experiment with entitlements and signing the framework

.github/workflows/build-desktop.yml

@@ -1441,12 +1441,9 @@ jobs:
 
       - name: Resign
         run: |
-          codesign -dvvv "./dist/mas-dev-universal/Bitwarden.app" 2>&1 | grep -iE "TeamIdentifier|flags|Format|Identifier|Authority"
-          
-          codesign -dvvv "./dist/mas-dev-universal/Bitwarden.app/Contents/PlugIns/autofill-extension.appex" 2>&1 | grep -iE "TeamIdentifier|flags|Format|Identifier|Authority"
-
-          security find-identity -v -p codesigning          
-          
+          # Resign the Electron Framework
+          codesign --force --deep --options=runtime --sign "Developer ID Application: 8bit Solutions LLC (LTZ2PFU5D6)" --timestamp --generate-entitlement-der --preserve-metadata=identifier,flags Bitwarden.app/Contents/Frameworks/Electron\ Framework.framework
+          # Resign the bundle 
           codesign --entitlements resources/entitlements.mas.plist --deep --verbose --options runtime --force --sign "Developer ID Application: 8bit Solutions LLC (LTZ2PFU5D6)" dist/mas-dev-universal/Bitwarden.app
 
       - name: Zip masdev asset

apps/desktop/resources/entitlements.mac.plist

@@ -1,12 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-<dict>
-	<key>com.apple.security.cs.allow-jit</key>
-	<true/>
-	<!--
+	<dict>
+		<key>com.apple.security.cs.allow-jit</key>
+		<true />
+		<!--
 	<key>com.apple.developer.authentication-services.autofill-credential-provider</key>
 	<true/>
 	-->
-</dict>
-</plist>
+		<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+		<true />
+	</dict>
+</plist>