How to add App Group entitlement to existing, sandboxed app?

Scripting Forums AppleScriptObjC and Xcode
#1

Hello,

I am trying to test, whether I can add App Group entitlement to an existing app.

I have created a new App Group Identifier in the App Developer account: group.com.company.app
I have a feeling that this is already, where I go wrong. I might have to use a team identifier
placeholder.com.company.app?
Then registered it in the identities for 2 existing Apps
Then added the entitlement in Xcode to the App Code
And my created App Group Identifier is not offered for selection, which cannot be good
Then followed the following guidance for testing:
https://macscripter.net/viewtopic.php?id=47088

And keep getting errors in the primary app:
One is a spurious one from what I googled
But then there are lots of warnings that the Menu outlets cannot be connected to the NSUserDefaults
And of course, nothing is written into the App Group Container.

I used this link: https://docs.microsoft.com/en-us/xamarin/ios/deploy-test/provisioning/capabilities/app-groups-capabilities to help me understand the initial steps of registering.

My questions please:

  1. is it not possible to add App Group entitlement to an existing app?
  2. is there anything obviously wrong in my above approach that prevents success?

Thank you for your help!

Uwe

#2

Just to say that I opened a developer ticket and got it sorted.

It does not seem to be of great interest to anybody as nobody answered, but if anyone wants help then just post to this forum and I will post the syntax that worked for me.

Best wishes

#3

I would like to know how to do it, but I have a question first.

When you say you want to add to an existing app, do you mean an app you developed yourself in Xcode, or a third party app?

The reason is, I have a program ‘Script Debugger’ with doesn’t have an entitlement “com.apple.developer.contacts.notes”. But Apple’s own ‘Script Editor’ does. I need to add this entitlement to ‘Script Debugger’ if possible.

#4

You can add entitlements after using command line codesign.

You definitely need to make sure you have the proper entitlement.plist file set up

Create an entitlements file for the tool:

% /usr/libexec/PlistBuddy -c "Add :com.apple.security.app-sandbox bool true" "ToolC.entitlements"
File Doesn't Exist, Will Create: ToolC.entitlements
% /usr/libexec/PlistBuddy -c "Add :com.apple.security.inherit bool true" ToolC.entitlements
% cat ToolC.entitlements 
…
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
</dict>
</plist>

Sign the tool as shown below:

% codesign -s - -i com.example.apple-samplecode.AppWithTool.ToolC -o runtime --entitlements ToolC.entitlements -f ToolC

This breaks down as follows:

  • The -s - argument applies an ad hoc signature (in Xcode parlance, this is Sign to Run Locally). Setting up the code signature here is critical. It sets up a pattern that Xcode uses when it re-signs the tool when embedding it into the final app. The signing identity is the only thing that doesn’t matter. Xcode overrides that identity with the product’s signing identity during the embedding process, which is why you can get away with an ad hoc signature.
  • The -i com.example.apple-samplecode.AppWithTool.ToolCoption sets the code signing identifier.
  • The -o runtime option enables the hardened runtime. Again, this isn’t necessary for App Store distribution, but it’s best practice for new code.
  • The --entitlements ToolC.entitlements option supplies the signature’s entitlements.
  • The -f option overrides any existing signature. This isn’t strictly necessary but it avoids any confusion about the existing ad hoc signature applied by clang to the arm64 architecture. Apple silicon requires that all code be signed, and so clang automatically applies an ad hoc signature when building for Apple silicon.

This is from

#5

the NSUserDefaults
And of course, nothing is written into the App Group Container.

That accesses the preferences for the App.
You entitlements is not written to this file.
It is stored in the info.plist with the App’s bundle.