Fix #510 - Part 3 - Enable 'hardened runtime' on OSX (#542)

* Add hardened runtime

* Create entitlements.plist file for node entitlements

* Use entitlements file along with hardened runtime

* Fix whitespace

scripts/osx/publish.sh

@@ -23,7 +23,7 @@ else
 	security find-identity -v
 
 	echo "Starting codesign..."
-	codesign --deep --force --verbose --sign "Outrun Labs, LLC" _release/Onivim2.App
+	codesign --deep --force --verbose --sign "Outrun Labs, LLC" _release/Onivim2.App --options runtime --entitlements _release/entitlements.plist
 	echo "Onivim2.App codesign complete!"
 
 	# Validate

scripts/release.js

@@ -95,7 +95,6 @@ if (process.platform == "linux") {
 
   fs.mkdirpSync(frameworksDirectory);
   fs.mkdirpSync(resourcesDirectory);
-
   fs.writeFileSync(plistFile, require("plist").build(plistContents));
 
   // Copy bins over
@@ -114,6 +113,14 @@ if (process.platform == "linux") {
 
   shell(`dylibbundler -b -x "${path.join(binaryDirectory, "Oni2_editor")}" -d "${frameworksDirectory}" -p "@executable_path/../Frameworks/" -cd`);
 
+  const entitlementsPath = path.join(releaseDirectory, "entitlements.plist");
+  const entitlementsContents = {
+      "com.apple.security.cs.allow-jit": true,
+      "com.apple.security.cs.allow-unsigned-executable-memory": true,
+      "com.apple.security.cs.disable-library-validation": true,
+  };
+  fs.writeFileSync(entitlementsPath, require("plist").build(entitlementsContents));
+
   const dmgPath = path.join(releaseDirectory, "Onivim2.dmg");
   const dmgJsonPath = path.join(releaseDirectory, "appdmg.json");
   const basePath = releaseDirectory;