34 lines
1 KiB
Python
34 lines
1 KiB
Python
# SPDX-License-Identifier: BSD-2-Clause
|
|
# SPDX-FileCopyrightText: 2026 KDE e.V.
|
|
|
|
"""Whitelist of allowed macOS entitlements for KDE projects."""
|
|
|
|
import plistlib
|
|
|
|
# Allowed entitlement keys - any entitlement not in this list is rejected
|
|
ALLOWED_ENTITLEMENTS = {
|
|
# Allow loading libraries with different code signatures
|
|
# Required e.g. for Python/scripting apps that load user-installed packages
|
|
"com.apple.security.cs.disable-library-validation",
|
|
# Allow access to the microphone
|
|
# Required e.g. for Kdenlive
|
|
"com.apple.security.device.audio-input",
|
|
}
|
|
|
|
|
|
def validate_entitlements_file(file_path):
|
|
"""
|
|
Parse and validate an entitlements plist file.
|
|
|
|
Args:
|
|
file_path: Path to the .entitlements file
|
|
|
|
Raises:
|
|
ValueError: If any entitlement is not in the whitelist
|
|
"""
|
|
with open(file_path, "rb") as f:
|
|
entitlements = plistlib.load(f)
|
|
|
|
for key in entitlements.keys():
|
|
if key not in ALLOWED_ENTITLEMENTS:
|
|
raise ValueError(f"Entitlement not allowed: {key}")
|