Electron-osx-sign: Sandbox entitlements error ITMS-90296

[ahadcove]

I am having problems submitting my app to the app store. Where I am running into an error is sandbox not being enabled. I am adding entitlements when I sign the app, but apparently it is not working.
This is the error that is coming up.

ERROR ITMS-90296: "App sandbox not enabled. The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list: [( "com.site.app.pkg/Payload/App.app/Contents/Frameworks/App Helper EH.app/Contents/MacOS/QuizzUmmah Helper EH", "com.site.app.pkg/Payload/App.app/Contents/Frameworks/App Helper NP.app/Contents/MacOS/App Helper NP", "com.site.app.pkg/Payload/App.app/Contents/Frameworks/App Helper.app/Contents/MacOS/App Helper", "com.site.app.pkg/Payload/App.app/Contents/MacOS/App" )] Refer to App Sandbox page at https://developer.apple.com/devcenter/mac/app-sandbox/ for more information on sandboxing your app."

Here are my 2 entitlements:
Parent:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <string>'My team id'.com.site.app</string>
  </dict>
</plist>

child:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

And my build script:

 electron-packager . App --identity='3rd Party Mac Developer Application: 'Company' ('My team Id')' --sign-entitlements='./entitlements.mas' --sign-entitlements-inherit='./inherit.entitlements.mas' --osx-sign --app-version='1.0.0' --build-version='1.0.100' --platform=mas --app-bundle-id='com.site.app' --helper-bundle-id='com.site.app.helper' app-category-type=public.app-category.games --arch=all --icon=icon.icns --overwrite --asar",

Please help i am in dire need lol

[jay0lu]

@AhadCove Hi, Could you please post the solution?

[sethlu]

@jay0lu I believe the issue goes from setting up a proper signing command. Please check https://mintkit.net/electron-userland/electron-osx-sign/guide/ for more details if you are working with electron-packager and wanting to have electron-osx-sign enabled.

[jay0lu]

@sethlu Thanks for the reply. I'm using electron-forge to sign and package the app.

#!/bin/bash

# Name of your app.
APP="app name"
# The path of your app to sign.
APP_PATH="./out/app name.app"
# The path to the location you want to put the signed package.
RESULT_PATH="./macSign/$APP.pkg"
# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: XXX"
INSTALLER_KEY="3rd Party Mac Developer Installer: XXX"
# The path of your plist files.
CHILD_PLIST="./child.plist"
PARENT_PLIST="./parent.plist"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/Contents/MacOS/$APP Helper EH"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/Contents/MacOS/$APP Helper NP"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

My parent.plist is

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
    <key>com.apple.security.assets.pictures.read-write</key>
    <true/>
    <key>com.apple.security.device.audio-video-bridging</key>
    <true/>
    <key>com.apple.security.device.camera</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <string>XXX.XXX</string>
  </dict>
</plist>

My child.plist is

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

And changed the info.plist as document said.

Then I got ERROR ITMS-90296: "App sandbox not enabled." when I submit to apple.
Any idea where I'm wrong?

Thanks.

[sethlu]

@jay0lu I'm not sure where caused the issue from the settings. I'd recommend checking out https://mintkit.net/electron-userland/electron-osx-sign/guide/ and it should generate a signing script with electron-osx-sign for you, which can hopefully be less error-prone.

Also, you may export DEBUG=electron-osx-sign* (with the asterisk) when signing the app so electron-osx-sign will print out some useful debug log.

---

com.apple.security.application-groups should be specified as an array I believe.

[preethamsridhar]

Did anybody find the solution for this? I am having the same issue. I use electron-forge, electron-osx-sign, productbuild and productsign.

[ziulev]

Any news?