Bug 1853891 - Port bug 1593072: Add Mac signing config based on existing entitlements to fix decision task. rs=me

--HG--
extra : rebase_source : c72cf4882481b55dfb49d717dcb8dfb6ec767224

taskcluster/ci/build-mac-signing/kind.yml

@@ -9,6 +9,7 @@ transforms:
     - gecko_taskgraph.transforms.name_sanity
     - gecko_taskgraph.transforms.build_signing
     - gecko_taskgraph.transforms.signing
+    - gecko_taskgraph.transforms.hardened_signing
     - gecko_taskgraph.transforms.task
     - comm_taskgraph.transforms.signing
 

taskcluster/ci/config.yml

@@ -303,6 +303,26 @@ mac-notarization:
             macosx64.*: build/package/mac_osx/requirements.plist
             default: ''
 
+mac-signing:
+    hardened-sign-config:
+        by-release-level:
+            production:
+                - deep: false
+                  runtime: true
+                  force: true
+                  entitlements: comm/build/macosx/hardenedruntime/production.entitlements.xml
+                  globs:
+                      - "/Contents/MacOS/thunderbird-bin"
+                      - "/"
+            default:
+                - deep: false
+                  runtime: true
+                  force: true
+                  entitlements: comm/build/macosx/hardenedruntime/developer.entitlements.xml
+                  globs:
+                      - "/Contents/MacOS/thunderbird-bin"
+                      - "/"
+
 expiration-policy:
     by-project:
         try-comm-central:

taskcluster/ci/shippable-l10n-mac-signing/kind.yml

@@ -9,6 +9,7 @@ transforms:
     - gecko_taskgraph.transforms.name_sanity
     - gecko_taskgraph.transforms.shippable_l10n_signing
     - gecko_taskgraph.transforms.signing
+    - gecko_taskgraph.transforms.hardened_signing
     - gecko_taskgraph.transforms.task
     - comm_taskgraph.transforms.signing