using provisioning profile for codesigning macos apps

Gruntfile.js

@@ -599,14 +599,20 @@ module.exports = function (grunt) {
                     return getCodeSignConfig().identities.app;
                 },
                 hardenedRuntime: true,
-                entitlements: 'package/osx/entitlements.mac.plist',
-                'entitlements-inherit': 'package/osx/entitlements.mac.plist',
+                entitlements: 'package/osx/entitlements.plist',
+                'entitlements-inherit': 'package/osx/entitlements-inherit.plist',
                 'gatekeeper-assess': false
             },
             'desktop-x64': {
+                options: {
+                    'provisioning-profile': './keys/keeweb.provisionprofile'
+                },
                 src: 'tmp/desktop/KeeWeb-darwin-x64/KeeWeb.app'
             },
             'desktop-arm64': {
+                options: {
+                    'provisioning-profile': './keys/keeweb.provisionprofile'
+                },
                 src: 'tmp/desktop/KeeWeb-darwin-arm64/KeeWeb.app'
             },
             'installer': {

package/osx/entitlements.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.get-task-allow</key>
+    <true/>
+    <key>keychain-access-groups</key>
+    <array>
+      <string>3LE7JZ657W.net.antelle.keeweb</string>
+    </array>
+    <key>com.apple.application-identifier</key>
+    <string>3LE7JZ657W.net.antelle.keeweb</string>
+    <key>com.apple.developer.team-identifier</key>
+    <string>3LE7JZ657W</string>
+  </dict>
+</plist>