Re-sign the Firefox release bundle using entitlements from the mozilla-central repo. Set $MOZILLA_CENTRAL to be the path to the local clone of the mozilla-central repo and set $CSID to be the signing identity.

firefox.codesign

set -x

cp -r /Applications/Firefox.app .
find Firefox.app -type f -exec codesign --remove-signature {} \;
xattr -cr Firefox.app

codesign -v --force --sign ${CSID} --options runtime \
--entitlements ${MOZILLA_CENTRAL}/security/mac/hardenedruntime/v2/production/plugin-container.xml \
Firefox.app/Contents/MacOS/plugin-container.app

codesign -v --force --sign ${CSID} --options runtime \
--entitlements ${MOZILLA_CENTRAL}/security/mac/hardenedruntime/v2/production/media-plugin-helper.xml \
Firefox.app/Contents/MacOS/media-plugin-helper.app

codesign -v --force --sign ${CSID} --options runtime \
Firefox.app/Contents/MacOS/crashreporter.app \
Firefox.app/Contents/MacOS/updater.app \
Firefox.app/Contents/Library/LaunchServices/org.mozilla.updater \
Firefox.app/Contents/MacOS/XUL \
Firefox.app/Contents/MacOS/pingsender \
Firefox.app/Contents/MacOS/minidump-analyzer \
Firefox.app/Contents/MacOS/libfreebl3.dylib \
Firefox.app/Contents/MacOS/liblgpllibs.dylib \
Firefox.app/Contents/MacOS/libsoftokn3.dylib \
Firefox.app/Contents/MacOS/libosclientcerts.dylib \
Firefox.app/Contents/MacOS/libmozavutil.dylib \
Firefox.app/Contents/MacOS/libmozglue.dylib \
Firefox.app/Contents/MacOS/libgkcodecs.dylib \
Firefox.app/Contents/MacOS/libipcclientcerts.dylib \
Firefox.app/Contents/MacOS/libmozavcodec.dylib \
Firefox.app/Contents/MacOS/libnssckbi.dylib \
Firefox.app/Contents/MacOS/libnss3.dylib \
Firefox.app/Contents/Resources/gmp-clearkey/0.1/libclearkey.dylib

codesign -v --force --sign ${CSID} --options runtime \
--entitlements ${MOZILLA_CENTRAL}/security/mac/hardenedruntime/v2/production/browser.xml \
Firefox.app/Contents/MacOS/firefox-bin \
Firefox.app