From 6098dd01b4e13f6b8f71c998cb5e4fe4597f2ca1 Mon Sep 17 00:00:00 2001
From: Yuri Karamian <yuri@arkhost.com>
Date: Thu, 9 Jul 2026 16:46:59 +0200
Subject: [PATCH] Add macOS notarization entitlements + iOS mobile guards

- Add entitlements.plist for Developer ID hardened runtime (JIT,
  unsigned memory, library validation, network client)
- Reference entitlements in tauri.conf.json bundle.macOS
- Guard get_install_type() with early mobile return (avoids
  std::process::Command in iOS binary)
- Add cfg(mobile) no-op branch to xdg_open()
---
 src-tauri/entitlements.plist | 19 +++++++++++++++++++
 src-tauri/src/commands.rs    | 12 ++++++++++++
 src-tauri/tauri.conf.json    |  3 +++
 3 files changed, 34 insertions(+)
 create mode 100644 src-tauri/entitlements.plist

diff --git a/src-tauri/entitlements.plist b/src-tauri/entitlements.plist
new file mode 100644
index 0000000..ae63725
--- /dev/null
+++ b/src-tauri/entitlements.plist
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Hardened runtime entitlements for Developer ID distribution (outside Mac App Store).
+         Required for notarization. These do NOT enable App Sandbox.
+         Without these, the WebKit webview and bundled Rust libraries get killed by the
+         hardened runtime's library validation. -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <!-- Network access for auto-updater, AI features, WebDAV sync, image proxy -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+</dict>
+</plist>
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 02c0ddb..7999b17 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -1486,6 +1486,10 @@ fn xdg_open(arg: &str) -> Result<(), String> {
             .spawn()
             .map_err(|e| format!("Failed to open {}: {}", arg, e))?;
     }
+    #[cfg(mobile)]
+    {
+        let _ = arg;
+    }
     Ok(())
 }
 
@@ -2061,6 +2065,14 @@ pub fn get_install_type() -> String {
             return forced.to_string();
         }
     }
+
+    // On mobile (iOS/Android) the concept of install type is irrelevant and the
+    // Linux detection below would attempt std::process::Command which is forbidden
+    // in the iOS sandbox. Return early.
+    if cfg!(mobile) {
+        return "mobile".to_string();
+    }
+
     if cfg!(target_os = "macos") {
         "macos".to_string()
     } else if cfg!(target_os = "windows") {
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index db2cd6c..d1f25d9 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -55,6 +55,9 @@
       "appimage": {
         "bundleMediaFramework": false
       }
+    },
+    "macOS": {
+      "entitlements": "entitlements.plist"
     }
   }
 }