Skip to content

[MacCatalyst] Added Default Entitlements for MacCatalyst projects #18669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dustin-wojciechowski merged 9 commits into from
Aug 28, 2023
Merged

[MacCatalyst] Added Default Entitlements for MacCatalyst projects #18669

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ede766e
Added default entitlements for MacCatalyst projects. For Debug, an en…
dustin-wojciechowski Aug 8, 2023
f43ae76
Auto-format source code
Aug 8, 2023
483d2ea
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 8, 2023
4892823
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 21, 2023
bcae3c0
Removed network.client entitlement
dustin-wojciechowski Aug 21, 2023
a7ffe68
Fixed tests
dustin-wojciechowski Aug 21, 2023
f84522c
Update dotnet/targets/Xamarin.Shared.Sdk.DefaultItems.targets
dustin-wojciechowski Aug 23, 2023
2a79af0
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 23, 2023
2be6ea2
Merge branch 'main' into dev/default-entitlements-for-maccatalyst
dustin-wojciechowski Aug 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions dotnet/targets/Xamarin.Shared.Sdk.DefaultItems.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,20 @@
<None Include="@(ObjcBindingCoreSource)" />
</ItemGroup>

<PropertyGroup Condition="'$(_PlatformName)' == 'MacCatalyst'">
<EnableDefaultMacCatalystReleaseEntitlements Condition="'$(EnableDefaultMacCatalystReleaseEntitlements)' == ''">True</EnableDefaultMacCatalystReleaseEntitlements>
<EnableDefaultMacCatalystDebugEntitlements Condition="'$(EnableDefaultMacCatalystDebugEntitlements)' == ''">True</EnableDefaultMacCatalystDebugEntitlements>
</PropertyGroup>

<ItemGroup Condition="'$(EnableDefaultMacCatalystDebugEntitlements)' == 'True' and '$(Configuration)' == 'Debug'">
<CustomEntitlements Include="com.apple.security.get-task-allow" Type="boolean" Value="true" />

@mandel-macaque mandel-macaque Aug 8, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 On debugging: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087731

@dustin-wojciechowski dustin-wojciechowski Aug 21, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Being that this isn't part of the Release configuration and only Debug, and that this is something that Xcode adds in itself to enable web debugging, wouldn't this be fine? I'll add an assert in the unit test to make sure it's not being passed into the release configuration.

</ItemGroup>

<ItemGroup Condition="'$(EnableDefaultMacCatalystReleaseEntitlements)' == 'True' and '$(Configuration)' == 'Release'">
<CustomEntitlements Include="com.apple.security.app-sandbox" Type="boolean" Value="true" />

@mandel-macaque mandel-macaque Aug 8, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 since it allows sandboxing on catalyst apps: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_app-sandbox

@dustin-wojciechowski dustin-wojciechowski Aug 21, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was under the impression that Xcode also automatically adds this entitlement for apps that run on MacOS: https://developer.apple.com/documentation/uikit/mac_catalyst/creating_a_mac_version_of_your_ipad_app

@rolfbjarne Should app-sandbox get the same treatment as network.client? MAUI wanted this in our sdk.. can you publish Mac Catalyst apps in the Mac App Store without this entitlement?

@rolfbjarne rolfbjarne Aug 24, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you publish Mac Catalyst apps in the Mac App Store without this entitlement?

No: "To distribute a macOS app through the Mac App Store, you must enable the App Sandbox capability."

<CustomEntitlements Include="com.apple.security.network.client" Type="boolean" Value="true" />
Comment thread
dustin-wojciechowski marked this conversation as resolved.
Outdated
</ItemGroup>

<!-- Architecture -->
<!-- If the old-style variables are set, use those -->
<PropertyGroup Condition=" '$(TargetArchitectures)' == '' ">
Expand Down
27 changes: 27 additions & 0 deletions tests/dotnet/UnitTests/ProjectTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1273,6 +1273,33 @@ public void AutoAllowJitEntitlements (ApplePlatform platform, string runtimeIden
}
}

[TestCase (ApplePlatform.MacCatalyst, "maccatalyst-x64", "Release")]
[TestCase (ApplePlatform.MacCatalyst, "maccatalyst-x64", "Debug")]
public void CheckForMacCatalystDefaultEntitlements (ApplePlatform platform, string runtimeIdentifiers, string configuration)
{
var project = "Entitlements";
Configuration.IgnoreIfIgnoredPlatform (platform);
Configuration.AssertRuntimeIdentifiersAvailable (platform, runtimeIdentifiers);

var project_path = GetProjectPath (project, runtimeIdentifiers: runtimeIdentifiers, platform: platform, out var appPath, configuration: configuration);
Clean (project_path);

var properties = GetDefaultProperties (runtimeIdentifiers);
properties ["Configuration"] = configuration;
DotNet.AssertBuild (project_path, properties);

var executable = GetNativeExecutable (platform, appPath);
var foundEntitlements = TryGetEntitlements (executable, out var entitlements);
if (configuration == "Release") {
Assert.IsTrue (foundEntitlements, "Found in Release");
Comment thread
dustin-wojciechowski marked this conversation as resolved.
Outdated
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.app-sandbox")?.Value, "com.apple.security.app-sandbox enlistment was not found.");
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.network.client")?.Value, "com.apple.security.network.client enlistment was not found.");
Comment thread
dustin-wojciechowski marked this conversation as resolved.
Outdated
} else if (configuration == "Debug") {
Assert.IsTrue (foundEntitlements, "Found in Debug");
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.get-task-allow")?.Value, "com.apple.security.get-task-allow enlistment was not found.");
}
Comment on lines +1291 to +1296

@haritha-mohan haritha-mohan Aug 9, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i understand this format is consistent with the other tests.. but i wonder if it may be better to have a separate test per config? it might be a bit more verbose but in the future if there are more entitlements added it might be easier to keep track of and the test failure will speak for itself

otherwise lgtm

Suggested change
var executable = GetNativeExecutable (platform, appPath);
var foundEntitlements = TryGetEntitlements (executable, out var entitlements);
if (configuration == "Release") {
Assert.IsTrue (foundEntitlements, "Found in Release");
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.app-sandbox")?.Value, "com.apple.security.app-sandbox enlistment was not found.");
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.network.client")?.Value, "com.apple.security.network.client enlistment was not found.");
} else if (configuration == "Debug") {
Assert.IsTrue (foundEntitlements, "Found in Debug");
Assert.IsTrue (entitlements!.Get<PBoolean> ("com.apple.security.get-task-allow")?.Value, "com.apple.security.get-task-allow enlistment was not found.");
}
var executable = GetNativeExecutable (platform, appPath);
TryGetEntitlements (executable, out var entitlements);
if(entitlements is null)
Assert.Fail("no entitlements found");
// debug test
Assert.IsTrue (entitlements.Get<PBoolean> ("com.apple.security.app-sandbox")?.Value, "com.apple.security.app-sandbox enlistment was not found.");
// release test
Assert.IsTrue (entitlements.Get<PBoolean> ("com.apple.security.app-sandbox")?.Value, "com.apple.security.app-sandbox enlistment was not found.");
Assert.IsTrue (entitlements.Get<PBoolean> ("com.apple.security.network.client")?.Value, "com.apple.security.network.client enlistment was not found.");

}

// [TestCase (ApplePlatform.MacCatalyst, null, "Release")]
[TestCase (ApplePlatform.MacOSX, null, "Release")]
public void NoWarnCodesign (ApplePlatform platform, string runtimeIdentifiers, string configuration)
Expand Down