Skip to content

Commit

Permalink
Enable application sandbox
Browse files Browse the repository at this point in the history 
This enables a sandbox which is more secure and is required for App
Store submission. The application doesn't use any restricted features so
it's only required to properly migrate preferences (this is done
automatically) and storage (this is done by moving Application Support
directory using special container-migration manifest). See
https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/MigratingALegacyApp/MigratingAnAppToASandbox.html
for more details.

In order to keep auto-update work, Sparkle needed to be updated to 2.x
as 1.x doesn't work in sandboxed environment. It's not possible to
install 2.x using CocoaPods so it's now embedded as a framework. It has
been build in 2.x branch at 438f4a21. Downloading and installing updates
is implemented through XPC services to avoid adding unnecessary network
entitlements to the application sandbox. See
https://github.com/sparkle-project/Sparkle/blob/2.x/INSTALL.markdown for
more details.
  • Loading branch information
@p0deje
p0deje committed Aug 13, 2020
1 parent 71566fd commit 15a12fd
Show file tree
Hide file tree
Showing 358 changed files with 7,333 additions and 1,154 deletions.
85 changes: 57 additions & 28 deletions Maccy.xcodeproj/project.pbxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,19 @@
DAB65DFF2440AE29000AECA8 /* CoreDataManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAB65DFE2440AE29000AECA8 /* CoreDataManager.swift */; };
DAB65E0B2440B078000AECA8 /* HistoryItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAB65E0A2440B078000AECA8 /* HistoryItem.swift */; };
DAB65E0D2440B0D4000AECA8 /* HistoryItemContent.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAB65E0C2440B0D4000AECA8 /* HistoryItemContent.swift */; };
DAB8CE4224E368F200A2500E /* container-migration.plist in Resources */ = {isa = PBXBuildFile; fileRef = DAB8CE4124E368F200A2500E /* container-migration.plist */; };
DAC14124232367B200FCFA30 /* Search.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAC14123232367B200FCFA30 /* Search.swift */; };
DAD0862D24545C66002AFAEC /* Storage.xcdatamodeld in Sources */ = {isa = PBXBuildFile; fileRef = DAB65DFB2440AD63000AECA8 /* Storage.xcdatamodeld */; };
DAD20C7724E55CD200E96247 /* org.sparkle-project.Downloader.xpc in Resources */ = {isa = PBXBuildFile; fileRef = DAD20C7224E55CD100E96247 /* org.sparkle-project.Downloader.xpc */; };
DAD20C7824E55CD200E96247 /* org.sparkle-project.InstallerStatus.xpc in Resources */ = {isa = PBXBuildFile; fileRef = DAD20C7324E55CD100E96247 /* org.sparkle-project.InstallerStatus.xpc */; };
DAD20C7924E55CD200E96247 /* Sparkle.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = DAD20C7424E55CD100E96247 /* Sparkle.framework */; };
DAD20C7A24E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc in Resources */ = {isa = PBXBuildFile; fileRef = DAD20C7524E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc */; };
DAD20C7B24E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc in Resources */ = {isa = PBXBuildFile; fileRef = DAD20C7624E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc */; };
DAD20C7C24E55CEC00E96247 /* org.sparkle-project.Downloader.xpc in Embed Sparkle XPC Services */ = {isa = PBXBuildFile; fileRef = DAD20C7224E55CD100E96247 /* org.sparkle-project.Downloader.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
DAD20C7D24E55CEC00E96247 /* org.sparkle-project.InstallerConnection.xpc in Embed Sparkle XPC Services */ = {isa = PBXBuildFile; fileRef = DAD20C7624E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
DAD20C7E24E55CEC00E96247 /* org.sparkle-project.InstallerLauncher.xpc in Embed Sparkle XPC Services */ = {isa = PBXBuildFile; fileRef = DAD20C7524E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
DAD20C7F24E55CEC00E96247 /* org.sparkle-project.InstallerStatus.xpc in Embed Sparkle XPC Services */ = {isa = PBXBuildFile; fileRef = DAD20C7324E55CD100E96247 /* org.sparkle-project.InstallerStatus.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
DAD20C8024E55CF100E96247 /* Sparkle.framework in Copy Sparkle */ = {isa = PBXBuildFile; fileRef = DAD20C7424E55CD100E96247 /* Sparkle.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
DAE28500232257D20080E394 /* ColorImage.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAE284FF232257D20080E394 /* ColorImage.swift */; };
DAE2850223225BD90080E394 /* ColorImageTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAE2850123225BD90080E394 /* ColorImageTests.swift */; };
DAEE38471E3DBEB100DD2966 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAEE38461E3DBEB100DD2966 /* AppDelegate.swift */; };
Expand Down Expand Up @@ -77,23 +88,29 @@
/* End PBXContainerItemProxy section */

/* Begin PBXCopyFilesBuildPhase section */
DAE61D9E1EDC4A3C0016A3DE /* Embed Frameworks */ = {
DAA8D3D524E44F2E00A08026 /* Embed Sparkle XPC Services */ = {
isa = PBXCopyFilesBuildPhase;
buildActionMask = 2147483647;
dstPath = "";
dstSubfolderSpec = 10;
dstPath = "$(CONTENTS_FOLDER_PATH)/XPCServices";
dstSubfolderSpec = 16;
files = (
DAD20C7C24E55CEC00E96247 /* org.sparkle-project.Downloader.xpc in Embed Sparkle XPC Services */,
DAD20C7D24E55CEC00E96247 /* org.sparkle-project.InstallerConnection.xpc in Embed Sparkle XPC Services */,
DAD20C7E24E55CEC00E96247 /* org.sparkle-project.InstallerLauncher.xpc in Embed Sparkle XPC Services */,
DAD20C7F24E55CEC00E96247 /* org.sparkle-project.InstallerStatus.xpc in Embed Sparkle XPC Services */,
);
name = "Embed Frameworks";
name = "Embed Sparkle XPC Services";
runOnlyForDeploymentPostprocessing = 0;
};
DAE61DA01EDC4A5E0016A3DE /* CopyFiles */ = {
DAE61DA01EDC4A5E0016A3DE /* Copy Sparkle */ = {
isa = PBXCopyFilesBuildPhase;
buildActionMask = 2147483647;
dstPath = "";
dstSubfolderSpec = 16;
dstSubfolderSpec = 10;
files = (
DAD20C8024E55CF100E96247 /* Sparkle.framework in Copy Sparkle */,
);
name = "Copy Sparkle";
runOnlyForDeploymentPostprocessing = 0;
};
/* End PBXCopyFilesBuildPhase section */
Expand Down Expand Up @@ -153,7 +170,14 @@
DAB65DFE2440AE29000AECA8 /* CoreDataManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CoreDataManager.swift; sourceTree = "<group>"; };
DAB65E0A2440B078000AECA8 /* HistoryItem.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HistoryItem.swift; sourceTree = "<group>"; };
DAB65E0C2440B0D4000AECA8 /* HistoryItemContent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HistoryItemContent.swift; sourceTree = "<group>"; };
DAB8CE4024E3677F00A2500E /* Maccy.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Maccy.entitlements; sourceTree = "<group>"; };
DAB8CE4124E368F200A2500E /* container-migration.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "container-migration.plist"; sourceTree = "<group>"; };
DAC14123232367B200FCFA30 /* Search.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Search.swift; sourceTree = "<group>"; };
DAD20C7224E55CD100E96247 /* org.sparkle-project.Downloader.xpc */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.xpc-service"; name = "org.sparkle-project.Downloader.xpc"; path = "Sparkle/org.sparkle-project.Downloader.xpc"; sourceTree = "<group>"; };
DAD20C7324E55CD100E96247 /* org.sparkle-project.InstallerStatus.xpc */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.xpc-service"; name = "org.sparkle-project.InstallerStatus.xpc"; path = "Sparkle/org.sparkle-project.InstallerStatus.xpc"; sourceTree = "<group>"; };
DAD20C7424E55CD100E96247 /* Sparkle.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Sparkle.framework; path = Sparkle/Sparkle.framework; sourceTree = "<group>"; };
DAD20C7524E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.xpc-service"; name = "org.sparkle-project.InstallerLauncher.xpc"; path = "Sparkle/org.sparkle-project.InstallerLauncher.xpc"; sourceTree = "<group>"; };
DAD20C7624E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.xpc-service"; name = "org.sparkle-project.InstallerConnection.xpc"; path = "Sparkle/org.sparkle-project.InstallerConnection.xpc"; sourceTree = "<group>"; };
DAE284FF232257D20080E394 /* ColorImage.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ColorImage.swift; sourceTree = "<group>"; };
DAE2850123225BD90080E394 /* ColorImageTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ColorImageTests.swift; sourceTree = "<group>"; };
DAEE38431E3DBEB100DD2966 /* Maccy.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Maccy.app; sourceTree = BUILT_PRODUCTS_DIR; };
Expand Down Expand Up @@ -189,6 +213,7 @@
buildActionMask = 2147483647;
files = (
DA5F46512020E9FB00425C11 /* Carbon.framework in Frameworks */,
DAD20C7924E55CD200E96247 /* Sparkle.framework in Frameworks */,
2B63F3A3615AE0AF9FB59464 /* Pods_Maccy.framework in Frameworks */,
);
runOnlyForDeploymentPostprocessing = 0;
Expand All @@ -213,6 +238,11 @@
DA5F464F2020E4DF00425C11 /* Carbon.framework */,
70AE2EB056543A975B593A01 /* Pods_Maccy.framework */,
975F85A311398775317C1FCB /* Pods_MaccyTests.framework */,
DAD20C7224E55CD100E96247 /* org.sparkle-project.Downloader.xpc */,
DAD20C7624E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc */,
DAD20C7524E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc */,
DAD20C7324E55CD100E96247 /* org.sparkle-project.InstallerStatus.xpc */,
DAD20C7424E55CD100E96247 /* Sparkle.framework */,
);
name = Frameworks;
sourceTree = "<group>";
Expand Down Expand Up @@ -296,8 +326,10 @@
DA21AD3C249E85BD003E7C98 /* Sounds */,
DA246D601E56C9EA001E40F3 /* Application.xib */,
DA6373971E4AB9BB00263391 /* Assets.xcassets */,
DAB8CE4124E368F200A2500E /* container-migration.plist */,
DAEE384D1E3DBEB100DD2966 /* Info.plist */,
4762D6992467226100B3A2BA /* Localizable.strings */,
DAB8CE4024E3677F00A2500E /* Maccy.entitlements */,
DAB65DFB2440AD63000AECA8 /* Storage.xcdatamodeld */,
DAAEB195219694AE00A7883C /* About.swift */,
DAEE38461E3DBEB100DD2966 /* AppDelegate.swift */,
Expand Down Expand Up @@ -381,10 +413,9 @@
DAEE383F1E3DBEB100DD2966 /* Sources */,
DAEE38401E3DBEB100DD2966 /* Frameworks */,
DAEE38411E3DBEB100DD2966 /* Resources */,
DAE61D9E1EDC4A3C0016A3DE /* Embed Frameworks */,
DAE61DA01EDC4A5E0016A3DE /* CopyFiles */,
DAE61DA01EDC4A5E0016A3DE /* Copy Sparkle */,
DAA8D3D524E44F2E00A08026 /* Embed Sparkle XPC Services */,
8AE38A873EFDB3F38D55B774 /* [CP] Embed Pods Frameworks */,
DA6D71522489A95E008992E3 /* ShellScript */,
);
buildRules = (
);
Expand Down Expand Up @@ -468,7 +499,12 @@
isa = PBXResourcesBuildPhase;
buildActionMask = 2147483647;
files = (
DAD20C7B24E55CD200E96247 /* org.sparkle-project.InstallerConnection.xpc in Resources */,
DAD20C7724E55CD200E96247 /* org.sparkle-project.Downloader.xpc in Resources */,
DAD20C7824E55CD200E96247 /* org.sparkle-project.InstallerStatus.xpc in Resources */,
DA05E7CC2483EF83005CB8AA /* GeneralPreferenceViewController.xib in Resources */,
DAB8CE4224E368F200A2500E /* container-migration.plist in Resources */,
DAD20C7A24E55CD200E96247 /* org.sparkle-project.InstallerLauncher.xpc in Resources */,
DA6373981E4AB9BB00263391 /* Assets.xcassets in Resources */,
4762D6972467226100B3A2BA /* Localizable.strings in Resources */,
DA05E7D22483F70B005CB8AA /* AppearancePreferenceViewController.xib in Resources */,
Expand Down Expand Up @@ -530,8 +566,6 @@
"${BUILT_PRODUCTS_DIR}/LoginServiceKit/LoginServiceKit.framework",
"${BUILT_PRODUCTS_DIR}/Preferences/Preferences.framework",
"${BUILT_PRODUCTS_DIR}/Sauce/Sauce.framework",
"${PODS_ROOT}/Sparkle/Sparkle.framework",
"${PODS_ROOT}/Sparkle/Sparkle.framework.dSYM",
"${BUILT_PRODUCTS_DIR}/SwiftHEXColors/SwiftHEXColors.framework",
);
name = "[CP] Embed Pods Frameworks";
Expand All @@ -541,28 +575,13 @@
"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/LoginServiceKit.framework",
"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/Preferences.framework",
"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/Sauce.framework",
"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/Sparkle.framework",
"${DWARF_DSYM_FOLDER_PATH}/Sparkle.framework.dSYM",
"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/SwiftHEXColors.framework",
);
runOnlyForDeploymentPostprocessing = 0;
shellPath = /bin/sh;
shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Maccy/Pods-Maccy-frameworks.sh\"\n";
showEnvVarsInLog = 0;
};
DA6D71522489A95E008992E3 /* ShellScript */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
files = (
);
inputPaths = (
);
outputPaths = (
);
runOnlyForDeploymentPostprocessing = 0;
shellPath = /bin/sh;
shellScript = "LOCATION=\"${BUILT_PRODUCTS_DIR}\"/\"${FRAMEWORKS_FOLDER_PATH}\"\nIDENTITY=${EXPANDED_CODE_SIGN_IDENTITY_NAME}\n\ncodesign --verbose --force --deep -o runtime --sign \"$IDENTITY\" \"$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app\"\ncodesign --verbose --force -o runtime --sign \"$IDENTITY\" \"$LOCATION/Sparkle.framework/Versions/A\"\n";
};
/* End PBXShellScriptBuildPhase section */

/* Begin PBXSourcesBuildPhase section */
Expand Down Expand Up @@ -883,11 +902,16 @@
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_ENTITLEMENTS = Maccy/Maccy.entitlements;
CODE_SIGN_IDENTITY = "-";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
DEVELOPMENT_TEAM = MN3X4648SC;
FRAMEWORK_SEARCH_PATHS = "$(inherited)";
FRAMEWORK_SEARCH_PATHS = (
"$(inherited)",
"$(PROJECT_DIR)",
"$(PROJECT_DIR)/Sparkle",
);
INFOPLIST_FILE = Maccy/Info.plist;
LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
PRODUCT_BUNDLE_IDENTIFIER = org.p0deje.Maccy;
Expand All @@ -904,12 +928,17 @@
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_ENTITLEMENTS = Maccy/Maccy.entitlements;
CODE_SIGN_IDENTITY = "Apple Development";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
DEVELOPMENT_TEAM = MN3X4648SC;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = "$(inherited)";
FRAMEWORK_SEARCH_PATHS = (
"$(inherited)",
"$(PROJECT_DIR)",
"$(PROJECT_DIR)/Sparkle",
);
INFOPLIST_FILE = Maccy/Info.plist;
LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
PRODUCT_BUNDLE_IDENTIFIER = org.p0deje.Maccy;
Expand Down
2 changes: 1 addition & 1 deletion Maccy/AppDelegate.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {

func applicationWillFinishLaunching(_ notification: Notification) {
if ProcessInfo.processInfo.arguments.contains("ui-testing") {
SUUpdater.shared()?.automaticallyChecksForUpdates = false
SPUUpdater().automaticallyChecksForUpdates = false
}
}

Expand Down
5 changes: 2 additions & 3 deletions Maccy/Application.xib
View file
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="16097" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="16097.2" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="16097"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="16097.2"/>
</dependencies>
<objects>
<customObject id="-2" userLabel="File's Owner" customClass="NSApplication">
Expand All @@ -14,7 +14,6 @@
<customObject id="-3" userLabel="Application" customClass="UnsafePointer"/>
<customObject id="qYj-xg-cp5" userLabel="Delegate" customClass="AppDelegate" customModule="Maccy" customModuleProvider="target"/>
<customObject id="YLy-65-1bz" customClass="NSFontManager"/>
<customObject id="dcE-WI-1wz" customClass="SUUpdater"/>
<menu title="Main Menu" systemMenu="main" id="Jro-eu-QeA">
<items>
<menuItem title="Maccy" id="3CE-d6-uUV">
Expand Down
8 changes: 8 additions & 0 deletions Maccy/Maccy.entitlements
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
</dict>
</plist>
1 change: 0 additions & 1 deletion Maccy/Maccy.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import Cocoa
import KeyboardShortcuts
import LoginServiceKit
import Preferences
import Sparkle

class Maccy: NSObject {
static public var returnFocusToPreviousApp = true
Expand Down
Loading

0 comments on commit 15a12fd

Please sign in to comment.