Hello, I am currently facing an issue with my iOS app and its associated Preview extension. I am trying to save a file to a shared container using App Groups, so that my main app can read the file. The code works perfectly on the iOS simulator, but when I run the app on a physical device I encounter a "You don't have permission to save the file" error. Here's the relevant code snippet: let appGroupIdentifier = "group.com.yourcompany.yourapp" func saveDataToSharedContainer(fileName: String, data: Data) -> Bool { guard let containerURL = FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroupIdentifier) else { print("Error: Unable to access the shared container.") return false } let fileURL = containerURL.appendingPathComponent(fileName) do { try data.write(to: fileURL, options: .atomic) print("Data saved to shared container successfully.") return true } catch { print("Error: Unable to save data to shared container. \(error)") return false } } I have already verified the following: App Groups capability is enabled for both the main app target and the extension target. The App Group identifier is consistent in both the main app target and the extension target, as well as in the Swift code. Provisioning profiles and signing certificates are up-to-date, and the issue persists after cleaning the project and resetting the provisioning profiles. Despite trying these steps, the issue remains unresolved. This error is reproducible in a new project with a Preview extension. I would greatly appreciate any insights or suggestions from the community to help me resolve this issue. Thank you in advance!

I'm looking to automate device provisioning using App Store Connect API. Two things are snagging me: Updating Profiles API: Adding a new device seems clunky (read-all-devices, save, delete profile, recreate with a new device). Is there a simpler way to do it? I looked over the documentation and it seems like there's no streamlined way to do it, am I correct? Entitlements API: Not public yet? Does anyone know about any plans to open it up soon? I asked Apple Support and they didn't provide any information on this. Specifying entitlements during provisioning is an important step. Thanks for any help!

We have a legacy app written in a mix of C, ObjC, C++ and ObjC++ with .xib files. It is not sandboxed. It sends an Apple Event to TV (the app of that name from Apple, not a physical TV) using /usr/bin/osascript, calling a compiled Apple Script which is in our app bundle's Resources directory with parameters which we generate in our app at runtime. The first time it does this on a fresh system, the OS puts up a dialog asking for permission to control TV, and after the user clicks Allow, our app appears under Security and Privacy in the Automation section. That's all fine, but what is unexpected is that the app has no Apple Events entitlement (com.apple.security.automation.apple-events), and it doesn't have a NSAppleEventsUsageDescription string either. The documentation at https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_automation_apple-events says Your app doesn’t need the Apple Events Entitlement if it only sends Apple events to itself or to other processes signed with the same team ID. but we're not on the Apple team. When I filter the log for messages from tccd pertaining to our app, it does indeed complain : Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for accessing={TCCDProcess: identifier=<our bundle id>” But despite those complaints, everything works - I can send the event, and TV acts upon it. Is this working only by accident, and might fail in some minor future OS update? tccd also complains about the microphone Prompting policy for hardened runtime; service: kTCCServiceMicrophone requires entitlement com.apple.security.device.audio-input but it is missing for requesting={TCCDProcess: identifier=<our bundle ID> but we don't use the microphone tccd complains about this too <path-to-our-app> attempted to call TCCAccessRequest for kTCCServiceAccessibility without the recommended com.apple.private.tcc.manager.check-by-audit-token entitlement What does that mean, and should we be concerned?

I need to obtain the user's EID within my app. We are a mobile network operator and have also applied for Apple's eSIM development. Does Apple provide a certified developer access to an API for obtaining EID? I understand that there is no public API available, but I'm unsure if approved operators can access EID. If so, how can I apply for this private API?

In my sandboxed MacOS app I want to access OSLogStore programmatically to fetch logs for multi-component application (app, libraries, deriver) for further analysis. According to the documentation, - https://developer.apple.com/documentation/oslog/oslogstore/3366102-local the app should have com.apple.logging.local-storeentitlement. I have added this entitlement "by hand" to the entitlement file as I I can't find a correspondent entry in the Xcode -> Sign & Capabilities interface. When I run the app, I get Unsatisfied entitlements: com.apple.logging.local-store error and the app doesn't start. If I remove the entitlement, the app can't get access to the logd subsystem. How can I add com.apple.logging.local-store to my app? Should I request this not visible via Xcode configuration UI from apple? Thanks!

Hi, My application doesn't start playback anymore after signing it with entitlements. <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.files.user-selected.read-only</key> <true/> <key>com.apple.security.device.audio-input</key> <true/> <key>com.apple.security.device.microphone</key> <true/> <key>com.apple.security.assets.music.read-write</key> <true/> <key>com.apple.security.network.server</key> <true/> </dict> </plist> regards, Joël

Hi All, I submitted a Family Controls Request Form but haven't heard back. I didn't get any case id when I submitted the request, so how do you track it and know when It is approved? I'm currently developing an app that requires the main target and also the app extension to both use Family Controls. Does this mean I need to request forms for both app bundles separately or just the main app? This is really worrying for us as our project is almost ready and we are unable to launch it :( . Would appreciate any responses. Thanks,

**Why does using CameraPicker require user authorization through a pop-up? ** Why don't ImagePicker or PhotoPicker require additional pop-up authorizations for accessing the photo library? All of these are implemented using UIImagePickerController, so why does one require a pop-up and the others do not? Additionally, I thought that by configuring the picker, I would theoretically not need any permissions. If permissions are still required, wouldn’t it make more sense to directly request camera permissions and utilize the native camera functionality? What then are the advantages of using the picker?

Hello, I am writing a Desktop application for macOS with XCode. This application will be available on app store. So, i have to put sandbox entitlement. So, this application won't be able to access Desktop folder. It will be jailed into a specific directory to store datas. I have installed a macOS application from appstore. When I launched this application, I got a TCC prompt, asking me to allow this application to access Desktop (or Downloads I don't remember). How can this be possible ? I have tried to write a sandboxed application which tries to access to Desktop folder. I didn't get any TCC prompt: My access was rejected. How can I ask to access Desktop folder from I sandboxed application ? Thanks a lot

Hey, I am trying to use Family Controls in Mac Catalyst. On the iOS app it works fine. On macOs using Mac Catalyst it builds fine but I get following console output. Failed to get service proxy: Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.FamilyControlsAgent was invalidated: failed at lookup with error 159 - Sandbox restriction." UserInfo={NSDebugDescription=The connection to service named com.apple.FamilyControlsAgent was invalidated: failed at lookup with error 159 - Sandbox restriction.}` When i try to open the FamilyActivityPicker on the macOs app following error is displayed in the GUI. The operation could not be completed. (FamilyControls.ActivityPickerRemoteView Error error 2.) Do I need a familyControls capability for macOs? If yes, I only find it for iOS. Thanks for hints and help :)

I've heard family controls request forms can take up to weeks and even months... I'm currently developing an app that requires the main target and also the app extension to both use Family Controls. Does this mean I need to request forms for both app bundles separately or just the main app? If I have to wait weeks or even months for both then that's a bit painful tbh. Is there a way to distribute to testflight without getting approved for the family controls entitlement? Thanks

I requested the com.apple.developer.device-information.user-assigned-device-name entitlement on Feb 11 and received an email reply stating "We’ll contact you within a few weeks with your request status." However, it's been more than a month without any updates. Can anyone chime in with their experience RE: how long it took for Apple to review their request for this entitlement? https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_device-information_user-assigned-device-name

Hello everyone! Since iOS 17.4, it's now easier to set up an eSIM from a browser/email or with a link. We can now longpress the QR code to get the option to add an eSIM. Is it still required to have that private entitlement to enable the same functionality in-app but not in a browser? Seems odd. I can store QR codes on Imgur to install eSIM but can't do the same with my native app by CTCellularPlanProvisioning.addPlan method. Redirecting users to the browser seems like a workaround, but it creates a noticeable discrepancy in usability. I might have overlooked some SDK updates or new methods. Are there any new approaches to enable in-app eSIM setup with the latest update? Secondly, in the "Other eSIM activation methods" section of this page, a special link is mentioned, but I couldn't find any examples or resources for that. Thanks

The documentation for CarPlay (https://developer.apple.com/documentation/carplay/requesting_carplay_entitlements) tells you to disable automatic signing in the section titled "Import the CarPlay Provisioning Profile": Click All in the scope bar, and then deselect “Automatically manage signing”. There have also been other posts in the past about the inability to use automatic signing with CarPlay: https://developer.apple.com/forums/thread/63468 However in a recent post of mine (https://developer.apple.com/forums/thread/717429?login=true&page=1#732392022) I was instructed how to set it up so that I could use automatic signing for the new user-assigned-device-name entitlement and it worked so I thought "Can I do the same thing for CarPlay?" and it seems to be working so far. Is automatic signing with CarPlay now possible? We have been able to use automatic signing to archive successfully and run to real devices and verify that CarPlay is working. I'm crossing my fingers that we'll be able to submit and get the build approved and never have to touch manual signing again. Hopefully it works and the documentation is just out of date.

I am using Godot 4.2.1 and C# (.NET 8.0.1) to create an app. In Godot the app is exported to an XCode project so it can then be built to run on IOS devices. Access WiFi is checked in the Godot presets I have the multicast entitlement from Apple. Communication over UDP using Unicast to send and receive packets works correctly on iOS, macOS and Android devices. To set the multicast entitlement, the project name is selected in XCode, to open a big dialog box with multiple tabs. Click on the tab Signing and Capabilities. To add the multicast to the project "+ Capability" is clicked, search for "multi" which brings up multicast networking. Click on multicast networking to add it to the project. Then in the same dialog box, click the tab build settings and under "Signing" code signing identity is changed to iOS developer for all Debug and release items. The project is then built and run on the iOS device. The symptom is that no multicast packets are received. The multicast receiving code below works on macOS and Android devices so there must be something going on with the iOS devices that I'm missing. The UDP server is configured in C# code as a _listener: private const string MULTICAST_ADDRESS = "239.255.1.1"; private const int BCON_PORT = 49707; _listener = new UdpClient(); _listener.ExclusiveAddressUse = false; _listener.JoinMulticastGroup(IPAddress.Parse(MULTICAST_ADDRESS)); _listener.Client.Bind(new IPEndPoint(IPAddress.Any, BCON_PORT));

Hello! Firstly, I am submitting an entitlement request to access the E-sim configuration for the iOS application. While filling out the form, I encountered an issue with providing carrier information. The form is designed for a single carrier, but I have five carriers. Should I list all of them? Secondly, I have come across numerous discussions online regarding the time it takes to process such requests. Could you please provide me with an estimated timeframe for completion? Our customer is interested in completing the feature within a month. Thanks

I got approved for ProximityReader APIs for Apple Tap to Tay on iPhone. The Setting up the entitlement for Tap to Pay on iPhone guide says to look for "Additional Capabilities." I do not see it under my Certificates, Identifiers & Profiles. Where should I look?

I encountered a problem while implementing DNS Proxy for Network Extension. It consists of MyMyExt, a System Extension that implements DNS Proxy, and MyMyService, a container. The system extension consists of classes that inherit the NEDNSProxyProvider. Class has overrided "override init(), override func startProxy(...), override func stopProxy(...) override func handleNewFlow(...)" Since the manager.loadFromPreferences(...) and manager.saveToPreferences(...) calls, system extensions and DNS Proxy have been added. However, contrary to expectations, init(), startProxy(...), etc. are not being called. (In System Settings → Network → Filter, DNS Proxy has been added, but is displayed as "Activated" and a yellow circle) Here is the information that appears on the console. ... Omitted ... MyMyService.MyMyExt [Info] DNSProxyManager.swift: 51 [-] DNSProxy: saved nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Adding a connection for client mDNSResponder[167] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: handleNetworkDetectionNotification &lt;MyMyService.MyMyExt&gt; nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Received a restart command from nesessionmanager[1011] nesessionmanager Registering session NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Resetting VPN On Demand nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)] in state NESMVPNSessionStateIdle: update configuration nesessionmanager &lt;NESMServer: 0x13ae0ac90&gt;: &lt;MyMyService.MyMyExt&gt; Register DNS Proxy Session: NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Successfully registered nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: status changed to connecting nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)] in state NESMVPNSessionStateIdle: received start message nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Leaving state NESMVPNSessionStateIdle nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Entering state NESMVPNSessionStatePreparingNetwork nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Cannot create agent for plugin type MyMyService.MyMyExt, missing designated requirement nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Failed to create an NEAgent nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Leaving state NESMVPNSessionStatePreparingNetwork nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:&lt;GUID&gt;:(null)]: Entering state NESMVPNSessionStateStopping, timeout 20 seconds ... Omitted ... Perhaps the key is the "Cannot create agent for plugin type MyMyService.MyMyExt, missing designated requirement" recorded in the log. But I can't find out what this message is about or how to resolve it. and, here is my code, more info at my previous post. I ask for your help. Thank you, for your attention.

Do I need an entitlement to use the ARWorldTrackingConfiguration and get that data in RoomPlan enhancements being done?

I am using TapToPay with stripe it is working fine on the development mode but when i try to create build for app store it shows 2 errors.