Sparkle 2.1.0 can't update my sandboxed app

[kode54]

Description of the problem

My app is signed and correctly notarized, using hardened runtime, etc. I export by building an Archive, then automatically signing it with my Developer ID identity, using a cloud managed certificate. I have downloaded the Sparkle.framework from the distribution tar.xz package and added it to my project, Embed & Sign.

I see in the signing phase, it's applying my project's entitlements file across everything it signs, including the XPC Services.

Do you use Sandboxing in your app?

Yes.

Version of Sparkle.framework in the latest version of your app

2.1.0

Version of Sparkle.framework in the old version of app that your users have (or N/A)

2.1.0, 1.2.7

Sparkle's output from Console.app

error	04:24:51.426206-0700	authd	Sandbox denied authorizing right 'config.add.org.cogx.cog.sparkle2-auth' by client '/Applications/Cog.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/org.sparkle-project.InstallerLauncher.xpc' [65406] (engine 1767)
error	04:24:51.426206-0700	kernel	Sandbox: org.sparkle-proj(65406) deny(1) authorization-right-obtain config.add.org.cogx.cog.sparkle2-auth
error	04:24:51.426831-0700	org.sparkle-project.InstallerLauncher	Failed to make auth right set
error	04:24:51.432395-0700	org.sparkle-project.InstallerLauncher	Failed to open temp icon from path buffer with error: 1
error	04:24:51.432388-0700	kernel	Sandbox: org.sparkle-proj(65406) deny(1) file-write-create /private/tmp/0IMbuZ.png
error	04:24:51.440654-0700	kernel	Sandbox: org.sparkle-proj(65406) deny(1) authorization-right-obtain org.cogx.cog.sparkle2-auth
error	04:24:51.440661-0700	authd	Sandbox denied authorizing right 'org.cogx.cog.sparkle2-auth' by client '/Applications/Cog.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/org.sparkle-project.InstallerLauncher.xpc' [65406] (engine 1768)
error	04:24:51.440823-0700	org.sparkle-project.InstallerLauncher	Failed copying system domain rights: -60005
error	04:24:51.440956-0700	org.sparkle-project.InstallerLauncher	Failed to submit installer job
error	04:24:51.441045-0700	Cog	Error: Failed to gain authorization required to update target
error	04:24:51.440968-0700	org.sparkle-project.InstallerLauncher	If your application is sandboxed please follow steps at: https://sparkle-project.org/documentation/sandboxing/
error	04:24:52.868983-0700	Cog	Error: An error occurred while launching the installer. Please try again later. (null) (URL (null))

Steps to reproduce the behavior

1. Clone https://github.com/losnoco/cog recursively
2. Configure a team identifier in the Xcode-config/DEVELOPMENT_TEAM.xcconfig file, according to the Shared.xcconfig comments.
3. Archive the project.
4. Export an archive, automatically re-signing it as Xcode defaults.
5. Run the resulting binary.
6. Check for updates, if there's a newer version available.
7. Apply update.

[zorgiepoo]

I see in the signing phase, it's applying my project's entitlements file across everything it signs, including the XPC Services.

this is wrong if it’s including sparkles installer xpc service or its helper tools. They are unsandboxed. The sandbox guide specifies code signing details of these. If you follow a standard workflow you shouldn’t need any additional script or —deep flag that may be doing this.

See also #1828

[kode54]

I am not using any special scripts. I am using the Export for Developer ID process in Xcode 13.3.1, with Automatically manage signing. This automatically signs literally everything with my Developer ID, and uses the entitlements that my app includes.

Otherwise, I have to manually allocate a profile for each object that requests it, and select them per bundle. Three Sparkle objects request manual signing profiles if I do this.

[zorgiepoo]

This is because your app target (Cog) has:

OTHER_CODE_SIGN_FLAGS = --deep -f

It's the same exact issue as #1828. Your project should not be doing this. Check "Other Code Signing Flags" in your app target's Build Settings.

[kode54]

Thanks, I totally forgot I had that setting stashed in there, from back when I needed it for whatever reason.

Edit: Thanks for taking the time to look at my project configuration.

[zorgiepoo]

If it happens you do need to sign & sandbox some components for whatever reason, you will need to do it on a case-by-case basis. --deep signing is discouraged in general because some binaries may need different entitlements (or lack of) from others.