10

I have an App created in xCode 5 which includes a bundled executable file. I am trying to submit the app to the Mac App store, however when I submit it it fails with the following message:

App sandbox not enabled - The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list. Refer to the App Sandbox page for more information on sandboxing your app.

I have created an entitlements file (EXECUTABLE_NAME.entitlements), containing the 'com.apple.security.app-sandbox' key with a value of 'true'...

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
    </dict>
</plist>

...but the app still fails.

What am I missing (or what have I done wrong) to get the bundled executable file code signed?

2 Answers 2

13

I resolved this issue in the following manner:

1) the .plist file was missing the inherit key, so I modified it thus:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
        <key>com.apple.security.inherit</key>
        <true/>
    </dict>
</plist>

that on its own won't do the job, to actually code sign the file I did the following:

  1. archive the app
  2. open xCode's Organizer window
  3. right-click on the archive and select 'Show in Finder' to get its location
  4. With Terminal.app, navigate to its location and then inside the app bundle /Contents/Resources/
  5. Run the following command:

    codesign -f -s "$YOUR_CERTIFICATE_HERE" --entitlements "$THE_ENTITLEMENTS_PLIST" "$THE_EXECUTABLE"

for $YOUR_CERTIFICATE_HERE use your 3rd Party Mac Developer Application certificate

Once this is done, the app should upload to iTunes Connect and you will be able to see the relevant code signing information under the 'Binary Details' section.

2
  • very good answer. The entitlement file is in the same directory named "archived-expanded-entitlements.xcent"
    – Tibidabo
    Apr 8, 2016 at 4:56
  • This sort of worked for me... and sort of didn't. By adding the entitlements com.apple.security.app-sandbox=true and com.apple.security.inherit=true it did indeed stop Xcode's validator whining. However, when my app launched those executables with NSTask (which is what it happens to do with them), or when I launched them manually in the Terminal, they would crash instantly. I suspect 'inherit' confuses the sandbox when an executable is launched all by itself - but I do not know that for sure. Watch out for this if NSTask is your use case for this fix! Sep 30, 2016 at 17:45
8

@dmid's answer is correct and works.

But it could be simpler. Let's say the executable is myexe:

create myexe.entitlements file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
        <key>com.apple.security.inherit</key>
        <true/>
</dict>
</plist>

Run command:

codesign -f -s "$YOUR_CERTIFICATE_HERE" --entitlements "myexe.entitlements" "myexe"

Done!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.