By default, building MacVim locally will sign with an ad-hoc signature with no
entitlements. Release builds are then signed with the `macvim-signed`
target which signs MacVim with a valid signature and embed the
entitlments. This new target allows us to sign MacVim to have similar
entitlements and behaviors as a release build without needing an Apple
Developer signature.

There are currently two possible use cases for this:
1. Package managers like Homebrew can use this to build MacVim to get
   the correct hardened runtime entitlements.
2. Reproducible builds (macvim-dev#1506) can use this to generate a reproducible
   artifact. Proper release builds are not reproducible since there's no
   way for a proper digital signature to be reproduced, but we can strip
   and re-sign with an ad-hoc signature reproducibly using this target
   for a decent compromise.

Related: macvim-dev#1585

9 tasks

ychin deleted the make-macvim-signed-adhoc branch