diff --git a/build/build.xml b/build/build.xml
index 72e2fce41..22f85d39a 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -514,11 +514,11 @@
   <target name="macosx-build-avr-toolchain" unless="light_bundle">
     <antcall target="avr-toolchain-bundle">
       <param name="unpack_target" value="untar-native"/>
-      <param name="gcc_archive_file" value="avr-gcc-${AVRGCC-VERSION}-x86_64-apple-darwin14.tar.bz2"/>
+      <param name="gcc_archive_file" value="avr-gcc-${AVRGCC-VERSION}-x86_64-apple-darwin14-signed.tar.bz2"/>
       <param name="gcc_version" value="${AVRGCC-VERSION}"/>
-      <param name="avrdude_archive_file" value="avrdude-${AVRDUDE-VERSION}-x86_64-apple-darwin12.tar.bz2"/>
+      <param name="avrdude_archive_file" value="avrdude-${AVRDUDE-VERSION}-x86_64-apple-darwin12-signed.tar.bz2"/>
       <param name="avrdude_version" value="${AVRDUDE-VERSION}"/>
-      <param name="arduinoOTA_archive_file" value="arduinoOTA-${arduinoOTA-VERSION}-darwin_amd64.tar.bz2"/>
+      <param name="arduinoOTA_archive_file" value="arduinoOTA-${arduinoOTA-VERSION}-darwin_amd64-signed.tar.bz2"/>
       <param name="arduinoOTA_version" value="${arduinoOTA-VERSION}"/>
     </antcall>
 
@@ -556,7 +556,7 @@
 
     <!-- Sign app -->
     <exec executable="codesign" dir="macosx/work" failonerror="true">
-      <arg line="--keychain &quot;${macosx-sign-keychain}&quot; --force -s &quot;${macosx-sign-id}&quot; --deep -v Arduino.app/" />
+      <arg line="--keychain &quot;${macosx-sign-keychain}&quot; --force -s &quot;${macosx-sign-id}&quot; --timestamp --options runtime --deep -v Arduino.app/" />
     </exec>
 
     <!-- Check for successful signing -->
diff --git a/build/macosx/arduinoOTA-1.3.0-darwin_amd64-signed.tar.bz2.sha b/build/macosx/arduinoOTA-1.3.0-darwin_amd64-signed.tar.bz2.sha
new file mode 100644
index 000000000..7e29e1b40
--- /dev/null
+++ b/build/macosx/arduinoOTA-1.3.0-darwin_amd64-signed.tar.bz2.sha
@@ -0,0 +1 @@
+d36e992b402ff0f41e458c527ebd433827c55c1c
diff --git a/build/macosx/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-apple-darwin14-signed.tar.bz2.sha b/build/macosx/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-apple-darwin14-signed.tar.bz2.sha
new file mode 100644
index 000000000..4388da488
--- /dev/null
+++ b/build/macosx/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-apple-darwin14-signed.tar.bz2.sha
@@ -0,0 +1 @@
+c641845446426e3fabf5d1b3f01ef7921ae227cf
diff --git a/build/macosx/avrdude-6.3.0-arduino17-x86_64-apple-darwin12-signed.tar.bz2.sha b/build/macosx/avrdude-6.3.0-arduino17-x86_64-apple-darwin12-signed.tar.bz2.sha
new file mode 100644
index 000000000..2bcc96d20
--- /dev/null
+++ b/build/macosx/avrdude-6.3.0-arduino17-x86_64-apple-darwin12-signed.tar.bz2.sha
@@ -0,0 +1 @@
+0694b2f647b9cf847e38dacd6b54c6a8591dc323
diff --git a/build/macosx/gcc.entitlements b/build/macosx/gcc.entitlements
new file mode 100644
index 000000000..123d12a53
--- /dev/null
+++ b/build/macosx/gcc.entitlements
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
diff --git a/build/macosx/jre2.entitlements b/build/macosx/jre2.entitlements
new file mode 100644
index 000000000..afa54db33
--- /dev/null
+++ b/build/macosx/jre2.entitlements
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>