From 4b605f63776eba4095192f4f6d1bd30156874f3f Mon Sep 17 00:00:00 2001
From: Tim Angus <tim@ngus.net>
Date: Wed, 14 Jan 2026 18:21:29 +0000
Subject: [PATCH] Allow execution of VM code on macOS

The Q3 VM compiles native code that is unsigned, which since Tahoe (possibly
earlier) requires an entitlement to be set in order to execute it.
---
 cmake/entitlements.plist    | 9 +++++++++
 cmake/platforms/macos.cmake | 1 +
 2 files changed, 10 insertions(+)
 create mode 100644 cmake/entitlements.plist

diff --git a/cmake/entitlements.plist b/cmake/entitlements.plist
new file mode 100644
index 00000000..6e4f8c2f
--- /dev/null
+++ b/cmake/entitlements.plist
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+</dict>
+</plist>
diff --git a/cmake/platforms/macos.cmake b/cmake/platforms/macos.cmake
index 8b839b7e..ce681ae0 100644
--- a/cmake/platforms/macos.cmake
+++ b/cmake/platforms/macos.cmake
@@ -95,6 +95,7 @@ if(NOT "$ENV{APPLE_CERTIFICATE_ID}" STREQUAL "")
 
             add_custom_command(TARGET ${TARGET} POST_BUILD
                 COMMAND codesign --force --deep --options runtime
+                    --entitlements ${CMAKE_SOURCE_DIR}/cmake/entitlements.plist
                     --sign "$ENV{APPLE_CERTIFICATE_ID}"
                     "$<TARGET_FILE:${TARGET}>"
                 COMMENT "Code Signing for macOS: $<TARGET_FILE_BASE_NAME:${TARGET}>")