Search results for

A Summary of the WWDC25 Group Lab

10,109 results found

Post

Replies

Boosts

Views

Activity

Reply to The installer package includes files that are only readable by the root user
[quote='846261022, MartinSchultz72, /thread/788895?answerId=846261022#846261022, /profile/MartinSchultz72'] Is this the expected rights setup? [/quote] Nope. Here’s what I see with an equivalent test: % cd Test788895C 27-06-2025, 14.36.xcarchive/Products/Applications/Test788895C.app/Contents/_CodeSignature % ls -l total 8 -rw-r--r-- 1 quinn staff 2200 27 Jun 14:36 CodeResources This is Xcode 16.4 on macOS 15.5, but I would expect to see rw-r--r-- permissions for all versions of Xcode and all versions of macOS. Hmmm, so it’s an environmental issue. Interesting. If you’d asked me to bet on this, I would’ve put my money on it being a project issue. But, hey, that’s why we check these things. I have a couple of new diagnostic tests for you. The first is a simplification of my original test: In step 2, give the app a unique bundle ID. In step 3, disable automatic code signing and select Sign to Run Locally in the Signing Certificates popup. I’m hoping this continues to reproduce the problem. If not, stop now and w
Topic: Code Signing SubTopic: General Tags:
Jun ’25
help needed for signing certificate for Developer ID Application.
1.Provisioning profile xxx doesn't include signing certificate Developer ID Application: xxxxx. 2.Provisioning profile xxx doesn't match the entitlements file's value for the com.apple.developer.networking.networkextension entitlement. I decoded the profile, com.apple.developer.system-extension.install com.apple.developer.networking.networkextension packet-tunnel-provider-systemextension app-proxy-provider-systemextension content-filter-provider-systemextension dns-proxy-systemextension dns-settings relay url-filter-provider hotspot-provider com.apple.security.application-groups xxxxx xxxxx com.apple.developer.networking.vpn.api allow-vpn com.apple.application-identifier xxxxx keychain-access-groups xxxxx com.apple.developer.team-identifier xxxxx Kindly help me to resolve this.
1
0
147
Jun ’25
Reply to Does URLSession support ticket-based TLS session resumption
Follow-up to Tad's question above, we have tried to use Network.framework (indirectly via the use of SwiftNIO Transport Services), which allows us to access the TLSOptions configuration. I am using the following APIs in Security.framework. https://developer.apple.com/documentation/security/sec_protocol_options_set_tls_resumption_enabled(::) https://developer.apple.com/documentation/security/sec_protocol_options_set_tls_tickets_enabled(::) When enabling both options above, (TLS 1.2) session resumptions work, but the session ticket is only reused once (the pattern is consistent across multiple requests in our testing). Using the same setup but setting the minimum TLS version to 1.3, session resumption does not work at all (the client never sends the pre_shared_key extension in the ClientHello packet with the necessary information for resumption). Our goal is to make session resumption work for TLS 1.3. Here is the simple HTTP Client that we are experimenting with. final class NIOPlayerSession { private let boot
Jun ’25
Reply to Circular Reference Error in Xcode 26
Adding nonisolated to my struct fixed the issue. My project is, as well, on MainActor default isolation mode. Although this fixes the problem, I am not sure about any repercussions that this might have in terms of concurrency. I am also new to Swift concurrency (I found Embracing Swift Concurrency from WWDC25 to be very helpful if you haven't watched it already). However, I am not sure if this is intended functionality or not because the error gives very little information. Thanks for your solutions!
Topic: Programming Languages SubTopic: Swift Tags:
Jun ’25
"Sign in with Apple" issue
Hello. I have issue with implementing Sign in with Apple on my website. As folow, I have created: App ID identifier: com.livnobus.app (G2F5N5UHYZ) Service ID identifier: com.livnobus.client (B25ZN8P84U) with option enabled Sign in with Apple and configuration (Primary App ID and Webiste URLs) Key ID: 43N8XKUW7S with option enabled Sign in with Apple and configuration (Primary App ID and Grouped App Ids) When I click Sign in with Apple on my website (https://dev.livnobus.com/auth/login), system redirect me to https://appleid.apple.com/ and error show invalid_client. Redirect URL on my web site is: https://appleid.apple.com/auth/authorize?client_id=com.livnobus.client&redirect_uri=https%3A%2F%2Fdev.livnobus.com%2Fauth%2Fapple%2Fcallback&scope=name%20email&response_type=code&response_mode=form_post&state=eGAgdpLrvskJc26RbTizc9TGwxnL6KAEJOf68pmO&nonce=e7c7a242-1977-47ea-9013-98820c24bfba.eGAgdpLrvskJc26RbTizc9TGwxnL6KAEJOf68pmO There was old Service ID identifier com.livnobus.app-
0
0
60
Jun ’25
How to satisfy a custom Authorization Right?
I’m implementing a custom Authorization right with the following rule: <key>authenticate-user</key> <true/> <key>allow-root</key> <true/> <key>class</key> <string>user</string> <key>group</key> <string>admin</string> The currently logged-in user is a standard user, and I’ve created a hidden admin account, e.g. _hiddenadmin, which has UID≠0 but belongs to the admin group. From my Authorization Plug-in, I would like to programmatically satisfy this right using _hiddenadmin’s credentials, even though _hiddenadmin is not the logged-in user. My question: Is there a way to programmatically satisfy an authenticate-user right from an Authorization Plug-in using credentials of another (non-session) user?
5
0
147
Jun ’25
Gatekeeper disallowing directly distributed app
This is a continuation of my own old post that became inactive to regain traction. I am trying to resolve issues that arise when distributing a macOS app with a SysExt Network Extension (Packet Tunnel) outside the App Store using a Developer ID Certificate. To directly distribute the app, I start with exporting the .app via Archive in Xcode. After that, I create a new Developer ID provisioning profile for both the app and sysext and replace the embedded ones in the .app package. After I have replaced the provisioning profiles and the have the entitlements files ready, I start signing the frameworks, sysext and parent app. codesign --force --options runtime --timestamp --sign Developer ID Application: .app/Contents/Library/SystemExtensions/.systemextension/Contents/Frameworks/.framework/Versions/A/ codesign --force --options runtime --timestamp --sign Developer ID Application: .app/Contents/Frameworks/.framework/ codesign --force --options runtime --entitlements dist-vpn.entitlements --timestamp --sign Develo
3
0
170
Jun ’25
MacOS Sequoia support for VoiceOver AppleScript automation
We are unable to programmatically enable AppleScript automation for VoiceOver on macOS 15 (Sequoia) In macOS 15, Apple moved the VoiceOver configuration from: ~/Library/Preferences/com.apple.VoiceOver4/default.plist to a sandboxed path: ~/Library/Group Containers/group.com.apple.VoiceOver/Library/Preferences/com.apple.VoiceOver4/default.plist Steps to Reproduce: Use a macOS 15 (ARM64) machine (or GitHub Actions runner image with macOS 15 ARM). Open VoiceOver: open /System/Library/CoreServices/VoiceOver.app Set the SCREnableAppleScript flag to true in the new sandboxed .plist: plutil -replace SCREnableAppleScript -bool true ~/Library/Group Containers/group.com.apple.VoiceOver/Library/Preferences/com.apple.VoiceOver4/default.plist Confirm csrutil status is either disabled or not enforced. Attempt to control VoiceOver via AppleScript (e.g., using osascript voiceOverPerform.applescript). Observe that the AppleScript command fails with no useful output (exit code 1), and VoiceOver does not respon
3
0
163
Jun ’25
watchOS Info.plist overwritten with iOS settings during archive – causes App Store upload errors
Hello, I'm trying to distribute an iOS app that includes a watchOS companion app. Everything works fine when testing on a device, but when I archive the project for App Store distribution, the Info.plist inside the archived watch app gets overwritten with values from the iPhoneOS configuration. I've set Generate Info.plist File to No, and I've explicitly assigned the correct Info.plist path for the watchOS target. However, during archiving, it still gets replaced with iOS settings. As a result, when I run Distribute App, errors occur because the watchOS Info.plist is no longer valid. This is causing a serious issue, and I need help resolving it. Summary: Added a watchOS app to an existing iOS app. During archive, the watchOS Info.plist gets overwritten with iPhoneOS values. Distribute App fails due to an invalid Info.plist in the watchOS app.
0
0
42
Jun ’25
Reply to Network extension authorization dialog not appearing
I just filed FB17948001, with the sysdiagnose attached. So, I was able to take a look at it today and there are definitely some oddities I don't understand. FYI, the list of things below constructed across a significant period of time, so it isn't order in any particular way nor is it necessarily prioritized. (a) One of your components (ProxyAgent) crashed twice, with a reboot in between. You can find the crash log data in the system log archive by looking for pids 1401 and 339. The crashes themselves are fairly similar, with a high thread ID GCD thread crashing here: 6 0x101581398 -[ExtensionLoader asyncControlProxyWithErrorHandler:] 7 0x10102cebd -[AppBypassCollector sendAppEntry:] 8 0x10157e847 -[AppEntryCollector addName:] 9 0x10102d2a2 AppBypassConfig::sendListByOS(std::__1::set 0x1010226d5 AppBypassConfig::sendAppBypassList() I'm not sure how it connect (if at all), but the timing is suspicious as it lines up with about the time the system extension activation started. (b) An app update is what trig
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’25
Received the "Profile for Dolby Vision MUST be Profile 5 or 10" error for the channel that has only dolby vision profile 5
While validating a Dolby Vision Profile 5 playlist in CMAF format (with segments in MP4), the Media Stream Validator reported the following error in the MUXT-FIX-ISSUES list: However, the playlist correctly specifies Dolby Vision Profile 5 in both the EXT-X-STREAM-INF and EXT-X-I-STREAM-INF tags. Playlist: #EXTM3U #EXT-X-VERSION:8 #EXT-X-INDEPENDENT-SEGMENTS #EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID=audio-ec3,LANGUAGE=und,NAME=Undetermined,AUTOSELECT=YES,CHANNELS=6,URI=var14711339/aud1257/playlist.m3u8?device_profile=hls&seg_size=6&cmaf=1 #EXT-X-STREAM-INF:BANDWIDTH=14680000,AVERAGE-BANDWIDTH=14676380,VIDEO-RANGE=PQ,CODECS=ec-3,dvh1.05.06,RESOLUTION=3840x2160,AUDIO=audio-ec3 var14711339/vid/playlist.m3u8?device_profile=hls&seg_size=6&cmaf=1 #EXT-X-I-FRAME-STREAM-INF:BANDWIDTH=1419881,URI=trk14711339/playlist.m3u8?device_profile=hls&cmaf=1,VIDEO-RANGE=PQ,CODECS=dvh1.05.06,RESOLUTION=3840x2160 Could you please review this and clarify: Why is the Media Stream Validator reporting this error, e
1
0
88
Jun ’25
Reply to Detect and wait until a file has been unzipped to avoid permission errors
I didn't receive some notifications for recent replies to my posts. Were notifications disabled during the WWDC25 week? Not that I'm aware of, however, I'm also not sure they've ever been entirely reliable. I'm not sure I understand the difference between temporary and working (with in progress files). Here's what I meant by that: Temporary-> One of the system provided directories (retrieved through url(for:in:appropriateFor:create:)) which are typically invisible to the user. Working-> A user visible directory that the user either directly specifies/creates. Working-ish-> (variant of #2) A user visible directory your app creates for this, probably within the destination hierarchy. For example, creating a directory like In Progress at the top level of the hierarchy you're creating. Wouldn't the temporary one be for in progress files too? In terms of how your app uses these directories, they'd all work exactly the same way. The difference between the two (and which is the right choice) reall
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’25
Reply to How to force soft scrollEdgeEffectStyle in iOS 26?
I believe the solution to this problem is to use the new safeAreaBar(edge:alignment:spacing:content:) view modifier, as suggested by its documentation and a comment made during the SwiftUI group lab. However, I also believe that this modifier is currently broken (as of beta 2), because its behaviour seems to be no different to using safeAreaInset. I have filed feedback for this: FB18350439.
Topic: UI Frameworks SubTopic: SwiftUI Tags:
Jun ’25