chore: update macOS sidecar signing process and add entitlements

- Introduced a new entitlements file for the sidecar to enhance security during code signing.
- Updated the GitHub Actions workflow to utilize the entitlements file in the signing process.
- Bumped OpenHuman version to 0.49.21 in Cargo.lock for dependency management.
- Configured tauri.conf.json to reference the new entitlements file for macOS builds.

.github/workflows/release.yml

@@ -453,9 +453,12 @@ jobs:
           SIDECAR_BASE: ${{ steps.core-paths.outputs.sidecar_base }}
         run: |
           SIDECAR_PATH="app/src-tauri/binaries/${SIDECAR_BASE}-${MATRIX_TARGET}"
+          ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist"
           echo "Signing sidecar: $SIDECAR_PATH"
-          codesign --force --options runtime --sign "$APPLE_SIGNING_IDENTITY" "$SIDECAR_PATH"
+          echo "Using entitlements: $ENTITLEMENTS"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$APPLE_SIGNING_IDENTITY" "$SIDECAR_PATH"
           codesign --verify --verbose "$SIDECAR_PATH"
+          codesign --display --entitlements - "$SIDECAR_PATH"
           echo "Sidecar signed successfully"
 
       - name: Resolve standalone core CLI artifact path

app/src-tauri/Cargo.lock

@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "OpenHuman"
-version = "0.49.20"
+version = "0.49.21"
 dependencies = [
  "env_logger",
  "log",

app/src-tauri/entitlements.sidecar.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>

app/src-tauri/tauri.conf.json

@@ -53,6 +53,7 @@
     "createUpdaterArtifacts": true,
     "macOS": {
       "minimumSystemVersion": "10.15",
+      "entitlements": "entitlements.sidecar.plist",
       "dmg": {
         "background": "./images/background-dmg.png"
       }