{"record":{"id":"9ed88b9976866914","repo":"microsoft/typescript-go","slug":"signed-file-has-no-macos-entitlements-filepath","errorCode":null,"errorMessage":"Signed file has no macOS entitlements: ${filePath}","messagePattern":"Signed file has no macOS entitlements: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"Herebyfile.mjs","lineNumber":1513,"sourceCode":"    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\r\n<plist version=\"1.0\">\r\n<dict>\r\n${entries}\r\n</dict>\r\n</plist>\r\n`;\r\n}\r\n\r\n/**\r\n * @param {string} filePath\r\n */\r\nasync function verifyTypeScriptMacEntitlements(filePath) {\r\n    const { stdout } = await $pipe`go tool quill describe --quiet --output json ${filePath}`;\r\n    const details = JSON.parse(stdout);\r\n    const entitlements = details[0]?.superBlob?.entitlements?.entitlements;\r\n    if (typeof entitlements !== \"string\") {\r\n        throw new Error(`Signed file has no macOS entitlements: ${filePath}`);\r\n    }\r\n    for (const entitlement of typescriptMacEntitlements) {\r\n        const escapedEntitlement = entitlement.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\r\n        if (!new RegExp(`<key>\\\\s*${escapedEntitlement}\\\\s*</key>\\\\s*<true\\\\s*/>`).test(entitlements)) {\r\n            throw new Error(`Signed file is missing macOS entitlement '${entitlement}': ${filePath}`);\r\n        }\r\n    }\r\n}\r\n\r\n/**\r\n * @typedef {\"win32\" | \"linux\" | \"darwin\" | \"aix\" | \"android\" | \"freebsd\" | \"netbsd\" | \"openbsd\" | \"sunos\"} OS\r\n * @typedef {\"x64\" | \"arm\" | \"arm64\" | \"ia32\" | \"ppc64\" | \"loong64\" | \"mips64el\" | \"riscv64\" | \"s390x\"} Arch\r\n * @typedef {\"Microsoft400\" | \"LinuxSign\" | \"MacDeveloperHarden\" | \"8020\" | \"VSCodePublisher\"} Cert\r\n * @typedef {`${OS | \"alpine\"}-${Exclude<Arch, \"arm\"> | \"armhf\"}`} VSCodeTarget\r\n * @typedef {{ name: string; sourceDir: string }} VsixExtensionPackage\r\n * @typedef {{ nodeOs: string; vscodeTarget: string; sourceDir: string; extensionDir: string; vsixPath: string; vsixManifestPath: string; vsixSignaturePath: string }} VsixExtension\r\n * @typedef {{ GOOS: string; GOARCH: string }} GoDistTarget\r\n * @typedef {{ os: OS; arch: Arch; cert?: Cert; vsix?: boolean; alpine?: boolean }} Platform\r","sourceCodeStart":1495,"sourceCodeEnd":1531,"githubUrl":"https://github.com/microsoft/typescript-go/blob/1bcfa18d79a3be41772223d5c05dfe4480e614ff/Herebyfile.mjs#L1495-L1531","documentation":"verifyTypeScriptMacEntitlements runs `go tool quill describe --output json` on a signed darwin binary and expects an entitlements blob (details[0].superBlob.entitlements.entitlements as a string). If the binary carries no entitlements at all (unsigned, or signed without an entitlements plist), verification throws.","triggerScenarios":"The macOS signing step was skipped or ran without entitlements before verification; quill's JSON schema changed so the entitlements field is absent.","commonSituations":"Release tasks reordered so verification precedes entitlement-signing; quill version drift changing the describe output; ad-hoc signing without entitlements.","solutions":["Sign macOS binaries with the standard entitlements plist before running verification","Run `go tool quill describe <file>` manually and confirm an entitlements blob is present","Pin or update quill to the version whose JSON schema the script parses"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { $ } from \"execa\";\nconst { stdout } = await $`go tool quill describe --quiet --output json ${filePath}`;\nconst hasEntitlements = typeof JSON.parse(stdout)[0]?.superBlob?.entitlements?.entitlements === \"string\";\nif (!hasEntitlements) throw new Error(`Re-sign ${filePath} with entitlements before continuing release.`);","typeGuard":"/** @param {unknown} d @returns {boolean} */\nfunction hasEntitlementsBlob(d) {\n  return typeof d?.[0]?.superBlob?.entitlements?.entitlements === \"string\";\n}","tryCatchPattern":null,"preventionTips":["Always sign darwin binaries with the entitlements plist before verification runs","Check quill describe output manually when upgrading quill","Keep signing and entitlement verification adjacent in the task graph"],"tags":["signing","macos","entitlements","release"],"backgroundTag":null,"analyzedSha":"1bcfa18d79a3be41772223d5c05dfe4480e614ff","analyzedAt":"2026-08-16T02:12:00.115Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}