Skip to main content

​
mac signing (debug builds)

scripts/package-mac-app.sh builds and packages the app to a fixed path (dist/OpenClaw.app), then calls scripts/codesign-mac-app.sh to sign it. TCC permissions are tied to the bundle ID and code signature; keeping both stable (and the app at a fixed path) across rebuilds keeps macOS from forgetting TCC grants (notifications, accessibility, screen recording, mic, speech).
  • Debug bundle identifier defaults to ai.openclaw.mac.debug (override with BUNDLE_ID=...).
  • Node: >=22.19.0 <23 or >=23.11.0 (repo package.json engines). The packager also builds the Control UI (pnpm ui:build).
  • Requires a real signing identity by default; the codesign script exits with an error if none is found and ALLOW_ADHOC_SIGNING is not set. Ad-hoc signing (SIGN_IDENTITY="-") is explicit opt-in and does not persist TCC permissions across rebuilds. See macOS permissions.
  • Reads SIGN_IDENTITY from the environment (e.g. export SIGN_IDENTITY="Apple Development: Your Name (TEAMID)", or a Developer ID Application cert). Without it, codesign-mac-app.sh auto-selects an identity in this order: Developer ID Application, Apple Distribution, Apple Development, then the first valid codesigning identity found.
  • CODESIGN_TIMESTAMP=auto (default) enables trusted timestamps only for Developer ID Application signatures. Set on/off to force either way.
  • Stamps Info.plist with OpenClawBuildTimestamp (ISO8601 UTC) and OpenClawGitCommit (short hash, unknown if unavailable) so the About tab can show build, git, and debug/release channel.
  • Runs a Team ID audit after signing and fails if any Mach-O inside the bundle has a different Team ID. Set SKIP_TEAM_ID_CHECK=1 to bypass.

​
Usage

# from repo root
scripts/package-mac-app.sh                                                      # auto-selects identity; errors if none found
SIGN_IDENTITY="Developer ID Application: Your Name" scripts/package-mac-app.sh   # real cert
ALLOW_ADHOC_SIGNING=1 scripts/package-mac-app.sh                                 # ad-hoc (permissions will not stick)
SIGN_IDENTITY="-" scripts/package-mac-app.sh                                     # explicit ad-hoc (same caveat)
DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh                          # dev-only Sparkle Team ID mismatch workaround

​
Ad-hoc signing note

SIGN_IDENTITY="-" disables the Hardened Runtime (--options runtime) to prevent crashes when the app loads embedded frameworks (like Sparkle) that do not share the same Team ID. Ad-hoc signatures also break TCC permission persistence; see macOS permissions for recovery steps.

​
Build metadata for About

The About tab reads OpenClawBuildTimestamp and OpenClawGitCommit from Info.plist to show version, build date, git commit, and whether the build is DEBUG (via #if DEBUG). Re-run the packager after code changes to refresh these values.