Repository: godot
Issue: MacOS Notarization "The executable does not have the hardened runtime enabled. " using anything other than Xcode codesign
Labels: bug,platform:macos,topic:export

### Godot version

v4.1.2.stable.mono.official [399c9dc39]

### System information

Godot v4.1.2.stable.mono - macOS 14.0.0 - Vulkan (Forward+) - integrated Apple M1 Max - Apple M1 Max (10 Threads)

### Issue description

When attempting to perform notarization for MacOS, will fail with "The executable does not have the hardened runtime enabled. " regardless of what options you choose unless you use Xcode codesign.

Been trying to chase this one down for a few hours and I'm not seeing where we can configure this in the MacOS export.

I have the export Distribution Type set to - Distribution.

In the entitlements I have enabled the App Sandbox (I'm assuming this enables the hardened runtime as I see no other options), Network Server, Network Client, Device USB, and Device Bluetooth. No other entitlements are enabled (including Debugging - which I specifically turned off).

I am using the rcodesign tool in CodeSign and I have been able to confirm that the TeamID, Cert, and cert password are all correct. The only errors that I'm getting back are

`{
      "severity": "error",
      "code": null,
      "path": "MyGodotGame.dmg/Test Project.app/Contents/MacOS/Test Project",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087724",
      "architecture": "arm64"
    }`

The only way I have been able to get this to work and be accepted is to use the option "Xcode codesign"

Apple Team ID

Using the Apple Team Id that comes from the https://developer.apple.com/ website where the Team Id is located in Membership Details

Identity

Open the Developer ID Application in Keychain Access and copy the Common Name that is here. Yes, that means ALL of the text in the common name including the "Developer ID Application: COMPANY NAME (APPLE TEAM ID)" in its entirety.

However, if you use any of the other more "open source" methods - they don't appear to actually work (and should probably be removed from the profile).

Source: https://www.reddit.com/r/godot/comments/178y13o/macos_notarization_the_executable_does_not_have/

### Steps to reproduce

1/ Create an empty project
2/ Perform export for MacOS to rcodesign (note XCode codesign displayed here is for a working config)

<img width="459" alt="image" src="https://github.com/godotengine/godot/assets/95954/e40ba7e4-b4dd-447d-a929-5e07922dba1d">

3/ Set the entitlements after enabling the AppSandbox - note since there is nothing in the interface that speaks to hardened runtime, this will be the more obvious assumption - that this is what activates the hardened runtime
<img width="466" alt="image" src="https://github.com/godotengine/godot/assets/95954/9305a68a-8927-414e-9517-425a6ddc17b6">

4/ Set the Notorization method to Xcode Notary
 
<img width="454" alt="image" src="https://github.com/godotengine/godot/assets/95954/28a7b80c-2aba-4883-bcb2-854b2fb0266e">

5/ Select "Export Project" to produce the DMG for distribution

6/ Pull the status of the notarization

xcrun notarytool history --apple-id {appleId} --team-id {apple Team Id}


### Minimal reproduction project

N/A