Normalize the workload's mixed nested signatures after bundling.
   codesign --force --deep --sign - "$app"
   codesign --verify --deep --strict "$app"
   spctl --assess --type execute "$app" 2>/dev/null || true