signing-entitlements

# Signing & Entitlements ## Quick Start Use this skill when the failure smells like codesigning rather than compilation: launch refusal, missing entitlement, invalid signature, sandbox mismatch, hardened runtime confusion, or trust-policy rejection. ## Workflow 1. Inspect the bundle or binary. - Locate the `.app` or executable. - Identify the main binary inside `Contents/MacOS/`. 2. Read signing details. - Use `codesign -dvvv --entitlements :- <path>`. - Use `spctl -a -vv <path>` when Gatekeeper behavior matters. - Use `plutil -p` for entitlements or Info.plist inspection. 3. Classify the failure. - Unsigned or ad hoc signed - Wrong identity - Entitlement mismatch - Hardened runtime issue - App Sandbox issue - Nested code signing issue - Distribution/notarization prerequisite issue 4. Explain the minimum fix path. - Say exactly what is wrong. - Show the shortest set of validation or repair commands. - Distinguish local development problems from distribution problems. ## Useful Commands - `codesign -dvvv --entitlements :- <app-or-binary>` - `spctl -a -vv <app-or-binary>` - `security find-identity -p codesigning -v` - `plutil -p <path-to-entitlements-or-plist>` ## Guardrails - Never invent missing entitlements. - Do not conflate notarization with local debug signing. - If the real issue is a build setting or provisioning profile, say so directly. ## Output Expectations Provide: - what artifact was inspected - what signing state it is in - the exact failure class - the minimum fix or validation sequence