docs: add CONTRIBUTING.md note on dev-signing permission resets#276
Open
MufeezQadri wants to merge 1 commit into
Open
docs: add CONTRIBUTING.md note on dev-signing permission resets#276MufeezQadri wants to merge 1 commit into
MufeezQadri wants to merge 1 commit into
Conversation
Building from source with the default ad-hoc signature causes macOS to invalidate Accessibility/Microphone/Screen Recording grants on every rebuild, since ad-hoc signatures have no stable identity. Add a CONTRIBUTING.md explaining how to create a local self-signed "FreeFlow Dev" code-signing certificate so rebuilds keep a stable identity and permission grants persist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughAdded contribution documentation covering local project execution and macOS permission-reset troubleshooting caused by ad-hoc code signing. ChangesContribution Guidance
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Line 13: Update the signing guidance in CONTRIBUTING.md to accurately state
that Makefile passes CODESIGN_IDENTITY directly to codesign and does not
automatically fall back to ad-hoc signing. Document the explicit
CODESIGN_IDENTITY=- invocation if ad-hoc signing is intended, or implement the
missing fallback in the Makefile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
|
||
| ### Accessibility (or Microphone/Screen Recording) permission keeps disappearing after every rebuild | ||
|
|
||
| If you build from source without a matching signing identity in your keychain, `make` falls back to an ad-hoc signature. Ad-hoc signatures have no stable subject, so macOS treats every rebuild as a new, different app — any Accessibility/Microphone/Screen Recording grant you gave the previous build silently stops applying, even though System Settings may still show an old, now-stale entry. |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
rg -n 'CODESIGN_IDENTITY|codesign|--sign' MakefileRepository: zachlatta/freeflow
Length of output: 481
🏁 Script executed:
#!/bin/bash
set -eu
cat -n CONTRIBUTING.md | sed -n '1,40p'
echo
rg -n 'ad-hoc|CODESIGN_IDENTITY\s*=\s*-|fallback.*ad-hoc|codesign.*sign' .Repository: zachlatta/freeflow
Length of output: 3014
Clarify the signing behavior here. Makefile passes CODESIGN_IDENTITY straight to codesign; it does not automatically switch to ad-hoc signing when the identity is missing. If ad-hoc is intended, document the explicit CODESIGN_IDENTITY=- path or add that fallback in Makefile.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` at line 13, Update the signing guidance in CONTRIBUTING.md
to accurately state that Makefile passes CODESIGN_IDENTITY directly to codesign
and does not automatically fall back to ad-hoc signing. Document the explicit
CODESIGN_IDENTITY=- invocation if ad-hoc signing is intended, or implement the
missing fallback in the Makefile.
Source: MCP tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CODESIGN_IDENTITYin the keychain). Ad-hoc signatures have no stable subject, so macOS invalidates Accessibility/Microphone/Screen Recording grants on every rebuild — the permission can silently stop applying even though System Settings may still show a stale entry for it.CONTRIBUTING.mddocumenting the fix: create a local self-signed code-signing certificate namedFreeFlow Dev(matching the Makefile's defaultCODESIGN_IDENTITY) so rebuilds keep a stable signing identity and macOS remembers permission grants across rebuilds.Motivation
Hit this directly while building and running FreeFlow Dev from source — the dictation hotkey silently did nothing because Accessibility trust was reset by every rebuild. Documenting it so other contributors building from source don't have to re-diagnose the same thing.
Test plan
make clean && makewith no signing identity present produces an ad-hoc-signed app (codesign -dvshowsadhocflag, hotkey does nothing after granting Accessibility).FreeFlow DevCode Signing certificate, reranmake clean && make—codesign -dvnow showsAuthority=FreeFlow Devwith noadhocflag, and the Accessibility grant persists across a subsequent rebuild.Summary by CodeRabbit