Trying to remove app groups from my macOS app doesn't seem to work

Hi, a short question really, which boils down to...

How do I make sure I have removed all usage of app groups in my Mac app store app, such that the Mac app store agrees I have!

Fundamentally, what I'm trying to do is transfer my app to another developer. In previous releases of this app on the App Store, I used a shared app group container to communicate between the main app and it's (embedded) XPC service, but this blocks App Store transfer of the app to another developer.

So I came up with another approach for the App and XPC service to communicate (using a URL bookmark for security scoped files to be passed to the XPC service). And then tried various things to get the app store to accept that I'm no longer using app groups. So far with no luck...

  • removed the app groups entitlements by hand from the entitlements files used to sign the main app and the XPC service, respectively.

  • when that didn't work, go into the Developer Portal, find the app ids for the main app and the XPC service, make sure those app ids had the app groups entitlement removed too, created a new provisioning profile for the app, based on this updated app id, downloaded it, rebuilt an app archive using this updated provisioning profile and used it to create another new release on the app store

  • when that didn't work, found and deleted all app app groups in my developer account in the developer portal itself

None of the above worked.

When I try to transfer the app in App Store Connect, I still see the same message, "You can't transfer this app because of the following reasons: Sandboxed Group Container You can only transfer sandboxed apps that are not sharing a group container."

I'm now pretty far from using a shared group container, so I'm puzzled why it still thinks I am?


There is one last thing I can try... I noticed over the weekend that even though the entitlement is gone, there's one place in code that may or may not be run on rare occasions (hard to tell) that attempts to open the app group shared container with the code...

let container = FileManager.default.containerURL(forSecurityApplicationGroupIdentifier:

...which I think is just returning nil and doing nothing. Potentially the App Store sees that attempted API access for shared group containers and assumes I'm still using app groups (even though there's no entitlement so that call will always be failing)?

I can do yet another App Store update and just remove that code.

But I want to get to the bottom of why it has been failing all this time. What is App Store Connect / the Mac App Store looking at that makes it think I'm still using app groups? I've tried so many things and don't want to mess users around with another App Store update unless this code above is the actual cause!

Cheers

p.s. It's a teamID based app group of the form... MY_TEAM_ID.s4a

e.g. SWDC5K54B7.s4a

Answered by DTS Engineer in 864412022
what I'm trying to do is transfer my app to another developer

Right. You’ve misunderstand the relevant bit of App Store Connect > Transfer an app > App transfer criteria. It says:

Mac apps that have used the sandbox environment and share the Application Group Container Directory with other Mac apps can't be transferred.

That “have used” is important. It doesn’t mean “are currently using” but rather it means “have ever used”. If your Mac app has ever used an app group, you can’t transfer it )-:

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Accepted Answer
what I'm trying to do is transfer my app to another developer

Right. You’ve misunderstand the relevant bit of App Store Connect > Transfer an app > App transfer criteria. It says:

Mac apps that have used the sandbox environment and share the Application Group Container Directory with other Mac apps can't be transferred.

That “have used” is important. It doesn’t mean “are currently using” but rather it means “have ever used”. If your Mac app has ever used an app group, you can’t transfer it )-:

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks.

Oof. That is not good to hear.

So presumably the only way out of this is if I hand the source code to my friend, they build effectively a "new app" with a new app id, new name on the store, new description, etc.

They can "take over" from me with the new app, I can put something to that effect in my app description perhaps and remove my app from sale.

Then existing customers who have downloaded it will still be able to use my version but all new people looking will go to his instead. Sounds like that's just about the only viable approach?

That option certainly works, but it’s not without its challenges, including:

  • If the app costs money, or has in-app purchases, users are likely to get grumpy about having to buy things again.
  • If the app stores critical data in its container, you’ll need a way to migrate that data, which is tricky these days due to app container protection [1].

Regardless of what else you do here, I recommend that you file a bug against App Store Connect asking them to remove this limitation. Things have changed a lot since app transfers first rolled out on the Mac, and maybe that offers an avenue for improvement here.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] I have a link to the WWDC session that covers that in Trusted Execution Resources.

Trying to remove app groups from my macOS app doesn't seem to work
 
 
Q