macOS 26: Local Network Discovery and Connections does not work (again)

[belthesar]

Hi folks -

I've updated my test system to macOS 26 and tested Winbox-Mac. Unfortunately, it appears that the workaround that I was using to get the necessary entitlements for local network access is no longer working. I will see if there is a way to restore this functionality again, however the fact that the workaround is patched is generally a security posture improvement for macOS.

Until further notice, if you still depend on Winbox-Mac for accessing your Mikrotik devices, I highly encourage you to either hold off on upgrading to macOS 26 or probably more importantly, consider (re-)evaluating the officially supported Winbox 4 from Mikrotik.

The Winbox-Mac package in Homebrew will be marked as incompatible with macOS 26 Tahoe in the interim.

[cvetaevvitaliy]

For macOS 26 (Tahoe) - Local Network Access & Signing Fix

On macOS 26, the previous entitlement injection trick no longer works.
However, it’s still possible to restore basic LAN discovery and allow WinBox to run with proper permissions by fixing the Info.plist and re-signing the .app bundle ad-hoc.

I wrote a bash script that:
* 📝 Backs up and cleans up Info.plist (removes invalid keys, adds NSLocalNetworkUsageDescription and NSBonjourServices entries);
* 🧹 Removes Gatekeeper quarantine flags;
* 🔐 Ad-hoc signs all Mach-O binaries inside the bundle and then the app itself;
* 🧪 Verifies the signature.

This doesn’t fully restore Layer-2 MAC connectivity (that’s a Wine limitation), but it ensures WinBox can still access LAN over UDP 5678 and show neighbors if you use a BPF-based MNDP proxy or connect by IP.

Usage:

bash sign-winbox.sh
# or bash sign-winbox.sh "/Applications/Winbox-mac.app" if you have a different path
# or revert to original Info.plist
bash sign-winbox.sh --revert

Copy it to a file, for example sign-winbox.sh, make it executable chmod +x sign-winbox.shand run

#!/usr/bin/env bash
# sign-winbox.sh - Fix Info.plist + remove quarantine + ad-hoc sign Winbox-mac.app (Wine build)
# Usage:
#   bash sign-winbox.sh [PATH_TO_APP]
#   bash sign-winbox.sh --revert [PATH_TO_APP]
#
# Notes:
# - Requires macOS (PlistBuddy, codesign, plutil available by default).
# - No Developer ID needed (ad-hoc signing).
# - Firewall rule still may be needed manually for wine64 binary.
# - For MNDP neighbors in Wine: signing isn't enough for L2; use IP or BPF-proxy/VM if needed.

set -euo pipefail

APP_DEFAULT="/Applications/Winbox-mac.app"
APP="${2:-${1:-$APP_DEFAULT}}"
REVERT="false"

if [[ "${1:-}" == "--revert" ]]; then
  REVERT="true"
  shift || true
  APP="${1:-$APP_DEFAULT}"
fi

PLIST="$APP/Contents/Info.plist"
PLB="/usr/libexec/PlistBuddy"

bold() { printf "\033[1m%s\033[0m\n" "$*"; }
info() { printf "  • %s\n" "$*"; }
ok()   { printf "  ✓ %s\n" "$*"; }
warn() { printf "  ⚠ %s\n" "$*"; }
err()  { printf "  ✗ %s\n" "$*" >&2; }

require() {
  if ! command -v "$1" >/dev/null 2>&1; then
    err "Required tool '$1' not found."
    exit 1
  fi
}

check_app() {
  if [[ ! -d "$APP" ]]; then
    err "App bundle not found: $APP"
    exit 1
  fi
  if [[ ! -f "$PLIST" ]]; then
    err "Missing Info.plist: $PLIST"
    exit 1
  fi
}

backup_plist() {
  local bak="$PLIST.bak.$(date +%Y%m%d-%H%M%S)"
  sudo cp "$PLIST" "$bak"
  ok "Backup created: $bak"
  echo "$bak" >"$APP/.plist_backup_path"
}

revert_plist() {
  if [[ -f "$APP/.plist_backup_path" ]]; then
    local bak
    bak="$(cat "$APP/.plist_backup_path")"
    if [[ -f "$bak" ]]; then
      sudo cp "$bak" "$PLIST"
      ok "Reverted Info.plist from backup: $bak"
      exit 0
    fi
  fi
  err "No backup record found. Nothing to revert."
  exit 1
}

fix_plist() {
  bold "Fixing Info.plist…"

  # Remove dangling/empty keys if present
  if $PLB -c "Print :NSHumanReadableCopyright" "$PLIST" >/dev/null 2>&1; then
    sudo $PLB -c "Delete :NSHumanReadableCopyright" "$PLIST" || true
    ok "Removed NSHumanReadableCopyright"
  fi

  # Ensure NSLocalNetworkUsageDescription
  if ! $PLB -c "Print :NSLocalNetworkUsageDescription" "$PLIST" >/dev/null 2>&1; then
    sudo $PLB -c "Add :NSLocalNetworkUsageDescription string 'WinBox requires access to the local network to discover and manage MikroTik devices.'" "$PLIST"
    ok "Added NSLocalNetworkUsageDescription"
  else
    ok "NSLocalNetworkUsageDescription already present"
  fi

  # Ensure NSBonjourServices contains _services._dns-sd._udp.
  if ! $PLB -c "Print :NSBonjourServices" "$PLIST" >/dev/null 2>&1; then
    sudo $PLB -c "Add :NSBonjourServices array" "$PLIST"
    ok "Created NSBonjourServices array"
  fi
  if ! $PLB -c "Print :NSBonjourServices" "$PLIST" 2>/dev/null | grep -Fq "_services._dns-sd._udp."; then
    # Find next index:
    local count
    count="$($PLB -c "Print :NSBonjourServices" "$PLIST" 2>/dev/null | awk 'BEGIN{c=0} /^\s{4}\S+ =/ {c++} END{print c}')"
    sudo $PLB -c "Add :NSBonjourServices:$count string _services._dns-sd._udp." "$PLIST"
    ok "Added _services._dns-sd._udp. to NSBonjourServices"
  else
    ok "NSBonjourServices already includes _services._dns-sd._udp."
  fi

  # Ensure valid XML
  plutil -lint "$PLIST" >/dev/null
  sudo plutil -convert xml1 "$PLIST" >/dev/null 2>&1 || true
  ok "Info.plist validated"
}

remove_quarantine() {
  bold "Removing quarantine (Gatekeeper attributes)…"
  sudo xattr -r -d com.apple.quarantine "$APP" 2>/dev/null || true
  ok "Quarantine cleared (or absent)"
}

sign_inner() {
  bold "Ad-hoc signing inner Mach-O files…"
  # Find executable files, filter Mach-O, sign each
  mapfile -t machos < <(find "$APP" -type f -perm -111 -print0 | xargs -0 file | awk -F: '/Mach-O/{print $1}')
  if ((${#machos[@]}==0)); then
    warn "No inner Mach-O binaries found to sign (unexpected)."
    return 0
  fi
  for f in "${machos[@]}"; do
    info "Signing: $f"
    sudo codesign --force --sign - "$f"
  done
  ok "Inner Mach-O signing done"
}

sign_bundle() {
  bold "Ad-hoc signing the .app bundle (deep)…"
  sudo codesign --deep --force --sign - "$APP"
  ok "Bundle signed"
}

verify() {
  bold "Verifying codesign…"
  info "codesign -dv --verbose=4"
  codesign -dv --verbose=4 "$APP" 2>&1 | sed 's/^/  /'
  echo
  info "spctl --assess -vv (ad-hoc may warn; safe for local use)"
  spctl --assess -vv "$APP" 2>&1 | sed 's/^/  /' || true
}

post_notes() {
  echo
  bold "Next steps / Notes:"
  echo "  • Add firewall allow rule (if needed):"
  echo "      System Settings → Network → Firewall → Options… → Add:"
  echo "        $APP/Contents/Resources/wine/bin/wine64"
  echo "      set: Allow incoming connections"
  echo "  • Launch app:"
  echo "      \"$APP/Contents/MacOS/winbox-mac\""
  echo "  • If Neighbors is still empty: that's Layer-2/MNDP, not codesign."
  echo "      Use IP connect, BPF-based MNDP proxy, or Windows VM (Bridged) for full L2."
  echo
  ok "All done."
}

main() {
  require codesign
  require plutil
  require "$PLB"
  check_app

  if [[ "$REVERT" == "true" ]]; then
    revert_plist
  fi

  bold "Signing target: $APP"
  backup_plist
  fix_plist
  remove_quarantine
  sign_inner
  sign_bundle
  verify
  post_notes
}

main "$@"

[belthesar]

This is a neat solution! I wish I could use it to keep the bundle going, but Homebrew is gonna look poorly at including code to do self signing in there. There's a world where this could remain a resource for folks to sign the bundle should they choose to do so at their own risk.

Do you know if codesign requires having Xcode CLI tools installed?