Allow to load unsigned/unnotarized plugins on macOS about supercollider HOT 11 OPEN

The release version of SC (checked on 3.13.0) does have this key set. Have you encountered a situation where it was not?

Signing SC is currently done manually when doing the release. The process is described here: https://github.com/supercollider/supercollider/wiki/macOS-Signing-and-Notarization

The entitlement file should probably be part of the repo though :)

from supercollider.

Here's some more info for reference, from my experiences with that:

• unsigned binaries can still be loaded (with warnings etc) on Intel, even in the newest OS I think; on Arm that's blocked closer to the hardware
• when building with the Xcode generator, binaries should be ad-hoc signed automatically
• however, any manipulations like changing loader paths etc invalidates the signature
• in SC we're running ad-hoc code signing explicitly after assembling the package (since we do fixup some paths afterwards, so signing with macdeployqt wouldn't be enough)

from supercollider.

The release version of SC (checked on 3.13.0) does have this key set. Have you encountered a situation where it was not?

Ah, great, I didn't know that! I just kept getting requests from people who want a notarized binary of VSTPlugin. Now I can tell them to simply upgrade to SC 3.13 :) Thanks a lot!

from supercollider.

The entitlement file should probably be part of the repo though :)

+1

from supercollider.

I think the entitlement flag was part of most recent SC releases. However there still may be some issue with loading unsigned plugins; I can't remember if every plugin needed to be confirmed manually, or if they wouldn't load at all. We encountered that when doing the sc3-plugins release (when we couldn't figure out signing for the plugins).

from supercollider.

I think the entitlement flag was part of most recent SC releases.

Interesting. Last autumn I had to help students to manually set all the security exceptions to get VSTPlugin running. They all installed the most recent SuperCollider version back then, which must have been 3.12.1. However, last time I tested on a MacBook (macOS 13 Ventura) I didn't have these problems. I now checked the entitlements of SC 3.12.2 and SC 3.13 and they both set the necessary keys, so I am a bit confused...

In general, is SC supposed to load extensions without requiring any sort of manual confirmation or other interference by the user?

from supercollider.

Ahhh... I just found this:

Apple silicon requires that all code be at least ad hoc signed.

https://developer.apple.com/forums/thread/694873

IIRC, all the students who had this problems had M1 MacBooks... So I definitely need to code sign sigh. (Ad-hoc code signing should be trivial to do in my CI pipeline, though.)

from supercollider.

Ah yes, sorry, should've mentioned that - binaries don't run at all without signature on apple silicon.

from supercollider.

No worries! At least now I understand what's going on :)

from supercollider.

Thanks, that's very helpful!

from supercollider.

This user claims that they had to explicitly authorize my plugin binaries with SC 3.13 on macOS 13.6.3 (Intel): https://scsynth.org/t/vstplugin-v0-5-4-released/5380/54?u=spacechild1 I'm wondering what's going on...

from supercollider.