[packaging/craft-blueprints-kde] kde/applications/labplot: Re-sign the binary with the available entitlements.

Git commit b4ecf3f8c5e05d975736d375bc0d3733e0e9c55c by Alexander Semke.
Committed on 26/07/2026 at 09:20.
Pushed by sgerlach into branch 'master'.

Re-sign the binary with the available entitlements.

The patch adds code to the `preArchive()` method that copies `labplot.entitlements` from LabPlot source to the app bundle
and re-signs the app with the entitlements. This is now primarily to re-sign with com.apple.security.cs.disable-library-validation
to allow to import user-installed python modules in labplot python scripting runtime,
s.a. https://invent.kde.org/education/labplot/-/merge_requests/912.

M  +19   -0    kde/applications/labplot/labplot.py

https://invent.kde.org/packaging/craft-blueprints-kde/-/commit/b4ecf3f8c5e05d975736d375bc0d3733e0e9c55c

diff --git a/kde/applications/labplot/labplot.py b/kde/applications/labplot/labplot.py
index 84469ab27..7c80e4160 100644
--- a/kde/applications/labplot/labplot.py
+++ b/kde/applications/labplot/labplot.py
@@ -299,6 +299,25 @@ class Package(CMakePackageBase):
             utils.copyFile(os.path.join(pysideLocation, "__init__.py"), pysidePath, linkOnly=False)
             utils.copyFile(os.path.join(shibokenLocation, "__init__.py"), shibokenPath, linkOnly=False)
 
+            # Copy entitlements file and re-sign to allow loading Python packages with different signatures
+            entitlementsSource = self.sourceDir() / "labplot.entitlements"
+            if entitlementsSource.exists():
+                entitlementsDest = appPath / "Contents/Resources/labplot.entitlements"
+                utils.copyFile(entitlementsSource, entitlementsDest, linkOnly=False)
+                print(f"Copied entitlements file to {entitlementsDest}")
+
+                # Re-sign with entitlements (ad-hoc signature for now, Craft will re-sign later if needed)
+                import subprocess
+                result = subprocess.run([
+                    "codesign", "--force", "--deep", "--sign", "-",
+                    "--entitlements", str(entitlementsDest),
+                    str(appPath)
+                ], capture_output=True, text=True)
+                if result.returncode == 0:
+                    print(f"Re-signed app with entitlements")
+                else:
+                    print(f"Warning: Failed to re-sign with entitlements: {result.stderr}")
+
             # fix falsely picked up system Python lib
             # utils.system(["install_name_tool", "-change", "/Library/Frameworks/Python.framework/Versions/3.12/Python", os.path.join(appPath, "Contents", "Frameworks", "Python.framework", "Versions", "3.11", "Python"), os.path.join(appPath, "Contents", "MacOS", "cantor_pythonserver")])
             # utils.system(