Search results for

A Summary of the WWDC25 Group Lab

10,364 results found

Post

Replies

Boosts

Views

Activity

Reply to Provisioning profile missing entitlement
You are correct that the profile from step 3 has no entry for key-value storage. However, the profile from step 5 still uses the old team ID. One thing I realized while looking at this is that I'm still a member of the old team. That team's developer subscription is no longer active but I'm still a member. I almost left it when I realized but decided to only follow the steps you suggested. Step 3 (iCloud not enabled) Entitlements => { application-identifier => TEAM_ID.com.ORGANIZATION.APP aps-environment => production beta-reports-active => true com.apple.developer.team-identifier => TEAM_ID com.apple.security.application-groups => [ 0 => group.ORGANIZATION ] get-task-allow => false keychain-access-groups => [ 0 => TEAM_ID.* 1 => com.apple.token ] } Step 5 (iCloud re-enabled) Entitlements => { application-identifier => TEAM_ID.com.ORGANIZATION.APP aps-environment => production beta-reports-active => true com.apple.developer.icloud-container-develo
Topic: App & System Services SubTopic: iCloud & Data Tags:
7h
Reply to Strange behavior for automounted directory.
How are you creating this directory: /System/Volumes/Data/mnt/ The issue here is that the contents that are visible at / are created by basically merging the contents of the ROSV (Read Only System Volume) and the data volume of its volume group. Within that context, I think there are two ways to create something like a common mnt directory: Bypass these issues by placing the directory inside one of the existing standard directories. For example, create /Library/mnt/. If you specifically want the directory to exist at /, then use the /etc/synthetic.conf config file to create a new directory or symbolic link (see man synthetic.conf) for details. ...but what I would NOT do is simply create a new directory at the root of the Data volume and use it through /System/Volumes/ like this: /System/Volumes/Data/mnt/ The BEST case here is that you only get weird UI issues, since mnt won't be visible at / but will be visible in the path above (which is not a standard path). The worst case is that: I am working on
Topic: App & System Services SubTopic: Core OS Tags:
2d
Reply to HELP WITH SUBSCRIPTIONS
If you are using SubscriptionStoreView with groupID overload, make sure the groupID entered is matching with the one in App Store Connect, not the one from your Xcode StoreKit configuration file. In Xcode testing, you need a StoreKit config file, and make sure to select Edit Scheme -> Options tab and select StoreKit Configuration to the correct configuration file. But this does not affect your App Store version. You might need to handle unfinished transactions. Take a look at sample code from WWDC25 on StoreKit 2.
Topic: App & System Services SubTopic: StoreKit Tags:
2d
Reply to How can I configure the application or environment to suppress this repeated permission prompt?"
Paris and I chatted about your issue and we realised that it has a bit more subtlety than we first thought. First up, it’s not clear whether the app that hits this issue is one of your apps, or whether you’re hitting it an app created by a different third-party developer. We can help you in the first case, but in the second case you should talk to that app’s developer. Assuming that you are the one creating this app, the alert you’re seeing is the result of a feature known as app group container protection. There’s a link to the WWDC video that introduced this feature in Trusted Execution Resources. I also have a bunch of info about app groups in general in my App Groups: macOS vs iOS: Working Towards Harmony post. As explained in that last post, you don’t see this alert if all the apps accessing the app group are from the same team. However, there’s no way to avoid it if you’re trying to access an app group associated with some other team. The example you posted s
Topic: Privacy & Security SubTopic: General
2d
Does accessing multiple Keychain items with .userPresence force multiple biometric prompts despite reuse duration?
Hi everyone, I'm working on an app that stores multiple secrets in the Keychain, each protected with .userPresence. My goal is to authenticate the user once via FaceID/TouchID and then read multiple Keychain items without triggering subsequent prompts. I am reusing the same LAContext instance for these operations, and I have set: context.touchIDAuthenticationAllowableReuseDuration = LATouchIDAuthenticationMaximumAllowableReuseDuration However, I'm observing that every single SecItemCopyMatching call triggers a new FaceID/TouchID prompt, even if they happen within seconds of each other using the exact same context. Here is a simplified flow of what I'm doing: Create a LAContext. Set touchIDAuthenticationAllowableReuseDuration to max. Perform a query (SecItemCopyMatching) for Item A, passing [kSecUseAuthenticationContext: context]. Result: System prompts for FaceID. Success. Immediately perform a query (SecItemCopyMatching) for Item B, passing the same [kSecUseAuthenticationContext: context]. Result: System pro
Topic: Privacy & Security SubTopic: General Tags:
3
0
374
2d
Reply to Provisioning profile failed qualification. Profile doesn't support App Groups.
[quote='872694022, Kopyl, /thread/775029?answerId=872694022#872694022, /profile/Kopyl'] my app has nothing to do with iOS and their app groups. [/quote] OK. But my post, App Groups: macOS vs iOS: Working Towards Harmony, is still relevant regardless. The good news is that the situation has both stabilised and improved since you started this thread, and thus I don’t see any impediments to you solving this nicely. To offer specific advice I need to know more about your specific setup. What is your Team ID? What is the Apple ID of your app? And what app group ID are you trying to use? If you’re not comfortable sharing this info publicly, feel free to redact it. For example, for Apple Configurator that info would be: Team ID 4WXS7A4F54 -> 4________4 Apple ID 1037126344 -> 1________4 App group ID K36BKF7T3D.group.com.apple.configurator -> K________D.g___p.c__.a___e.c__________r IMPORTANT I’m looking for the Apple ID of the app, not your Apple ID (now known as an Apple A
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
2d
DNS Proxy system extension – OSSystemExtensionErrorDomain error 9 “validationFailed” on clean macOS machine
Hi, I’m implementing a macOS DNS Proxy as a system extension and running into a persistent activation error: OSSystemExtensionErrorDomain error 9 (validationFailed) with the message: extension category returned error This happens both on an MDM‑managed Mac and on a completely clean Mac (no MDM, fresh install). Setup macOS: 15.x (clean machine, no MDM) Xcode: 16.x Team ID: AAAAAAA111 (test) Host app bundle ID: com.example.agent.NetShieldProxy DNS Proxy system extension bundle ID: com.example.agent.NetShieldProxy.dnsProxy The DNS Proxy is implemented as a NetworkExtension system extension, not an app extension. Host app entitlements From codesign -d --entitlements :- /Applications/NetShieldProxy.app: xml com.apple.application-identifier AAAAAAA111.com.example.agent.NetShieldProxy com.apple.developer.system-extension.install com.apple.developer.team-identifier AAAAAAA111 com.apple.security.app-sandbox com.apple.security.application-groups group.com.example.NetShieldmac com.apple.security.files.user-
Topic: App & System Services SubTopic: Networking Tags:
1
0
101
2d
BGProcessingTask Not Triggering at Scheduled Time After Updating to Xcode 26.1.1
I’m reaching out regarding an issue we’ve been experiencing with BGProcessingTask since upgrading to Xcode 26.1.1. Issue Summary Our daily background processing task—scheduled shortly after end‑of‑day—has stopped triggering reliably at night. This behavior started occurring only after updating to Xcode 26.1.1. Prior to this update, the task consistently ran around midnight, executed for ~10–15 seconds, and successfully rescheduled itself for the next day. Expected Behavior BGProcessingTask should run at/near the scheduled earliestBeginDate, which we set to roughly 2 hours after end-of-day. The task should execute, complete, and then reschedule itself. Actual Behavior On devices running builds compiled with Xcode 26.1.1, the task does not trigger at all during the night. The same code worked reliably before the Xcode update. No system logs indicate rejection, expiration, or background task denial. Technical Details This is the identifier we use: private enum DayEndProcessorConst { static let taskIdent
Topic: UI Frameworks SubTopic: General Tags:
1
0
44
2d
Reply to Provisioning profile missing entitlement
Yes, the app builds fine when disabling key-value storage. Dumping the provisioning profile shows this: Entitlements => { application-identifier => TEAM_ID.com.ORGANIZATION.APP aps-environment => development com.apple.developer.icloud-container-development-container-identifiers => [ 0 => iCloud.ORGANIZATION.APP ] com.apple.developer.icloud-container-environment => [ 0 => Production 1 => Development ] com.apple.developer.icloud-container-identifiers => [ 0 => iCloud.ORGANIZATION.APP ] com.apple.developer.icloud-services => * com.apple.developer.team-identifier => TEAM_ID com.apple.developer.ubiquity-container-identifiers => [ 0 => iCloud.ORGANIZATION.APP ] com.apple.developer.ubiquity-kvstore-identifier => OTHER_TEAM_ID.com.ORGANIZATION.APP com.apple.security.application-groups => [ 0 => group.ORGANIZATION ] get-task-allow => true keychain-access-groups => [ 0 => TEAM_ID.* 1 => com.apple.token ] } So it does appear that the old te
Topic: App & System Services SubTopic: iCloud & Data Tags:
2d
App Store Rejection Under Guideline 4.2 (Minimum Functionality) – Hybrid Capacitor App With Native iOS Features and External Booking System
Summary I am seeking clarification regarding an App Store rejection under Guideline 4.2 – Design – Minimum Functionality, specifically around expectations for booking and payment flows in apps that rely on third-party, industry-standard reservation platforms. This app is a production application for a licensed transportation (black car / limo) service. It includes multiple native iOS features implemented via Capacitor and custom Swift plugins. However, the booking and payment flow depends on a third-party transportation platform (RideBits) that does not currently support deep linking with prefilled parameters or programmatic booking APIs. Before committing to a significant architectural change, I am hoping to understand whether Apple’s expectation under Guideline 4.2 is that all transactional booking and payment flows must be fully native and controlled by the app developer, even when third-party systems are operationally required. ⸻ App Context The app is designed for a real transportation business
Topic: App Store Distribution & Marketing SubTopic: App Review Tags:
1
0
50
2d
# [CRITICAL] Metal RHI Memory Leak - Resource exhaustion vulnerability (CWE-400) - Bug Report
[CRITICAL] Metal API Memory Leak - Heap Memory Never Released to OS (CWE-400) Security Classification This issue constitutes a resource exhaustion vulnerability (CWE-400): Aspect Details Type Uncontrolled Resource Consumption CWE CWE-400 Vector Local (any Metal application) Impact System instability, denial of service User Control None - no mitigation available Recovery Requires application restart Summary Metal heap allocations are never released back to macOS, even when the memory is entirely unused. This causes continuous, unbounded memory growth until system instability or crash. The issue affects any application using Metal API heap allocation. This was discovered in Unreal Engine 5, but reproduces in a completely blank UE5 project with zero application code - confirming this is Metal framework behavior, not application-level. Environment OS: macOS Tahoe 26.2 Hardware: Apple Silicon M4 Max (also reproduced on M1, M2, M3) API: Metal Reproduction Steps Run any Metal application that allocates and
Topic: Graphics & Games SubTopic: Metal Tags:
5
0
849
3d