Remove unneeded macOS signing entitlements

[BlackHoleFox]

Hiyo, thanks again for the app. After installing Heynote on my Mac I noticed the entitlements were slightly off. Hopefully they should be good now :)

• com.apple.security.cs.allow-dyld-environment-variables: This isn't needed and just pokes holes in the hardened runtime. All it lets you do is inject dynamic libraries and mess with the process environment externally.

The other ones I removed only do anything when your app is sandboxed, and Heynote is not since its using the standard Electron build. If you ever distribute Heynote on the Mac app store, you'll need to bring these back in another file,

• com.apple.security.inherit: Usually makes sure child processes get the same sandbox as the main parent, but not used here since the main process does this without help from the system (like Chromium itself)
• com.apple.security.network.client: Lets a sandboxed app make outbound network connections. Again the main Heynote process isn't sandboxed so it can already make whatever connections desired.

[heyman]

Thanks!

Question: If com.apple.security.inherit and com.apple.security.network.client currently have no effect, but would be needed if Heynote were to be distributed on Apple's app store, maybe it would make more sense to keep them?

[BlackHoleFox]

but would be needed if Heynote were to be distributed on Apple's app store, maybe it would make more sense to keep them?

To the best of my knowledge you will need a dedicated entitlements file for Mac App Store distribution, so these removed entitlements would go there instead. This is because you need the com.apple.security.app-sandbox key there, yet that is incompatible with "regular" Electron builds.

[heyman]

To the best of my knowledge you will need a dedicated entitlements file for Mac App Store distribution, so these removed entitlements would go there instead. This is because you need the com.apple.security.app-sandbox key there, yet that is incompatible with "regular" Electron builds.

I see! I have no plans distributing Heynote through Apple's app store anyway, so I guess there's no point keeping them :). I tested out a build from this branch and everything worked as far as I could tell.

[heyman]

Thanks!