From 1a11685578d658c85246eec3a8f940563a593945 Mon Sep 17 00:00:00 2001
From: Florent Benoit <fbenoit@redhat.com>
Date: Mon, 21 Sep 2026 15:12:38 +0200
Subject: [PATCH] fix(vm): codesign macOS driver-vm with hypervisor entitlement
 in CI

The release tarball ships an unsigned binary that fails at runtime
when Hypervisor.framework rejects the caller. Sign with the existing
entitlements plist during the build, before artifact upload.

Closes #3506

Signed-off-by: Florent Benoit <fbenoit@redhat.com>
---
 .github/actions/build-rust-binary/action.yml | 13 +++++++++++++
 .github/workflows/build-vm-driver.yml        |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/.github/actions/build-rust-binary/action.yml b/.github/actions/build-rust-binary/action.yml
index 099d6acf2f..5a0b995e07 100644
--- a/.github/actions/build-rust-binary/action.yml
+++ b/.github/actions/build-rust-binary/action.yml
@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  entitlements-file:
+    description: Path to an entitlements plist for macOS ad-hoc codesigning (skipped when empty or not on macOS)
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
@@ -77,6 +81,15 @@ runs:
         # Confirm Syft can decode the embedded cargo-auditable metadata.
         SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
 
+    - name: Codesign with entitlements
+      if: inputs.entitlements-file != '' && runner.os == 'macOS'
+      shell: bash
+      env:
+        INPUTS_ENTITLEMENTS: ${{ inputs.entitlements-file }}
+        INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_BINARY: ${{ inputs.binary }}
+      run: /usr/bin/codesign --entitlements "${INPUTS_ENTITLEMENTS}" --force -s - "target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
+
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
diff --git a/.github/workflows/build-vm-driver.yml b/.github/workflows/build-vm-driver.yml
index c20706cdb2..9d1cce769b 100644
--- a/.github/workflows/build-vm-driver.yml
+++ b/.github/workflows/build-vm-driver.yml
@@ -39,6 +39,7 @@ jobs:
           - arch: aarch64
             triple: aarch64-apple-darwin
             runner: macos-15-xlarge
+            entitlements-file: crates/openshell-driver-vm/entitlements.plist
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     defaults:
@@ -106,3 +107,4 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ inputs['cargo-version'] }}
           supervisor-image-tag: ${{ inputs['supervisor-image-tag'] }}
+          entitlements-file: ${{ matrix.entitlements-file }}