From a0947fe13ea88f47c25ebf7de2a4df9630556ecd Mon Sep 17 00:00:00 2001 From: ciregenz Date: Sun, 5 Jul 2026 16:53:00 -0700 Subject: [PATCH] [eric] build: VMP_REQUIRE_SIGN=0 override for cred-less local cuts (CI keeps the hard gate) --- scripts/build-app.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/build-app.sh b/scripts/build-app.sh index 88b92e42..bca64678 100755 --- a/scripts/build-app.sh +++ b/scripts/build-app.sh @@ -69,7 +69,8 @@ if $SIGN_MODE; then # A signed build is a build users actually run, so its Widevine VMP signature # is mandatory: the afterPack hook hard-fails on a missing/failed signature # instead of shipping a DMG whose Spotify/Netflix audio is silently dead. - export VMP_REQUIRE_SIGN=1 + # Respect an explicit outer VMP_REQUIRE_SIGN=0: a cred-less local cut may consciously ship DRM-limited (CI always has EVS secrets, so releases from CI keep the hard gate). + export VMP_REQUIRE_SIGN=${VMP_REQUIRE_SIGN:-1} fi # Step 0: Ensure bundled uv + uvx binaries exist.