Code-signing entitlements needed for OSX

[ncruces]

Without the appropriate code-sign entitlements, OSX will kill any go processes attempting to compile a Wasm file.

Download a code-signed Golang app utilizing this driver, that attempts to compile the SQLite Wasm file (through wazero).
The operating system will kill the process.

[ncruces]

This should no longer be a problem, since we've moved away from wazero.

---

The solution will be to document this as a requirement when developing any wazero application on macOS.

The entitlements appear to be as follows:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
</dict>
</plist>

[ncruces]

Thanks @develerltd and @sirily11 for reporting this, suggesting and validating the solution.

[gesellix]

This helped me code-signing my app. Thanks!

Using the allow-unsigned-executable-memory is discouraged or at least not recommended. I tried another approach to reduce the required entitlements to only allow-jit by using the wazero interpreter instead of the compiler. The compiler has better overall performance with a latency on first instantiation.

In my case, the interpreter is sufficient and I currently prefer to reduce the required entitlements. I checked only on macOS, yet. If my tests on Windows and Linux become significantly slow using the interpreter, I'm going to use the compiler.

For anyone interested in using the interpreter, this is my code snippet (detailed explanations copied from ChatGPT for my future self):

package repository

import (
	"github.com/ncruces/go-sqlite3"
	"github.com/tetratelabs/wazero"
)

func init() {
	// So your SQLite driver (ncruces/go-sqlite3) embeds SQLite via wazero (Wasm).
	// If it runs the compiler/JIT engine, it allocates executable memory.
	// Under hardened runtime, that’s allowed only if the code follows
	// JIT rules (W^X, MAP_JIT on arm64) and you have the right entitlement.
	// The fact that allow-jit alone fails but allow-unsigned-executable-memory
	// works strongly suggests a W+X or “execute-from-anonymous” mapping somewhere in that path.
	//
	// Code-signing entitlements needed for OSX:
	// https://github.com/ncruces/go-sqlite3/discussions/291
	//
	// https://github.com/ncruces/go-sqlite3/wiki/Support-matrix#compiler
	// The interpreter is significantly slower (but the compiler introduces [startup latency](https://github.com/ncruces/go-sqlite3/discussions/32)).
	// Use wazero.NewRuntimeConfigInterpreter() to always use the interpreter.
	sqlite3.RuntimeConfig = wazero.NewRuntimeConfigInterpreter()
}

[ncruces]

wazero doesn't use MAP_JIT. But it doesn't need W+X either: it mmaps RW initially, compiles the entire code, then mprotects it RX; it's W^X at all times.

But I honestly don't know what's the best way to handle this. If the interpreter works for you, great!

[gesellix]

Yes, I didn't dig deeper to understand the actual reason for the entitlement.
Thanks for your great package and providing those configuration options :)