Merge pull request #4601 from zen-browser/macos-signing-fix

src/browser/base/content/ZenCustomizableUI.sys.mjs

@@ -126,7 +126,7 @@ export var ZenCustomizableUI = new (class {
     window.CustomizableUI.registerToolbarNode(window.document.getElementById('zen-sidebar-top-buttons'));
     window.CustomizableUI.registerToolbarNode(window.document.getElementById('zen-sidebar-icons-wrapper'));
     window.addEventListener(
-      'MozAfterPaint',
+      'DOMContentLoaded',
       () => {
         this._dispatchResizeEvent(window);
       },

src/security/mac/hardenedruntime/v2/production/firefox-browser-xml.patch

@@ -0,0 +1,13 @@
+diff --git a/security/mac/hardenedruntime/v2/production/firefox.browser.xml b/security/mac/hardenedruntime/v2/production/firefox.browser.xml
+index abbf33e9d2b3c9d1e0a34bd46e7cd289c435533b..4d988ca8201fa6aba6ca049e97d3cdc6b772b5eb 100644
+--- a/security/mac/hardenedruntime/v2/production/firefox.browser.xml
++++ b/security/mac/hardenedruntime/v2/production/firefox.browser.xml
+@@ -26,7 +26,7 @@
+ 
+     <!-- Required for com.apple.developer.web-browser.public-key-credential -->
+     <key>com.apple.application-identifier</key>
+-    <string>43AQ936H96.org.mozilla.firefox</string>
++    <string>H36NPCN86W.app.zen-browser.zen</string>
+ 
+     <!-- For platform passkey (webauthn) support -->
+     <key>com.apple.developer.web-browser.public-key-credential</key><true/>

src/tools/signing/macos/mach_commands-py.patch

@@ -0,0 +1,29 @@
+diff --git a/tools/signing/macos/mach_commands.py b/tools/signing/macos/mach_commands.py
+index a513ad723805459c194d27b42dac68e9babba468..be74acbfe16a4eb389bc7d0ba32820b82fe2819c 100644
+--- a/tools/signing/macos/mach_commands.py
++++ b/tools/signing/macos/mach_commands.py
+@@ -37,7 +37,6 @@ from mozbuild.base import MachCommandConditions as conditions
+     "Release channel entitlements, but the configuration used will be the "
+     "Release configuration as defined in the repo working directory, not the "
+     "configuration from the revision of the earlier 120 build.",
+-    conditions=[conditions.is_firefox],
+ )
+ @CommandArgument(
+     "-v",
+@@ -342,6 +341,7 @@ def macos_sign(
+     cs_reset_cmd = ["find", app, "-exec", "codesign", "--remove-signature", "{}", ";"]
+     run(command_context, cs_reset_cmd, capture_output=not verbose_arg)
+ 
++    run(command_context, ["mv", "./embedded.provisionprofile", os.path.join(app, "Contents")], capture_output=not verbose_arg)
+     if use_rcodesign_arg is True:
+         sign_with_rcodesign(
+             command_context,
+@@ -567,7 +567,7 @@ def sign_with_rcodesign(
+     # input path and its options are specified as standard arguments.
+     ctx.log(logging.INFO, "macos-sign", {}, "Signing with rcodesign")
+ 
+-    cs_cmd = ["rcodesign", "sign"]
++    cs_cmd = ["rcodesign", "sign", "--for-notarization"]
+     if p12_file_arg is not None:
+         cs_cmd.append("--p12-file")
+         cs_cmd.append(p12_file_arg)