{"record":{"id":"1e9814d89902a9e3","repo":"microsoft/typescript-go","slug":"signed-file-is-missing-macos-entitlement-entitl","errorCode":null,"errorMessage":"Signed file is missing macOS entitlement '${entitlement}': ${filePath}","messagePattern":"Signed file is missing macOS entitlement '(.+?)': (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"Herebyfile.mjs","lineNumber":1518,"sourceCode":"</dict>\r\n</plist>\r\n`;\r\n}\r\n\r\n/**\r\n * @param {string} filePath\r\n */\r\nasync function verifyTypeScriptMacEntitlements(filePath) {\r\n    const { stdout } = await $pipe`go tool quill describe --quiet --output json ${filePath}`;\r\n    const details = JSON.parse(stdout);\r\n    const entitlements = details[0]?.superBlob?.entitlements?.entitlements;\r\n    if (typeof entitlements !== \"string\") {\r\n        throw new Error(`Signed file has no macOS entitlements: ${filePath}`);\r\n    }\r\n    for (const entitlement of typescriptMacEntitlements) {\r\n        const escapedEntitlement = entitlement.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\r\n        if (!new RegExp(`<key>\\\\s*${escapedEntitlement}\\\\s*</key>\\\\s*<true\\\\s*/>`).test(entitlements)) {\r\n            throw new Error(`Signed file is missing macOS entitlement '${entitlement}': ${filePath}`);\r\n        }\r\n    }\r\n}\r\n\r\n/**\r\n * @typedef {\"win32\" | \"linux\" | \"darwin\" | \"aix\" | \"android\" | \"freebsd\" | \"netbsd\" | \"openbsd\" | \"sunos\"} OS\r\n * @typedef {\"x64\" | \"arm\" | \"arm64\" | \"ia32\" | \"ppc64\" | \"loong64\" | \"mips64el\" | \"riscv64\" | \"s390x\"} Arch\r\n * @typedef {\"Microsoft400\" | \"LinuxSign\" | \"MacDeveloperHarden\" | \"8020\" | \"VSCodePublisher\"} Cert\r\n * @typedef {`${OS | \"alpine\"}-${Exclude<Arch, \"arm\"> | \"armhf\"}`} VSCodeTarget\r\n * @typedef {{ name: string; sourceDir: string }} VsixExtensionPackage\r\n * @typedef {{ nodeOs: string; vscodeTarget: string; sourceDir: string; extensionDir: string; vsixPath: string; vsixManifestPath: string; vsixSignaturePath: string }} VsixExtension\r\n * @typedef {{ GOOS: string; GOARCH: string }} GoDistTarget\r\n * @typedef {{ os: OS; arch: Arch; cert?: Cert; vsix?: boolean; alpine?: boolean }} Platform\r\n */\r\nvoid 0;\r\n\r\n/** @type {VsixExtensionPackage[]} */\r\nconst vsixExtensionPackages = [\r","sourceCodeStart":1500,"sourceCodeEnd":1536,"githubUrl":"https://github.com/microsoft/typescript-go/blob/1bcfa18d79a3be41772223d5c05dfe4480e614ff/Herebyfile.mjs#L1500-L1536","documentation":"The entitlements XML on the signed binary must contain <key>NAME</key> followed by <true/> for every entry in typescriptMacEntitlements. A missing key, or one set to false, fails verification for that specific entitlement.","triggerScenarios":"A new entitlement name was added to typescriptMacEntitlements in Herebyfile.mjs without adding it (as true) to the plist used at signing time, or the plist sets that key to false.","commonSituations":"Drift between the expected-entitlements list in the build script and the signing plist; entitlements toggled off during debugging.","solutions":["Add the missing key as <true/> in the entitlements plist used for signing, then re-sign","Or remove/adjust the entry in typescriptMacEntitlements if that entitlement is no longer required","Change the plist and typescriptMacEntitlements in the same commit to keep them in sync"],"exampleFix":"<!-- before -->\n<key>com.apple.security.cs.allow-jit</key>\n<false/>\n\n<!-- after -->\n<key>com.apple.security.cs.allow-jit</key>\n<true/>","handlingStrategy":"validation","validationCode":"for (const entitlement of typescriptMacEntitlements) {\n  const re = new RegExp(`<key>\\\\s*${entitlement.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*</key>\\\\s*<true\\\\s*/>`);\n  if (!re.test(plistXml)) throw new Error(`Entitlements plist lacks ${entitlement}; fix before signing.`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the entitlements plist and typescriptMacEntitlements in the same commit when changing them","Validate the plist against the expected list before signing, not after","Never set an expected entitlement to <false/> without updating the script"],"tags":["signing","macos","entitlements","release"],"backgroundTag":null,"analyzedSha":"1bcfa18d79a3be41772223d5c05dfe4480e614ff","analyzedAt":"2026-08-16T02:12:00.115Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}