ContextQMD
Back to Openclaw

macOS signing

docs/platforms/mac/signing.md

2026.7.13.2 KB
Original Source

mac signing (debug builds)

scripts/package-mac-app.sh builds and packages the app to a fixed path (dist/OpenClaw.app), then calls scripts/codesign-mac-app.sh to sign it. TCC permissions are tied to the bundle ID and code signature; keeping both stable (and the app at a fixed path) across rebuilds keeps macOS from forgetting TCC grants (notifications, accessibility, screen recording, mic, speech).

  • Debug bundle identifier defaults to ai.openclaw.mac.debug (override with BUNDLE_ID=...).
  • Node: >=22.22.3 <23, >=24.15.0 <25, or >=25.9.0 (repo package.json engines). The packager also builds the Control UI (pnpm ui:build).
  • Requires a real signing identity by default; the codesign script exits with an error if none is found and ALLOW_ADHOC_SIGNING is not set. Ad-hoc signing (SIGN_IDENTITY="-") is explicit opt-in and does not persist TCC permissions across rebuilds. See macOS permissions.
  • Reads SIGN_IDENTITY from the environment (e.g. export SIGN_IDENTITY="Apple Development: Your Name (TEAMID)", or a Developer ID Application cert). Without it, codesign-mac-app.sh auto-selects an identity in this order: Developer ID Application, Apple Distribution, Apple Development, then the first valid codesigning identity found.
  • CODESIGN_TIMESTAMP=auto (default) enables trusted timestamps only for Developer ID Application signatures. Set on/off to force either way.
  • Stamps Info.plist with OpenClawBuildTimestamp (ISO8601 UTC) and OpenClawGitCommit (short hash, unknown if unavailable) so the About tab can show build, git, and debug/release channel.
  • Runs a Team ID audit after signing and fails if any Mach-O inside the bundle has a different Team ID. Set SKIP_TEAM_ID_CHECK=1 to bypass.

Usage

bash
# from repo root
scripts/package-mac-app.sh                                                      # auto-selects identity; errors if none found
SIGN_IDENTITY="Developer ID Application: Your Name" scripts/package-mac-app.sh   # real cert
ALLOW_ADHOC_SIGNING=1 scripts/package-mac-app.sh                                 # ad-hoc (permissions will not stick)
SIGN_IDENTITY="-" scripts/package-mac-app.sh                                     # explicit ad-hoc (same caveat)
DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh                          # dev-only Sparkle Team ID mismatch workaround

Ad-hoc signing note

SIGN_IDENTITY="-" disables the Hardened Runtime (--options runtime) to prevent crashes when the app loads embedded frameworks (like Sparkle) that do not share the same Team ID. Ad-hoc signatures also break TCC permission persistence; see macOS permissions for recovery steps.

Build metadata for About

The About tab reads OpenClawBuildTimestamp and OpenClawGitCommit from Info.plist to show version, build date, git commit, and whether the build is DEBUG (via #if DEBUG). Re-run the packager after code changes to refresh these values.