Code Signature Invalid crash using com.apple.security.cs.allow-jit

In this Apple forum thread: App not launching after signing with hardened runtime, Apple developer relations says:

If your app uses a JIT, you should only need

com.apple.security.cs.allow-jit

If that’s insufficient, you need to dig into the code to find out why.

IINA is using the OpenResty LuaJIT library and using that entitlement resulted in "Code Signature Invalid" crashes as reported in IINA issue https://github.com/iina/iina/issues/3551

The problem appears to be that LuaJIT is not following the best practices specified in this Apple document: Porting Just-In-Time Compilers to Apple Silicon

Another developer pointed out that LuaJIT is not using the MAP_JIT flag, one of the requirements specified in the above document:

low-batt@gag luajit2 (v2.1-agentzh $=)$ grep -inr 'MAP_JIT' *
low-batt@gag luajit2 (v2.1-agentzh $=)$ 

That means instead of the Allow Execution of JIT-compiled Code Entitlement, IINA must use the Allow Unsigned Executable Memory Entitlement, for which Apple warns:

Including this entitlement exposes your app to common vulnerabilities in memory-unsafe code languages. Carefully consider whether your app needs this exception.

Therefore for security reasons it is desirable that LuaJIT be updated to follow Apple's best practices for JIT compilers and support use of the more restrictive Allow Execution of JIT-compiled Code Entitlement.

Start by tracing LuaJIT's JIT memory-allocation paths and compare their behavior with Apple's Porting Just-In-Time Compilers to Apple Silicon guidance, especially MAP_JIT. Reproduce the IINA Code Signature Invalid crash on Apple Silicon with the allow-jit entitlement. Done means LuaJIT supports the required entitlement without relying on the less restrictive unsigned-executable-memory exception.