Is it an absolute requirement to make your app sandboxed? Can you upload apps to App Store without this entitlement?
My app works perfectly without the "com.apple.security.app-sandbox" entitlement, but adding it breaks everything. The app crashes immediately and I'm getting the "EXC_BAD_ACCESS (Code Signature Invalid)" error.
If it's a must, is there a good tutorial about how to make "sandbox" work with electron? I tried to Google it, but there seem to be many different guides and recommendations. I'm not sure which one to follow.
I'm using electron builder 21.2.0 (which has electron-osx-sign) with Electron 6.1.9.
My understanding is that in order to build a proper MAS package, I need to do the following:
- sign the app using "Mac App Distribution" and "Mac App Installer" certificates
- sign all native dependencies as well with the same certificates
Request the following entitlements (besides the ones my app actually needs)
<key>com.apple.security.application-groups</key> <array> <string>TEAM_ID.your.bundle.id</string> </array> <key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/> <key>com.apple.security.cs.allow-jit</key> <true/> <key>com.apple.security.cs.disable-library-validation</key> <true/>
My app requires only these entitlements:
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<key>com.apple.security.files.user-selected.read-only</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
Is there anything else I'm missing?
Thanks in advance for any help!