Skip to content

[MacCatalyst] Added Default Entitlements for MacCatalyst projects #18669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dustin-wojciechowski merged 9 commits into from
Aug 28, 2023
Merged

[MacCatalyst] Added Default Entitlements for MacCatalyst projects #18669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ede766e
Added default entitlements for MacCatalyst projects. For Debug, an en…
dustin-wojciechowski Aug 8, 2023
f43ae76
Auto-format source code
Aug 8, 2023
483d2ea
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 8, 2023
4892823
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 21, 2023
bcae3c0
Removed network.client entitlement
dustin-wojciechowski Aug 21, 2023
a7ffe68
Fixed tests
dustin-wojciechowski Aug 21, 2023
f84522c
Update dotnet/targets/Xamarin.Shared.Sdk.DefaultItems.targets
dustin-wojciechowski Aug 23, 2023
2a79af0
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 23, 2023
2be6ea2
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions dotnet/targets/Xamarin.Shared.Sdk.DefaultItems.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,19 @@
<None Include="@(ObjcBindingCoreSource)" />
</ItemGroup>

<PropertyGroup Condition="'$(_PlatformName)' == 'MacCatalyst'">
<EnableDefaultMacCatalystReleaseEntitlements Condition="'$(EnableDefaultMacCatalystReleaseEntitlements)' == ''">True</EnableDefaultMacCatalystReleaseEntitlements>
<EnableDefaultMacCatalystDebugEntitlements Condition="'$(EnableDefaultMacCatalystDebugEntitlements)' == ''">True</EnableDefaultMacCatalystDebugEntitlements>
</PropertyGroup>

<ItemGroup Condition="'$(EnableDefaultMacCatalystDebugEntitlements)' == 'True' and '$(Configuration)' == 'Debug'">
<CustomEntitlements Include="com.apple.security.get-task-allow" Type="boolean" Value="true" />
Copy link
Contributor

@mandel-macaque mandel-macaque Aug 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 On debugging: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087731

Copy link
Contributor Author

@dustin-wojciechowski dustin-wojciechowski Aug 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Being that this isn't part of the Release configuration and only Debug, and that this is something that Xcode adds in itself to enable web debugging, wouldn't this be fine? I'll add an assert in the unit test to make sure it's not being passed into the release configuration.

</ItemGroup>

<ItemGroup Condition="'$(EnableDefaultMacCatalystReleaseEntitlements)' == 'True' and '$(Configuration)' == 'Release'">
<CustomEntitlements Include="com.apple.security.app-sandbox" Type="boolean" Value="true" />
Copy link
Contributor

@mandel-macaque mandel-macaque Aug 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 since it allows sandboxing on catalyst apps: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_app-sandbox

Copy link
Contributor Author

@dustin-wojciechowski dustin-wojciechowski Aug 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was under the impression that Xcode also automatically adds this entitlement for apps that run on MacOS: https://developer.apple.com/documentation/uikit/mac_catalyst/creating_a_mac_version_of_your_ipad_app

@rolfbjarne Should app-sandbox get the same treatment as network.client? MAUI wanted this in our sdk.. can you publish Mac Catalyst apps in the Mac App Store without this entitlement?

Copy link
Member

@rolfbjarne rolfbjarne Aug 24, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you publish Mac Catalyst apps in the Mac App Store without this entitlement?

No: "To distribute a macOS app through the Mac App Store, you must enable the App Sandbox capability."

</ItemGroup>

<!-- Architecture -->
<!-- If the old-style variables are set, use those -->
<PropertyGroup Condition=" '$(TargetArchitectures)' == '' ">
Expand Down
26 changes: 26 additions & 0 deletions tests/dotnet/UnitTests/ProjectTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1270,6 +1270,32 @@ public void AutoAllowJitEntitlements (ApplePlatform platform, string runtimeIden
}
}

[TestCase (ApplePlatform.MacCatalyst, "maccatalyst-x64", "Release")]
[TestCase (ApplePlatform.MacCatalyst, "maccatalyst-x64", "Debug")]
public void CheckForMacCatalystDefaultEntitlements (ApplePlatform platform, string runtimeIdentifiers, string configuration)
{
var project = "Entitlements";
Configuration.IgnoreIfIgnoredPlatform (platform);
Configuration.AssertRuntimeIdentifiersAvailable (platform, runtimeIdentifiers);

var project_path = GetProjectPath (project, runtimeIdentifiers: runtimeIdentifiers, platform: platform, out var appPath, configuration: configuration);
Clean (project_path);

var properties = GetDefaultProperties (runtimeIdentifiers);
properties ["Configuration"] = configuration;
DotNet.AssertBuild (project_path, properties);

var executable = GetNativeExecutable (platform, appPath);
var foundEntitlements = TryGetEntitlements (executable, out var entitlements);
Assert.IsTrue (foundEntitlements, "Issues found with Entitlements.");
if (configuration == "Release") {
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.app-sandbox")?.Value, "com.apple.security.app-sandbox enlistment was not found in Release configuration.");
Assert.IsNull (entitlements.Get<PBoolean> ("com.apple.security.get-task-allow")?.Value, "com.apple.security.get-task-allow enlistment was found in Release configuration.");
} else if (configuration == "Debug") {
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.get-task-allow")?.Value, "com.apple.security.get-task-allow enlistment was not found in Debug configuration.");
}
}

// [TestCase (ApplePlatform.MacCatalyst, null, "Release")]
[TestCase (ApplePlatform.MacOSX, null, "Release")]
public void NoWarnCodesign (ApplePlatform platform, string runtimeIdentifiers, string configuration)
Expand Down