From ac38280a0ca95f5bd6eacb9fe4ffe9fbd34cba07 Mon Sep 17 00:00:00 2001 From: DragonNameLeo <15801369+DragonNameLeo@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:31:22 +0800 Subject: [PATCH] fix(macos): only reset TCC grants when the signing requirement changes Ad-hoc builds still reset Accessibility / Microphone on every install, since their cdhash-based requirement changes each build. A stable signing identity keeps the same designated requirement, so its grants now survive reinstalls. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01YJvDYNu6QoSEhJ4yGSuRqk --- openless-all/app/scripts/build-mac.sh | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/openless-all/app/scripts/build-mac.sh b/openless-all/app/scripts/build-mac.sh index 2b8cd6c32..c8dcf810f 100755 --- a/openless-all/app/scripts/build-mac.sh +++ b/openless-all/app/scripts/build-mac.sh @@ -152,11 +152,17 @@ if [ "$INSTALL" = "1" ]; then echo "▶ 装到 /Applications" pkill -f "OpenLess.app/Contents/MacOS/openless" 2> /dev/null || true sleep 1 - # Reset TCC before every reinstall: the ad-hoc signing hash changes on each build, so old - # authorizations break immediately; without a reset, "checked in System Settings" silently - # stops working. - tccutil reset Accessibility com.openless.app 2> /dev/null || true - tccutil reset Microphone com.openless.app 2> /dev/null || true + # TCC grants are bound to the designated requirement. An ad-hoc signature pins the cdhash, + # which changes on each build, so old authorizations break immediately; without a reset, + # "checked in System Settings" silently stops working. A stable signing identity keeps the + # same requirement, so its grants survive the reinstall and are left alone. + OLD_REQUIREMENT="$(codesign -d -r- /Applications/OpenLess.app 2> /dev/null || true)" + NEW_REQUIREMENT="$(codesign -d -r- "$APP" 2> /dev/null || true)" + if [ -z "$NEW_REQUIREMENT" ] || [ "$OLD_REQUIREMENT" != "$NEW_REQUIREMENT" ]; then + echo "▶ 签名要求已变化，重置辅助功能 / 麦克风授权" + tccutil reset Accessibility com.openless.app 2> /dev/null || true + tccutil reset Microphone com.openless.app 2> /dev/null || true + fi rm -rf /Applications/OpenLess.app cp -R "$APP" /Applications/ xattr -dr com.apple.quarantine /Applications/OpenLess.app 2> /dev/null || true