It is not going to be sandboxed but rather notarized, so I'm using hardened runtime. Just FYI, I recommend that you use enable the hardened runtime in all your code. While the only place it’s required right now is for notarisation, it’s a good security practice in all situations. My application bundle has now the following structure: That’s a really helpful summary. Thanks! I presume that your login item is actually a Service Management login item, that is, you install it using SMLoginItemSetEnabled. If so, standard practice is to prefix your XPC service name with your Team ID. That will be accessible to your app and your app extensions. If any of the client code is sandboxed, sign it with an app group entitlement that’s a prefix of the XPC service name. For example, if your service name is SKMME9E2Y8.com.example.test703702.service, add an app group ``SKMME9E2Y8.com.example.test703702`. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo
Topic:
App & System Services
SubTopic:
Core OS
Tags: