fix(macOS): preserve release entitlements when signing (#16125)

* fix(macOS): preserve release entitlements during signing

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

* ci(macOS): sign outer app with release entitlements

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

---------

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

.github/scripts/sign-macos-app.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+app_path=$1
+identity=$2
+entitlements=$3
+
+sign_args=(--force --options runtime --sign "$identity")
+if [[ "$identity" != "-" ]]; then
+  sign_args+=(--timestamp)
+fi
+
+frameworks_path="$app_path/Contents/Frameworks"
+if [[ -d "$frameworks_path" ]]; then
+  while IFS= read -r -d '' code; do
+    if file -b "$code" | grep -q 'Mach-O'; then
+      codesign "${sign_args[@]}" "$code"
+    fi
+  done < <(find "$frameworks_path" -type f -print0)
+
+  while IFS= read -r -d '' framework; do
+    codesign "${sign_args[@]}" "$framework"
+  done < <(find "$frameworks_path" -depth -type d -name '*.framework' -print0)
+fi
+
+service_path="$app_path/Contents/MacOS/service"
+if [[ -f "$service_path" ]]; then
+  codesign "${sign_args[@]}" "$service_path"
+fi
+
+codesign "${sign_args[@]}" --generate-entitlement-der \
+  --entitlements "$entitlements" "$app_path"
+codesign --verify --deep --strict --verbose=2 "$app_path"
+
+actual_entitlements=$(codesign -d --entitlements :- "$app_path" 2>/dev/null)
+audio_input=$(plutil -extract 'com\.apple\.security\.device\.audio-input' raw - \
+  <<<"$actual_entitlements")
+if [[ "$audio_input" != "true" ]]; then
+  echo "Missing com.apple.security.device.audio-input entitlement" >&2
+  exit 1
+fi

.github/workflows/flutter-build.yml

@@ -916,6 +916,8 @@ jobs:
 
       - name: Codesign app and create signed dmg
         if: env.MACOS_P12_BASE64 != null && env.UPLOAD_ARTIFACT == 'true'
+        env:
+          MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
         run: |
           # Patch create-dmg to give more attempts to unmount image
           CREATE_DMG="$(command -v create-dmg)"
@@ -926,7 +928,10 @@ jobs:
           security unlock-keychain -p ${{ secrets.MACOS_P12_PASSWORD }} rustdesk.keychain
           # start sign the rustdesk.app and dmg
           rm -rf *.dmg || true
-          codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict ./flutter/build/macos/Build/Products/Release/RustDesk.app -vvv
+          bash ./.github/scripts/sign-macos-app.sh \
+            ./flutter/build/macos/Build/Products/Release/RustDesk.app \
+            "$MACOS_CODESIGN_IDENTITY" \
+            ./flutter/macos/Runner/Release.entitlements
           create-dmg --icon "RustDesk.app" 200 190 --hide-extension "RustDesk.app" --window-size 800 400 --app-drop-link 600 185 rustdesk-${{ env.VERSION }}.dmg ./flutter/build/macos/Build/Products/Release/RustDesk.app
           codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict rustdesk-${{ env.VERSION }}.dmg -vvv
           # notarize the rustdesk-${{ env.VERSION }}.dmg