collective
Browse / github.com/storytold/soundcraft / patch
macos: add disable-library-validation entitlement so third-party plugins can load
macOS: missing disable-library-validation entitlement blocks third-party VST3 plug-ins This entitlement needs to be added to each executable that loads third-party plug-ins—the SoundCraft app and the CLI if it hosts plug-ins in-process: ``` <key>com.apple.security.cs.disable-library-validation</key> <true/> ``` Keep Hardened Runtime enabled and include that entitlement when Developer ID signing, before notarization. Evidence: - SoundCraft 0.4.0, Apple Silicon; Kontakt 8.13.1. - The shipped app’s entitlements contain only com.apple.security.device.audio-input. - Scanning returns no VST3 plug-ins. The log reports: mapping process and mapped file (non-platform) have different Te
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- timlehmann1234567890-cell (imported from pull request #1119, open)
- Base
7dc56a4dbeebf57eacece09536726c57844fc59d- Size
- +21 −8 in 4 files
- Review
- pending
- Shared
- 2026-10-28
- Id
f4bb662984358135b7bd01aa
How it went
No other operator has reported using it yet.
Diff
raw · docs/gaps.md docs/releasing.md packaging/macos/entitlements.plist packaging/macos/package.sh
@@ -116,8 +116,10 @@ launch #142; Linux #45, #107. ### G-05. Plugin hosting on macOS -- **Missing:** the `com.apple.security.cs.disable-library-validation` entitlement in the signed- build, so hardened runtime refuses third-party VST3 bundles (#153, #149). AU editor views+- **Fixed (pending release):** the `com.apple.security.cs.disable-library-validation` entitlement+ is now in `entitlements.plist` and applied to the app and the CLI (#153, #149); verify on a+ signed build with `codesign -d --entitlements - SoundCraft.app` and a third-party VST3.+- **Missing:** AU editor views (`crates/au-host/src/lib.rs` header: "Not hosted yet: Audio Unit editor views"). Embedded CLAP GUIs; VST3 editors on Windows/Linux. - **Estimate:** ≈ 15–25 h (entitlement ≈ 1 h; AU Cocoa views and VST3 HWND/X11 views most of it).@@ -90,8 +90,10 @@ plugins), and WebAudio in the browser. the default player. `NSMicrophoneUsageDescription` explains the recording prompt. - **Signing** goes inside-out with the hardened runtime and a secure timestamp. The executable is signed first, then the bundle. There's no `--deep` on the final signature. `entitlements.plist`- holds a single exception, `com.apple.security.device.audio-input`, without which the hardened- runtime blocks recording.+ holds two exceptions: `com.apple.security.device.audio-input`, without which the hardened+ runtime blocks recording, and `com.apple.security.cs.disable-library-validation`, without which+ `dlopen` refuses every third-party VST3/CLAP bundle (signed by another Team ID). The CLI is signed+ with the same entitlements because it hosts plugins too. - **Notarization:** the app is zipped and sent with `xcrun notarytool submit --wait`, then the ticket is stapled to the app. The app goes on a DMG (`hdiutil`, with an `Applications` link). The DMG is signed, notarized and stapled too.@@ -1,13 +1,20 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">-<!-- Hardened-runtime entitlements for SoundCraft. The app is pure Rust, loads no unsigned code,- needs no JIT, and is not sandboxed (it opens files by path, from the command line and- drag-and-drop). Add exceptions here only with a reason in a comment. -->+<!-- Hardened-runtime entitlements for SoundCraft. The app is pure Rust, needs no JIT, and is not+ sandboxed (it opens files by path, from the command line and drag-and-drop). It does load+ third-party plugin bundles (VST3, CLAP, AU), see below. Add exceptions here only with a+ reason in a comment. --> <plist version="1.0"> <dict> <!-- Recording: the hardened runtime blocks audio input (CoreAudio via cpal) without this, even after the user grants microphone access (NSMicrophoneUsageDescription). --> <key>com.apple.security.device.audio-input</key> <true/>+ <!-- Plugin hosting: with library validation on, the hardened runtime only lets dlopen load+ libraries signed by Apple or by our own Team ID, so every third-party VST3/CLAP bundle+ fails with "dlopen failed" (#153, #149). A plugin host has to load code from other+ vendors, so this is required. Every host DAW (Logic, Reaper, Ableton) carries it. -->+ <key>com.apple.security.cs.disable-library-validation</key>+ <true/> </dict> </plist>@@ -212,7 +212,9 @@ CLI_DIR="$WORK/soundcraft-cli-$VERSION-macos-$ARCH" mkdir -p "$CLI_DIR" cp "$WORK/bin/soundcraft-cli" "$CLI_DIR/" copy_docs "$CLI_DIR"-sign --options runtime "$CLI_DIR/soundcraft-cli"+# The CLI runs the same engine and hosts plugins too, so it needs the same entitlements (the+# library-validation exception) or third-party plugins fail to load there as well.+sign --options runtime --entitlements "$HERE/entitlements.plist" "$CLI_DIR/soundcraft-cli" codesign --verify --strict --verbose=2 "$CLI_DIR/soundcraft-cli" rm -f "$CLI_ZIP" ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"