fix(build): revert to one-file yt-dlp binary to bypass macOS Gatekeeper Library Validation

Gatekeeper enforces Library Validation and prevents `dlopen` of quarantined ad-hoc signed dynamic libraries on ARM64. Because the `_internal` folder was shipped inside the DMG, the user's system flagged it with the com.apple.quarantine attribute, causing the Python shared library to fail to load inside `yt-dlp`.

By reverting back to the single-file PyInstaller binary (which is now properly code-signable without corruption on macOS), PyInstaller extracts the `_internal` folder at runtime to `/var/folders/...`. These extracted files do not inherit the quarantine flag, allowing AMFI to successfully load them and completely bypassing the dlopen system policy rejection.
This commit is contained in:
NimBold
2026-06-11 05:20:07 +03:30
parent db293a2613
commit 7b3d620efa
2 changed files with 9 additions and 24 deletions
+2 -7
View File
@@ -67,13 +67,8 @@ jobs:
run: |
mkdir -p Sources/Firelink
# Download the one-folder macOS build. The direct one-file binary is not code-signable.
curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o yt-dlp.zip
mkdir -p yt-dlp-macos
unzip -q -o yt-dlp.zip -d yt-dlp-macos
mv yt-dlp-macos/yt-dlp_macos Sources/Firelink/yt-dlp
cp -R yt-dlp-macos/_internal Sources/Firelink/_internal
rm -rf yt-dlp.zip yt-dlp-macos
# Download the one-file macOS build. PyInstaller on macOS now properly supports code-signing without corrupting the archive.
curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos -o Sources/Firelink/yt-dlp
chmod +x Sources/Firelink/yt-dlp
# Download latest FFmpeg release build for macOS ARM64 from Martin Riedl's build server