Support for embedded provisioning profiles and embedded apps in macOS DMGs #289
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Support two new features in packager: DMG embedded provisioning profiles and apps.
Embedded provisioning profiles are required by Apple to distribute apps with certain entitlements outside the App Store, so they can be installed in macOS without a device management profile installed. In other words, pretty much any macOS app with certain entitlements, that's offered outside the App Store, needs this.
Embedded apps are a way for DMGs to pack more than one binary, where each may have different entitlements. An example would be the 1Password DMG package, which contains both a handful of binaries that require no entitlements, plus another handful that do. The reason for this is that Apple doesn't allow more than one binary per package to be entitled, so if e.g. a single package, let's call it X, bundles a UI (tauri, electron, etc.), and a daemon with a number of entitlements (network extension, devicekit, etc.) together, the daemon needs to be embedded as an app with its own entitlements, inside of the "main" bundle.
As a note, these embedded apps must be signed before bundling them in the main DMG, and never re-signed during packaging, or the entitlement binary signature will be invalidated.
Edit: sorry for the messy commit stream.