fix default entitlements for non steam apps

Author: StephenHodgson

.github/workflows/validate.yml

@@ -84,7 +84,7 @@ jobs:
             }
           }
         shell: pwsh
-      - uses: buildalon/activate-unity-license@development
+      - uses: buildalon/activate-unity-license@v1
         with:
           license: 'Personal'
           username: ${{ secrets.UNITY_USERNAME }}

dist/index.js

@@ -58739,7 +58739,7 @@ async function ArchiveXcodeProject(projectRef) {
         const entitlementsHandle = await fs.promises.open(projectRef.entitlementsPath, fs.constants.O_RDONLY);
         try {
             const entitlementsContent = await fs.promises.readFile(entitlementsHandle, 'utf8');
-            core.debug(`----- Entitlements content: -----\n${entitlementsContent}\n-----------------------------------`);
+            core.info(`----- Entitlements content: -----\n${entitlementsContent}\n-----------------------------------`);
         }
         finally {
             await entitlementsHandle.close();
@@ -59215,11 +59215,22 @@ async function getDefaultEntitlementsMacOS(projectRef) {
             };
             break;
         default:
-            defaultEntitlements = {
-                'com.apple.security.cs.disable-library-validation': true,
-                'com.apple.security.cs.allow-dyld-environment-variables': true,
-                'com.apple.security.cs.disable-executable-page-protection': true,
-            };
+            if (projectRef.isSteamBuild) {
+                defaultEntitlements = {
+                    'com.apple.security.cs.disable-library-validation': true,
+                    'com.apple.security.cs.allow-dyld-environment-variables': true,
+                    'com.apple.security.cs.disable-executable-page-protection': true,
+                };
+            }
+            else {
+                defaultEntitlements = {
+                    'com.apple.security.cs.allow-jit': true,
+                    'com.apple.security.cs.allow-unsigned-executable-memory': true,
+                    'com.apple.security.cs.allow-dyld-environment-variables': true,
+                    'com.apple.security.cs.disable-library-validation': true,
+                    'com.apple.security.cs.disable-executable-page-protection': true,
+                };
+            }
             break;
     }
     await fs.promises.writeFile(entitlementsPath, plist.build(defaultEntitlements));

dist/index.js.map

@@ -25,7 +25,7 @@
     "uuid": "^10.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.15.21",
+    "@types/node": "^22.15.33",
     "@types/plist": "^3.0.5",
     "@types/semver": "^7.7.0",
     "@types/uuid": "^10.0.0",

package-lock.json

@@ -402,7 +402,7 @@ export async function ArchiveXcodeProject(projectRef: XcodeProject): Promise<Xco
         const entitlementsHandle = await fs.promises.open(projectRef.entitlementsPath, fs.constants.O_RDONLY);
         try {
             const entitlementsContent = await fs.promises.readFile(entitlementsHandle, 'utf8');
-            core.debug(`----- Entitlements content: -----\n${entitlementsContent}\n-----------------------------------`);
+            core.info(`----- Entitlements content: -----\n${entitlementsContent}\n-----------------------------------`);
         } finally {
             await entitlementsHandle.close();
         }
@@ -866,12 +866,23 @@ async function getDefaultEntitlementsMacOS(projectRef: XcodeProject): Promise<vo
             };
             break;
         default:
-            // steam: https://partner.steamgames.com/doc/store/application/platforms#3
-            defaultEntitlements = {
-                'com.apple.security.cs.disable-library-validation': true,
-                'com.apple.security.cs.allow-dyld-environment-variables': true,
-                'com.apple.security.cs.disable-executable-page-protection': true,
-            };
+            if (projectRef.isSteamBuild) {
+                // steam: https://partner.steamgames.com/doc/store/application/platforms#3
+                defaultEntitlements = {
+                    'com.apple.security.cs.disable-library-validation': true,
+                    'com.apple.security.cs.allow-dyld-environment-variables': true,
+                    'com.apple.security.cs.disable-executable-page-protection': true,
+                };
+            } else {
+                // use default hardened runtime entitlements
+                defaultEntitlements = {
+                    'com.apple.security.cs.allow-jit': true,
+                    'com.apple.security.cs.allow-unsigned-executable-memory': true,
+                    'com.apple.security.cs.allow-dyld-environment-variables': true,
+                    'com.apple.security.cs.disable-library-validation': true,
+                    'com.apple.security.cs.disable-executable-page-protection': true,
+                };
+            }
             break;
     }
     await fs.promises.writeFile(entitlementsPath, plist.build(defaultEntitlements));