From 97eafd11fb69078c308c2a052238ff9444536237 Mon Sep 17 00:00:00 2001
From: Gronod <gordon@i3omb.com>
Date: Sat, 12 Sep 2026 09:41:11 +0100
Subject: [PATCH] fix(m9): Debug entitlements file to disable library
 validation for test host (#119)

---
 Resources/ICCery.Debug.entitlements | 16 ++++++++++++++++
 project.yml                         | 11 +++++++----
 2 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100644 Resources/ICCery.Debug.entitlements

diff --git a/Resources/ICCery.Debug.entitlements b/Resources/ICCery.Debug.entitlements
new file mode 100644
index 0000000..1179d62
--- /dev/null
+++ b/Resources/ICCery.Debug.entitlements
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- App Sandbox intentionally absent: ICCery must spawn Argyll tools,
+	     read/write user-chosen working directories, and talk to lp/CUPS. -->
+	<key>com.apple.security.device.usb</key>
+	<true/>
+	<!-- Debug only: the shared ICCeryCore package framework embedded in the
+	     test products is ad-hoc signed with no Team ID, so hardened-runtime
+	     library validation kills the test host at launch (run 31992, #119).
+	     Release uses ICCery.entitlements and links the package statically. -->
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>
diff --git a/project.yml b/project.yml
index bdd9fc8..642e5c3 100644
--- a/project.yml
+++ b/project.yml
@@ -19,6 +19,7 @@ targets:
       - path: Resources
         excludes:
           - ICCery.entitlements
+          - ICCery.Debug.entitlements
           - Argyll
       - path: Resources/Argyll
         type: folder
@@ -63,12 +64,14 @@ targets:
         MACOSX_DEPLOYMENT_TARGET: "12.0"
         ARCHS: "$(ARCHS_STANDARD)"
       # Debug builds sign ad-hoc; hardened-runtime library validation would
-      # reject the unsigned embedded ICCeryCore package framework when the
-      # test host launches (run 31992, #119). Release keeps validation and
-      # links the package statically anyway.
+      # reject the embedded ICCeryCore package framework (no Team ID) when
+      # the test host launches (run 31992, #119). DISABLE_LIBRARY_VALIDATION
+      # does not inject the entitlement on Xcode 14.2, so use a dedicated
+      # Debug entitlements file. Release keeps validation and links the
+      # package statically anyway.
       configs:
         Debug:
-          DISABLE_LIBRARY_VALIDATION: YES
+          CODE_SIGN_ENTITLEMENTS: Resources/ICCery.Debug.entitlements
 
   ICCeryCoreTests:
     type: bundle.unit-test
-- 
2.39.5