Re-seal VLC.app after bundle install so it still launches; v3.5.1 - #17
Merged
Conversation
Adding the plugin to VLC.app's bundle (PR #14) invalidated the app's code-signature seal. On a cold launch macOS then refuses to open VLC ("a sealed resource is missing or invalid") -- a launch *refusal*, so it produces no crash log, which made it look like VLC "just won't open." install.sh now re-seals the bundle after installing the plugin: clears quarantine (xattr -cr) and re-signs VLC.app ad-hoc with --preserve-metadata= entitlements (so disable-library-validation is kept and the plugin still loads). The app becomes ad-hoc signed; a fresh VLC reinstall restores the original signature and the user just re-runs install.sh. README documents the re-seal step and a manual recovery one-liner for anyone who hit the "VLC won't open" state on an older install. Bumps DIX_VERSION to 3.5.1. Verified: installer re-seals, VLC launches from the Dock, and dixwaveform loads under the re-signed app (clean env, no VLC_PLUGIN_PATH). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpVzsy8Wrc9DYEXns2Njzb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
PR #14 installed the plugin into
VLC.app's bundle for GUI-launch discovery — but adding a file to a Developer-ID-signed, hardened-runtime app breaks its code-signature seal. On a cold launch macOS then refuses to open VLC ("a sealed resource is missing or invalid"). Because it's a launch refusal, not a crash, there's no crash log — so it looked like "VLC just won't open."(Live-caught by the user; VLC was restored by re-sealing the bundle.)
The fix
install.shnow re-seals the bundle after installing the plugin:xattr -cr "$VLC_APP"— clear quarantine so Gatekeeper allows the locally-modified app,codesign -f -s - --preserve-metadata=entitlements "$VLC_APP"— re-sign ad-hoc while preserving VLC's entitlements (disable-library-validation), so the plugin still loads.VLC.app becomes ad-hoc signed; a fresh VLC reinstall restores the original signature and the user just re-runs
./install.sh. The README documents the step + a manual recovery one-liner for anyone already stuck.Verified
dixwaveformv3.5.1 loads under the re-signed app with a clean env (noVLC_PLUGIN_PATH).test_pitch,test_lufs) pass.🤖 Generated with Claude Code
Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/