App Sandbox entitlement stripped from dext by Xcode?

Question

Created Mar ’24

Replies 4

Boosts 2

Participants 3

I have a macOS app which contains a dext. I'd like to distribute it to external testers using TestFlight, so it has to pass Mac App Store review. It failed, because the App Sandbox entitlement was missing.

I checked the app, it has the entitlement, but the dext does not. However, the .entitlements file used by the dext does contain App Sandbox set to true.

I tried adding a "fake-entitlement" value to the .entitlements file, and that made it into the dext's code signature, but the App Sandbox entitlement appears to be stripped out by the build process?

For a dext target, it isn't possible to add the App Sandbox capability in Xcode's Signing and Capability section. I have to add the entitlement manually in the .entitlement file (or it was put there by the Xcode driver template, I don't remember).

I've tried clean building several times, I've tried Xcode 15.0.1, 15.2 and 15.3, but the result is always the same. I'm inspecting the entitlements using codesign -dvvv --entitlements - <path-to-dext>

Does anyone know what I can do to put the App Sandbox entitlement into my dext's signature? Is this happening to anyone else?

Boost

Answer 1

ssmith_c OP

Mar ’24

I filed a bug with a minimal macOS project with a DriverKit dext which exhibits this same behavior, FB13688443

0

Answer 2

KivancG OP

Jun ’24

Hi @ssmith_c , I have the same issue. Did you manage to solve it?

The weird thing is that although the "app sandbox" entitlement is unnecessary for the DriverKit project, the Apple store review team constantly asks for it, and no documents describe how to do that.

0

Answer 3

ssmith_c OP

Jul ’24

Hi @KivancG I "solved" the problem by contacting the app review team and referencing the bug, FB13688443.

1

Answer 4

Kivg OP

Jul ’24

Thank you, @ssmith_c . I'm struggling with the same issue now, and I couldn't get any support but you. I couldn't access the bug you referenced. What was it about ?

As I inspected the details of the Xcode signing process, I saw the app sandbox entitlement is stripped in the progress between clicking the distribute button ( in the Xcode archiver ) and sending it to the Apple Store connect. The entitlement is present before that, which I can see when I inspect the archive artifact ( it is embedded inside the DEXT executable ).

0