packaging/macos/CMakeLists.txt

0001
0002
0003 set(GENERAL_ENTITLEMENTS "
0004     <key>com.apple.security.get-task-allow</key>
0005     <true/>
0006     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
0007     <true/>
0008     <key>com.apple.security.cs.allow-jit</key>
0009     <true/>
0010     <key>com.apple.security.cs.disable-library-validation</key>
0011     <true/>
0012     <key>com.apple.security.cs.allow-dyld-environment-variables</key>
0013     <true/>
0014 ")
0015
0016 set(SANDBOX_ENTITLEMENTS "
0017     <!-- Sandbox entitlements -->
0018     <key>com.apple.security.app-sandbox</key>
0019     <true/>
0020     <key>com.apple.security.network.client</key>
0021     <true/>
0022     <key>com.apple.security.files.user-selected.read-write</key>
0023     <true/>
0024     <key>com.apple.security.files.bookmarks.app-scope</key>
0025     <true/>
0026     <key>com.apple.security.files.bookmarks.document-scope</key>
0027     <true/>
0028 ")
0029
0030 set(DEV_SANDBOX_ENTITLEMENTS "
0031     <!-- Temporary permissions sandbox migration -->
0032     <key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>
0033     <array>
0034         <string>${CMAKE_INSTALL_PREFIX}/</string>
0035     </array>
0036 ")
0037
0038
0039 # Debugging in a full sandboxed bundle is slow, instead we sign the krita
0040 # binary using this set of entitlements, which gives permission to the entire
0041 # BUILDROOT/i path location. This ensures krita is run in sandboxed environment
0042 # and proper debug works.
0043 set(ENTITLEMENTS "${GENERAL_ENTITLEMENTS} ${SANDBOX_ENTITLEMENTS} ${DEV_SANDBOX_ENTITLEMENTS}")
0044 configure_file(entitlements.plist.template ${CMAKE_CURRENT_BINARY_DIR}/sandboxdev-entitlements.plist)
0045