[education/labplot] /: CI: sign macOS packages with new entitlement

Git commit c0cd1c9366f6de672371b1c222875a42185b7b53 by Stefan Gerlach.
Committed on 29/07/2026 at 09:34.
Pushed by sgerlach into branch 'master'.

CI: sign macOS packages with new entitlement

M  +18   -0    .gitlab-ci.yml

https://invent.kde.org/education/labplot/-/commit/c0cd1c9366f6de672371b1c222875a42185b7b53

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3c457ce0f8..a282f17c6b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -88,6 +88,24 @@ craft_macos_qt6_arm64:
     - if: '$CI_COMMIT_REF_NAME == "master"'
       when: manual
       allow_failure: true
+  script:          
+    - craft --package labplot
+ 
+    # Re-sign with entitlements (Craft doesn't pick them up automatically yet)
+    - |
+      APP_PATH="archive/Applications/KDE/LabPlot.app"
+      ENTITLEMENTS="$APP_PATH/Contents/Resources/labplot.entitlements"
+      if [ -f "$ENTITLEMENTS" ]; then
+        echo "Applying entitlements to LabPlot.app"
+        codesign --force --deep --sign - \
+          --entitlements "$ENTITLEMENTS" \
+          "$APP_PATH"
+      
+        echo "Verifying entitlements:"
+        codesign -d --entitlements - "$APP_PATH/Contents/MacOS/labplot"
+      else
+        echo "Warning: Entitlements file not found at $ENTITLEMENTS"
+      fi
 
 snap_snapcraft_lxd:
   rules: