From 7b3d620efa27c8ea27c8cffc1cb7148ea064b8f0 Mon Sep 17 00:00:00 2001
From: NimBold <NimBold@users.noreply.github.com>
Date: Thu, 11 Jun 2026 05:20:07 +0330
Subject: [PATCH] fix(build): revert to one-file yt-dlp binary to bypass macOS
 Gatekeeper Library Validation

Gatekeeper enforces Library Validation and prevents `dlopen` of quarantined ad-hoc signed dynamic libraries on ARM64. Because the `_internal` folder was shipped inside the DMG, the user's system flagged it with the com.apple.quarantine attribute, causing the Python shared library to fail to load inside `yt-dlp`.

By reverting back to the single-file PyInstaller binary (which is now properly code-signable without corruption on macOS), PyInstaller extracts the `_internal` folder at runtime to `/var/folders/...`. These extracted files do not inherit the quarantine flag, allowing AMFI to successfully load them and completely bypassing the dlopen system policy rejection.
---
 .github/workflows/release.yml |  9 ++-------
 Scripts/create_app_bundle.sh  | 24 +++++++-----------------
 2 files changed, 9 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 49dd619..1753855 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,13 +67,8 @@ jobs:
         run: |
           mkdir -p Sources/Firelink
 
-          # Download the one-folder macOS build. The direct one-file binary is not code-signable.
-          curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o yt-dlp.zip
-          mkdir -p yt-dlp-macos
-          unzip -q -o yt-dlp.zip -d yt-dlp-macos
-          mv yt-dlp-macos/yt-dlp_macos Sources/Firelink/yt-dlp
-          cp -R yt-dlp-macos/_internal Sources/Firelink/_internal
-          rm -rf yt-dlp.zip yt-dlp-macos
+          # Download the one-file macOS build. PyInstaller on macOS now properly supports code-signing without corrupting the archive.
+          curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos -o Sources/Firelink/yt-dlp
           chmod +x Sources/Firelink/yt-dlp
 
           # Download latest FFmpeg release build for macOS ARM64 from Martin Riedl's build server
diff --git a/Scripts/create_app_bundle.sh b/Scripts/create_app_bundle.sh
index 2d0bd48..7f1dd70 100755
--- a/Scripts/create_app_bundle.sh
+++ b/Scripts/create_app_bundle.sh
@@ -28,32 +28,22 @@ is_valid_mach_o() {
 
 ensure_ytdlp() {
   local ytdlp_path="$ROOT_DIR/Sources/Firelink/yt-dlp"
-  local ytdlp_internal_path="$ROOT_DIR/Sources/Firelink/_internal"
 
-  if [[ -x "$ytdlp_path" ]] && [[ -d "$ytdlp_internal_path" ]] && is_valid_mach_o "$ytdlp_path"; then
+  if [[ -x "$ytdlp_path" ]] && is_valid_mach_o "$ytdlp_path"; then
     return
   fi
 
-  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null; then
-    echo "WARNING: yt-dlp or its runtime is missing or malformed, and curl/unzip are not available to refresh it." >&2
+  if ! command -v curl >/dev/null; then
+    echo "WARNING: yt-dlp is missing, and curl is not available to refresh it." >&2
     return
   fi
 
   echo "Refreshing bundled yt-dlp runtime..."
-  local temp_dir
-  temp_dir="$(mktemp -d)"
-  curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o "$temp_dir/yt-dlp.zip"
-  unzip -q -o "$temp_dir/yt-dlp.zip" -d "$temp_dir"
-  cp "$temp_dir/yt-dlp_macos" "$ytdlp_path"
+  curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos -o "$ytdlp_path"
   chmod +x "$ytdlp_path"
-
-  if [[ -d "$temp_dir/_internal" ]]; then
-    rm -rf "$ROOT_DIR/Sources/Firelink/_internal"
-    cp -R "$temp_dir/_internal" "$ROOT_DIR/Sources/Firelink/_internal"
-    touch "$ROOT_DIR/Sources/Firelink/_internal/.gitkeep"
-  fi
-
-  rm -rf "$temp_dir"
+  
+  # Remove legacy _internal directory if it exists
+  rm -rf "$ROOT_DIR/Sources/Firelink/_internal"
 }
 
 ensure_ytdlp