App Groups names are red

Question

Created 2d

Replies 3

Boosts 0

Participants 2

I have recently restarted an old code base. The app uses App Groups to communicate with network and endpoint system extensions.

For some reason, in

Xcode > Target > Signing & Capabilities

the app groups are showing up with red text. I feel the red signifies a problem, but I cannot figure out what it is.

The app compiles and runs, but I feel there is problem that I am missing.

Any idea why App Group names would be displayed in red?

Answered by DTS Engineer in 857787022

It’s better to reply as a reply, rather than in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits.

I am using macOS style that starts with Team ID

OK.

The Xcode App Group editor is not fully up to speed when it comes to macOS-style app group IDs. The screen shot of your provisioning profile shows the it’s correctly authorising you to use any group matching 2V________.*. And the App Groups editor is showing that you claim two of those groups. That’s all good.

Note Regarding the group.com._.MySecurtiyAppGroup, it’s presence isn’t a problem. You’re not claiming access to that group, because the checkbox next it in the App Groups editor isn’t checked. And it’s fine for the profile to authorise you to use groups that you don’t then claim.

I suspect that the red indicates that the app group ID you’re claiming isn’t literally in the app group ID listed in the profile. With iOS-style app groups ID that’d be a serious problem. With macOS-style app group IDs, that’s fine because of the wildcard. I think it’d be reasonable for you to file a bug against Xcode about this [1]. If do that, please post your bug number, just for the record.

In the meantime, it’s important that you check that the build binary has the right entitlement claim, and that the claim is authorised by the profile:

% codesign -d --entitlements - Test799926.app              
…
[Dict]
    …
    [Value]
        [Array]
            [String] SKMME9E2Y8.Test799926.shared
    …
% security cms -D -i Test799926.app/Contents/embedded.provisionprofile | plutil -p -
{
  …
  "Entitlements" => {
    …
    "com.apple.security.application-groups" => [
      1 => "SKMME9E2Y8.*"
    ]
    …
  }
  …
}

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Assuming it reproduces in Xcode 26 RC. I’m not able to test that right now.

Boost

Answer 1

DTS Engineer OP

Apple

2d

App groups on the Mac have undergone significant changes in the last year or so. For the backstory, read App Groups: macOS vs iOS: Working Towards Harmony.

What style of app group ID are you using? macOS style, that starts with a Team ID? Or iOS-style, that starts with group.?

And what version of Xcode is this?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

THeberlein OP

1d

Adding another App Groups image showing the grayed out group I do not remember adding. Clicking on the (i) in the developer provisioning profile also says there are 3 groups.

0

Answer 3

DTS Engineer OP

Apple

1d

Recommended

It’s better to reply as a reply, rather than in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits.

I am using macOS style that starts with Team ID

OK.

The Xcode App Group editor is not fully up to speed when it comes to macOS-style app group IDs. The screen shot of your provisioning profile shows the it’s correctly authorising you to use any group matching 2V________.*. And the App Groups editor is showing that you claim two of those groups. That’s all good.

Note Regarding the group.com._.MySecurtiyAppGroup, it’s presence isn’t a problem. You’re not claiming access to that group, because the checkbox next it in the App Groups editor isn’t checked. And it’s fine for the profile to authorise you to use groups that you don’t then claim.

I suspect that the red indicates that the app group ID you’re claiming isn’t literally in the app group ID listed in the profile. With iOS-style app groups ID that’d be a serious problem. With macOS-style app group IDs, that’s fine because of the wildcard. I think it’d be reasonable for you to file a bug against Xcode about this [1]. If do that, please post your bug number, just for the record.

In the meantime, it’s important that you check that the build binary has the right entitlement claim, and that the claim is authorised by the profile:

% codesign -d --entitlements - Test799926.app              
…
[Dict]
    …
    [Value]
        [Array]
            [String] SKMME9E2Y8.Test799926.shared
    …
% security cms -D -i Test799926.app/Contents/embedded.provisionprofile | plutil -p -
{
  …
  "Entitlements" => {
    …
    "com.apple.security.application-groups" => [
      1 => "SKMME9E2Y8.*"
    ]
    …
  }
  …
}

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Assuming it reproduces in Xcode 26 RC. I’m not able to test that right now.

0