Repository navigation
Conversation
Under the hardened runtime without this entitlement, Bun starts and passes smoke tests but runs with its JIT off. On the shipped 0.6.4 arm64 binary, a CPU loop took about 1690 ms, against about 140 ms for the same bytes with the entitlement. Startup is unaffected: `--version` and `--help` take about 200 ms either way. `verify_code_signing` asserts the entitlement because nothing else would notice it going missing. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the macOS signing change that enables Bun’s JIT.
No open issues 🎉
What changed in this PR
Enables Bun’s JIT in signed macOS CLI binaries by adding the allow-jit entitlement while retaining the hardened runtime’s other protections.
Changes:
- Adds a shared entitlement file to both macOS signing paths.
- Extends Fastlane verification to require the entitlement to be explicitly enabled.
- Adds a patch changeset describing the CPU-heavy JavaScript performance improvement.
| File | Description |
|---|---|
packages/cli/scripts/sign-macos-binaries.ts |
Passes the shared entitlement file to codesign. |
packages/cli/macos.entitlements |
Enables only com.apple.security.cs.allow-jit. |
fastlane/Fastfile |
Applies the entitlement during signing and verifies its value. |
.changeset/macos-allow-jit-entitlement.md |
Documents the signing fix in a patch release note. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The macOS binaries are signed with the hardened runtime but no entitlements, and under those conditions Bun silently runs with its JIT off.
Nothing fails: the binary starts, notarizes, and passes smoke tests, so the signing checks never caught it.
This came up while setting up CLI signing for another Bun project.
Measured on the shipped 0.6.4 binaries, with a CPU-bound JavaScript loop:
Impact
Startup doesn't change:
--version,--helpandchats --helptake about 200 ms with or without the entitlement. So only CPU-heavy JavaScript gets faster, and most commands, which wait on I/O, may not change noticeably. I didn't time commands that talk to a server.Tradeoff
allow-jitis the only entitlement added. Bun needs it to run its JIT, and the other hardened runtime protections stay on, including library validation and the block on unsigned executable memory. The cost is that a memory-corruption bug would have an easier route to running code. It seems a small added risk for a CLI that runs its own bundled code.How to test
Build 17 built from source, then signed and notarized both architectures. From its downloaded release archives, both binaries have the entitlement,
spctlreportsNotarized Developer ID, and the JIT is on.verify_code_signingfails on the shipped 0.6.4 binary, on one with the entitlement set tofalse, and on an ad-hoc signature.packages/cli/scripts/sign-macos-binaries.tsgot the same flag, but neither Buildkite nor my local runs exercise it.To reproduce on a built or released binary: