Electron-osx-sign: Unable to write file even with right entitlement option.

[trigun539]

Here is my parent.plist file contents:

```



com.apple.security.app-sandbox

com.apple.security.application-groups
GROUP.STRINGHERE
com.apple.security.files.user-selected.read-write

Here is my child.plist file

com.apple.security.app-sandbox

com.apple.security.inherit

My signing command: 

electron-osx-sign "XXXX-mas-x64/XXXX.app" --verbose --identity="**" --entitlements=./entitlements/parent.plist --entitlements-inherit=./entitlements/child.plist --platform=mas --version=1.0.2 --provisioning-profile=./XXXXX.provisionprofile --type=development
```
Error that I am getting:

deny file-write-create App doesn't have permission to write file.

The file is being saved from a user dialog, they select location and file if written to that location.

[sethlu]

Hi @trigun539, thanks for reporting the issue. Quick check, are you using this dialog when prompting the user to save the file?

---

Amend: electron-osx-sign should be able to discover com.apple.security.application-groups by itself so it's fine to skip this item in the entitlements file.

[trigun539]

yes, I am using dialog.showSaveDialog. I removed the com.apple.security.application-groups portion but if I did that, I would just get a blank page when app is opened (not responding).

[sethlu]

@trigun539 Mhm that's very weird. (Probably the codesign wasn't done correctly.) Would you mind running the codesign again with export DEBUG=electron-osx-sign* (with the asterisk) and posting the debug log here afterwards?

Also, a little issue I see from your choice of Electron version... I would recommend using Electron >= v1.1.1 since earlier versions may experience graphics issues after sandboxing 😮 & make sure to use the Mac Developer identity for local testing/development and the latest electron-osx-sign for codesigning.

[trigun539]

@sethlu Here is the output of the command. Also, I was able to write the file to pictures folder if I gave it the following entitlement: com.apple.security.assets.pictures.read-write. However, I need the com.apple.security.files.user-selected.read-write

electron-osx-sign "Croppr-mas-x64/Croppr.app" --verbose --identity="3rd Party Mac Developer Application: Edwin Perez (XXXXX)" --entitlements=./entitlements/parent.plist --entitlements-inherit=./entitlements/child.plist --platform=mas --version=1.0.2 --provisioning-profile=./Croppr_Development_Profile.provisionprofile --type=development

  electron-osx-sign `identity` passed in arguments. +0ms
  electron-osx-sign Executing... security find-identity -v +3ms
  electron-osx-sign Identity: 
 > Name: 3rd Party Mac Developer Application: Edwin Perez (XXXXXXX) 
 > Hash: FCA58879658BFAE58ED4A6889C5045BA4B442B9F +180ms
  electron-osx-sign Found 1 identity. +1ms
  electron-osx-sign Pre-sign operation enabled for provisioning profile: 
 * Disable by setting `pre-embed-previsioning-profile` to `false`. +0ms
  electron-osx-sign Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`: 
 * Disable by setting `pre-auto-entitlements` to `false`. +0ms
  electron-osx-sign `provisioning-profile` passed in arguments. +1ms
  electron-osx-sign Executing... security cms -D -i ./Croppr_Development_Profile.provisionprofile +0ms
  electron-osx-sign Provisioning profile: 
 > Name: Croppr Development Profile 
 > Platforms: [ 'darwin', 'mas' ] 
 > Type: development 
 > Path: ./Croppr_Development_Profile.provisionprofile 
 > Message: { AppIDName: 'croppr',
  ApplicationIdentifierPrefix: [ 'XXXXXXX' ],
  CreationDate: 2017-06-08T09:26:41.000Z,
  Platform: [ 'OSX' ],
  DeveloperCertificates: [ <Buffer 30 82 05 83 30 82 04 6b a0 03 02 01 02 02 08 10 e2 f9 d7 53 54 b7 6b 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 96 31 0b 30 09 06 03 55 04 06 ... > ],
  Entitlements: 
   { 'keychain-access-groups': [ 'XXXXXXX.*' ],
     'com.apple.application-identifier': 'XXXXXXXX.io.eperez.croppr',
     'com.apple.developer.team-identifier': 'XXXXXXX' },
  ExpirationDate: 2018-06-08T09:26:41.000Z,
  Name: 'Croppr Development Profile',
  ProvisionedDevices: [ 'F82047D1-AC3B-5BC3-BC99-BC7BD685716E' ],
  TeamIdentifier: [ 'XXXXXXX' ],
  TeamName: 'Edwin Perez',
  TimeToLive: 365,
  UUID: '521bbfbf-bdfe-439d-8402-27c90a7beb36',
  Version: 1 } +51ms
  electron-osx-sign Looking for existing provisioning profile... +3ms
  electron-osx-sign Found embedded provisioning profile: 
 * Please manually remove the existing file if not wanted. 
 * Current file at: Croppr-mas-x64/Croppr.app/Contents/embedded.provisionprofile +1ms
  electron-osx-sign Signing application... 
 > Application: Croppr-mas-x64/Croppr.app 
 > Platform: mas 
 > Entitlements: ./entitlements/parent.plist 
 > Child entitlements: ./entitlements/child.plist 
 > Additional binaries: [] 
 > Identity: { name: '3rd Party Mac Developer Application: Edwin Perez (XXXXXXX)',
  hash: 'FCA58879658BFAE58ED4A6889C5045BA4B442B9F' } +0ms
  electron-osx-sign Walking... Croppr-mas-x64/Croppr.app/Contents +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper EH.app/Contents/MacOS/Croppr Helper EH +25ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper EH.app/Contents/MacOS/Croppr Helper EH +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper EH.app +101ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper EH.app +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper NP.app/Contents/MacOS/Croppr Helper NP +93ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper NP.app/Contents/MacOS/Croppr Helper NP +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper NP.app +91ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper NP.app +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper.app/Contents/MacOS/Croppr Helper +94ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper.app/Contents/MacOS/Croppr Helper +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper.app +95ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Croppr Helper.app +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +91ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +977ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +126ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework +268ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/Frameworks/Electron Framework.framework +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app/Contents/MacOS/Croppr +969ms
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/child.plist Croppr-mas-x64/Croppr.app/Contents/MacOS/Croppr +0ms
  electron-osx-sign Signing... Croppr-mas-x64/Croppr.app +1s
  electron-osx-sign Executing... codesign --sign FCA58879658BFAE58ED4A6889C5045BA4B442B9F --force --entitlements ./entitlements/p*** Croppr-mas-x64/Croppr.app +1ms
  electron-osx-sign Verifying... +1s
  electron-osx-sign Verifying application bundle with codesign... +1ms
  electron-osx-sign Executing... codesign --verify --deep --verbose=2 --strict Croppr-mas-x64/Croppr.app +0ms
  electron-osx-sign Verified. +1s
  electron-osx-sign Displaying entitlements... +1ms
  electron-osx-sign Executing... codesign --display --entitlements :- Croppr-mas-x64/Croppr.app +0ms
  electron-osx-sign Entitlements: 
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <string>XXXXXXX.io.eperez.croppr</string>
    <key>com.apple.security.files.user-selected.read-write</key>
        <true/>
  </dict>
</plist>
 +31ms
  electron-osx-sign Application signed. +0ms
  electron-osx-sign Application signed: Croppr-mas-x64/Croppr.app +0ms
Application signed: Croppr-mas-x64/Croppr.app

[sethlu]

@trigun539 The signing identity should be Mac Developer instead of 3rd Party Mac Developer Application for development signing.

On the issue regarding to deny file-write-create... I'm wondering if com.apple.security.files.user-selected.read-write only allows reading/overwriting an existing file but not creating something new. 😕 Where are you trying to write a new file to... for example?

[trigun539]

@sethlu The user would be creating a new file on a location they select. So, for example:

• Reading a file in ~/pictures/file.jpg -> saving to ~/pictures/file-cropped.jpg. I'll look into changing the signing identity to see if that helps. Thanks

[sethlu]

@trigun539 so the user selects the directory and enters the file name in the modal created with dialog.showSaveDialog()?

[trigun539]

@sethlu yes

[sethlu]

@trigun539 I may need to recreate the issue for some further experiments before knowing the cause for the issue. However, the codesigning process should've been set up correctly, since you can write to the Pictures folder with the corresponding entitlement key.

[trigun539]

@sethlu I am in the process of re-creating and isolating the issue. Will let you know if I run into the issue again.

[sethlu]

@trigun539 Cool! Looking forward to hearing from you soon 😺

[trigun539]

It turned out to that I was adding the file extension to the filename given by the user. So, it would fail since I didn't have permissions to the path-to-file[ext]. I do get the right permissions to path-to-file piece. Sorry about the trouble. Thanks @sethlu

[sethlu]

@trigun539 no worries 😸 glad you found the cause to this issue.

[chryb]

@trigun539 I think I have the same issue but I don't really understand how you've fixed it. I need the permissions to let the user create .md files. It would be great if you could help me 😄
My .entitlements files are looking like your files in the initial comment.

[trigun539]

@chryb the problem is that you depend on the user to "add" the extension themselves. If they don't add it while in the save popup, then you only have access to "sample" not "sample.md". I kept trying to add the extension programatically and failed because I didn't have access.

[chryb]

@trigun539 I don't add the file extension by myself, it's added with filters: [ { name: 'Markdown', extensions: ['md'] } ] in the dialog options. Do you think that this could produce the error?

[trigun539]

@chryb I would take that out and see if it worked without it. If it does, then something may need to be updated with electron to ensure the extension is taken into account when user selects something so the app gets permission to the file.

[chryb]

@trigun539 I have found the problem. It has nothing to do with electron-osx-sign, however, it's caused through jetpack-fs. Jetpack has an atomic mode to save files securely, but this creates a new temporary file. The sandbox doesn't allow to create this file. I will add an issue to the jetpack repo.