“eskimo”

[quote='909210022, BladeConjuroro, /thread/850327?answerId=909210022#909210022, /profile/BladeConjuroro'] Does macOS guarantee that protected data becomes unavailable in each of those cases? [/quote] No. Well, it’s something that I expect to happen but I doubt you’ll find any guarantees as to the exact circumstances as to when it does [1]. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] If such things did exist they’d be in Apple Platform Security. I took a quick look and couldn’t spot anything.

[quote='909155022, WalkerZhuang, /thread/845976?answerId=909155022#909155022, /profile/WalkerZhuang'] Does Cross-architecture Compatibility Framework support free Personal Teams for local development? [/quote] Technically, the Cross-architecture Compatibility Framework capability maps to the com.apple.developer.cross-architecture-support entitlement which is only available to paid teams. This is not uncommon. The list of capabilities available to a Personal Team is quite short. See the Apple Developer column in Developer Account Help > Reference > Supported capabilities (macOS). Note This table doesn’t list this capability because it’s not auto-generated from our back end, something I’d like to see change (r. 179941179). The story with com.apple.developer.cross-architecture-support-unmanaged is a little muddy. It looks like it’s actually a thing — that is, the system treats it as equivalent to com.apple.developer.cross-architecture-support — but I can’t see any way to provision it. Note that it’s in the

[quote='909228022, DTS Engineer, /thread/841433?answerId=909228022#909228022'] I’m researching the best way to set that up … [/quote] OK, please do the following: On a test device, install the Phone (General) and VPN (Network Extension) debug profiles. Get those from our Bug Reporting > Profiles and Logs page. Reproduce the problem, and note down the time. Immediately trigger a sysdiagnose log. File a bug, making sure to include the sysdiagnose log and the timestamp from step 2. Reply here with your bug number. I’ll then intercept the bug so that I can look at the log. Oh, wait, before you do any of that, please try reproducing this on iOS 27, just on the off chance that there’s something in the OS triggering this. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='909340022, Dhruv_codesire, /thread/850649?answerId=909340022#909340022, /profile/Dhruv_codesire'] What are the next steps [/quote] Apple needs to run through the onboarding process. Unless there’s some sort of problem, there’s nothing for you to do until it completes. [quote='909340022, Dhruv_codesire, /thread/850649?answerId=909340022#909340022, /profile/Dhruv_codesire'] How long does it usually take for the service to be provisioned ? [/quote] There’s no official guidance. If you rummage around on the forums you’ll find experience reports from other developers. My only caution on that front is to that it took a while for this process to get going properly, so it’s best to focus on recent experience and discount reports from back when URL filters were first introduced. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Just to clarify, this problem only occurs if the socket generates traffic during the update, that is, between when you call setTunnelNetworkSettings(_:completionHandler:) and when the completion handler runs (roughly). So, a socket that’s dormant during that time but generates traffic after the configuration has completed doesn’t have the problem. Is that right? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

We believe that this is more fallout from the one of the issues (FB24791716) being discussed on this thread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Are you on iPadOS 27? If so, we’ve been discussed a Swift Playground problem like this on this thread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

See this thread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='850777021, GenomeDev, /thread/850777, /profile/GenomeDev'] 1- Is LOCAL_PEERTOKEN a public, supported API on macOS 13 and later? [/quote] Yes. [quote='850777021, GenomeDev, /thread/850777, /profile/GenomeDev'] Can it be used with getsockopt() on a file descriptor returned by accept() to retrieve an audit_token_t for the connected peer? [/quote] Yes. [quote='850777021, GenomeDev, /thread/850777, /profile/GenomeDev'] 2- At what point is the peer identity captured? [/quote] When the peer connects. [quote='850777021, GenomeDev, /thread/850777, /profile/GenomeDev'] even if that process exits and its PID is reused? [/quote] Protecting against PID reuse is one of the primary reasons that audit tokens exist. [quote='850777021, GenomeDev, /thread/850777, /profile/GenomeDev'] 3- Is the audit token obtained through LOCAL_PEERTOKEN officially supported as input to Security.framework APIs … ? [/quote] Yes. An audit token is an audit token. If you have one, you can use it wherever. There aren’t different flavours fo

Let’s focus this discussion on your other thread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I’m presuming that ohttp.protectuswebfilter.com is your OHTTP gateway? I think I need to take a proper look at this log. I’m researching the best way to set that up and I’ll reply here with the details, hopefully tomorrow. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='909021022, osupdate_1, /thread/850331?answerId=909021022#909021022, /profile/osupdate_1'] We’re not developing any of it. [/quote] OK. In that case my advice is that you escalate via Apple Support resources. Usually I’d recommend the Apple Support Community, run by Apple Support, but this sounds like it warrants something more drastic. Our mission here on the Apple Developer Forums is to help developers create products for Apple platforms. We’re not really set up to help folks with issues like this one. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Thanks for that explanation. It was very clear. Given those requirements I’m inclined to recommend the NSApplicationProtectedDataDidBecomeAvailable notification. It’s not directly tied to screen lock state but rather to the state of the keybag [1] that controls access to protected data on the file system and in the keychain. If, for example, you store a credential in the keychain [2] such that it’s accessible when unlocked, this tells you whether it’s accessible or not. That seems appropriate for your goal here. Keep in mind that this state is only accessible from within GUI login session (it’s an AppKit API and AppKit is only supported within a GUI login session). So you’ll need some sort of process running within the session to pick this up, for example, a launchd agent. However, I don’t think that’ll be a problem in your case because you’re already doing stuff, like dealing with web browsers, that requires you to be running within the GUI login session. Also note that if you search the ’net you’ll find a b

[quote='909127022, LABcare, /thread/850281?answerId=909127022#909127022, /profile/LABcare'] Is a web-only service like this eligible to … obtain this access? [/quote] That’s a policy question, and it’s not something I can answer right now. However, see my reply here. [quote='909127022, LABcare, /thread/850281?answerId=909127022#909127022, /profile/LABcare'] Could you also clarify which Developer Program membership or account role is required to access it … ? [/quote] You definitely need to be a member of a paid team. I’m not sure if there’s a program role limitation, but I don’t see that as a major blocker. If you create a paid team and its an Organization team and you’re a member of the team but not the Account Holder and this form isn’t available to you, then you can simply ask your team’s Account Holder to complete the form. [quote='909127022, LABcare, /thread/850281?answerId=909127022#909127022, /profile/LABcare'] whether eligibility for this web-only use case can be confirmed before enrollment? [/quote]

Good point! And in retrospect I should’ve mentioned this )-: On macOS, there are two keychain implementations: The original file-based keychain The data protection keychain TN3137 On Mac keychain APIs and implementations explains these in more detail. On macOS: securityd runs, amongst other things, the file-based keychain. The data protection keychain is run by a different process, secd. Note On other Apple platforms, there is only the data protection keychain implementation, and its run by securityd. So, the data protection keychain implementation lives in securityd on mostly platforms but secd on macOS, because the name securityd was already taken. If this crash is being provoked by your code then it makes sense that switching to the data protection keychain would avoid it, because that’s implemented by a completely different process. And while I’m glad this works for you, it won’t work for everyone because, as explained in TN3137, not all programs can use the data protection keychain. Oh, and finally, just