Electron-osx-sign: How can I check to apply parent and child.plist

[Younghun-Jung]

I used electron-osx-sign plugin to sign for my app.
However, App submission is rejected.

App reviewers, they executed my app and try to log in using accounts and password provided by our development team. But reviewers said that my app cannot fetch next content and there is just loading panel in login view. I think that this loading panel is shown during asynchronous request using axios to get authentication.

I checked Electron guide in more detail.
https://electronjs.org/docs/tutorial/mac-app-store-submission-guide
I noticed that I did not create .plist files(parent.plist, child.plist) and also didn't add some below keys into parent.plist.

<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>

So, I create two plist files and add above keys into parent.plist.
and then, I use below commend when I signed with electron-osx-sign plugin.

electron-osx-sign MyApp.app --entitlements="parent.plist" --entitlements-inherit="child.plist" 

So, I got question,
Do these above keys make the server request(or get response) possible?
(My app also has websocket functionality).

If so, How can I know that these changes are well reflected?
I opened contents in my app(open package), I can still see that there was only info.plist file.

Thanks.

[sethlu]

Great question! I think the parent.plist should look like the following. I think even only having the network client entitlement key should work with web socket.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
  </dict>
</plist>

And you won't need to manually provide the child entitlements file as the default one would work fine 😸 The entitlement entries will be recorded in the executable program and won't be available as plain text like Info.plist.

If you run export DEBUG=electron-osx-sign* before running electron-osx-sign, you can find the actual signed entitlements at the end of the log. Alternatively you may run codesign -d --entitlements :- path/to/my.app to display all entitlements on the app bundle.

[Younghun-Jung]

Thanks for your replay.
'And you won't need to manually provide the child entitlements file as the default one would work fine'

You mean that I do not need to create 'child.plist' file.
That means, it does not matter that I add child.plist file manually right?.
because I already submit my app to App store with signing by below comment in my release date.
Is not there any problem?

electron-osx-sign MyApp.app --entitlements="parent.plist" --entitlements-inherit="child.plist" 

My app's directory structure like below.

electron-mat
   ㄴMyApp-mas-x64
      ㄴ MyApp.app
      ㄴ parent.plist
      ㄴ child.plist
      ㄴ LICENSE
      ㄴ LICENSES.chromium.html
      ㄴ version

parent.plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <string>OUR_TEAM_ID.MY_APP_BUNDLE_ID</string>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
  </dict>
</plist>

child.plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

Thanks again for your awesome plugin.

[sethlu]

Yep! electron-osx-sign will automatically use the template https://github.com/electron-userland/electron-osx-sign/blob/master/default.entitlements.mas.inherit.plist when signing a MAS build of Electron.

Let us know if your submission was successful 😺

[Younghun-Jung]

Thanks! Your response save my time.

[peturh]

Lol, makes sense. Defaults to app-sandbox=true.