Folks, I need some help. I’ve been working on adding support for this to App Wrapper, while it works, there’s a huge gray area and that’s the effects of this option. Please read this and if you have the time, try out the current App Wrapper beta with your Xojo made application and report any failures.
What is a Hardened Runtime?
My assumption is that it’s an App Sandbox Lite, now don’t get too upset, it’s not as restrictive as a full App Sandbox, but it still comes with restrictions.
Contrary to my earlier assumptions, it appears that all you need to make a “Hardened Runtime” is macOS 10.13.6 or newer.
What I need your help with
Because this new option does apply restrictions to your application, and I can not find any clear documentation to state exactly what restrictions it applies, the only way we can know for sure is to test applications with this option.
@Christophe de vocht found two issues.
- Decalres (and I assume plugins also) that interact with OS API MUST reference the correct framework, referencing the dylib directly fails.
- AppleScript is dead.
Assumption 2 maybe a little too harsh, as I would like to believe that it’s not dead, instead what I think you need to do is to add the correct entitlements. In the “Capabilities” section of App Wrapper, switch “App Sandbox” to “Entitlements Only” and then fill in the Apple Script details.
I was able to create a “Hardened” version of App Wrapper, which was still able to code sign applications. This is something that can not be done when App Wrapper is Sandboxed.
App Wrapper 3.9 Beta
Please download and test the beta of App Wrapper 3.9, it includes the following changes.
- 64-Bit; it’s made with the latest Xojo and fully 64-Bit compatible.
- Usage Descriptions; it includes support for usage descriptions (also required for 10.14). Apple’s documentation list 18 possibilities, with only 4 marked as macOS, yet I’ve added support for the ones that macOS developers have received rejections for not including.
- “Hardended Runtime”; please note this currently only works when NOT using “Apple Temporary Engine”. If you run into problems when not using this, please let me know as I’m trying to remove support for Apple’s temp engine.
What about Notarization?
It will come, my primary focus at this point is to work on “Hardened Runtime” option, understand what the restrictions are, and to try to ensure that App Wrapper makes this transition as easy as possible. So for the week (at time of writing), I am only looking at this. I will look into Notarizing next week or after we have a better understanding.
Thank you for helping.