Hey, I am trying to use Family Controls in Mac Catalyst. On the iOS app it works fine. On macOs using Mac Catalyst it builds fine but I get following console output. Failed to get service proxy: Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.FamilyControlsAgent was invalidated: failed at lookup with error 159 - Sandbox restriction." UserInfo={NSDebugDescription=The connection to service named com.apple.FamilyControlsAgent was invalidated: failed at lookup with error 159 - Sandbox restriction.}` When i try to open the FamilyActivityPicker on the macOs app following error is displayed in the GUI. The operation could not be completed. (FamilyControls.ActivityPickerRemoteView Error error 2.) Do I need a familyControls capability for macOs? If yes, I only find it for iOS. Thanks for hints and help :)

Hi All, I submitted a Family Controls Request Form but haven't heard back. I didn't get any case id when I submitted the request, so how do you track it and know when It is approved? I'm currently developing an app that requires the main target and also the app extension to both use Family Controls. Does this mean I need to request forms for both app bundles separately or just the main app? This is really worrying for us as our project is almost ready and we are unable to launch it :( . Would appreciate any responses. Thanks,

After updating to Xcode 15.3 and Sonoma, I started getting an error when packaging my app: Provisioning profile failed qualification Profile doesn't include the com.apple.developer.mail-client entitlement. There is no indication in the documentation that this has anything to do with the provisioning profile, and there is no capacility that needs to be added. I was given the "com.apple.developer.mail-client" entitlement from Apple over a year ago as documented in: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_mail-client, and it worked fine until now.

I requested the com.apple.developer.device-information.user-assigned-device-name entitlement on Feb 11 and received an email reply stating "We’ll contact you within a few weeks with your request status." However, it's been more than a month without any updates. Can anyone chime in with their experience RE: how long it took for Apple to review their request for this entitlement? https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_device-information_user-assigned-device-name

I have a macOS app which contains a dext. I'd like to distribute it to external testers using TestFlight, so it has to pass Mac App Store review. It failed, because the App Sandbox entitlement was missing. I checked the app, it has the entitlement, but the dext does not. However, the .entitlements file used by the dext does contain App Sandbox set to true. I tried adding a "fake-entitlement" value to the .entitlements file, and that made it into the dext's code signature, but the App Sandbox entitlement appears to be stripped out by the build process? For a dext target, it isn't possible to add the App Sandbox capability in Xcode's Signing and Capability section. I have to add the entitlement manually in the .entitlement file (or it was put there by the Xcode driver template, I don't remember). I've tried clean building several times, I've tried Xcode 15.0.1, 15.2 and 15.3, but the result is always the same. I'm inspecting the entitlements using codesign -dvvv --entitlements - Does anyone know what I can do to put the App Sandbox entitlement into my dext's signature? Is this happening to anyone else?

Hello everyone! Since iOS 17.4, it's now easier to set up an eSIM from a browser/email or with a link. We can now longpress the QR code to get the option to add an eSIM. Is it still required to have that private entitlement to enable the same functionality in-app but not in a browser? Seems odd. I can store QR codes on Imgur to install eSIM but can't do the same with my native app by CTCellularPlanProvisioning.addPlan method. Redirecting users to the browser seems like a workaround, but it creates a noticeable discrepancy in usability. I might have overlooked some SDK updates or new methods. Are there any new approaches to enable in-app eSIM setup with the latest update? Secondly, in the "Other eSIM activation methods" section of this page, a special link is mentioned, but I couldn't find any examples or resources for that. Thanks

Hello! Firstly, I am submitting an entitlement request to access the E-sim configuration for the iOS application. While filling out the form, I encountered an issue with providing carrier information. The form is designed for a single carrier, but I have five carriers. Should I list all of them? Secondly, I have come across numerous discussions online regarding the time it takes to process such requests. Could you please provide me with an estimated timeframe for completion? Our customer is interested in completing the feature within a month. Thanks

I got approved for ProximityReader APIs for Apple Tap to Tay on iPhone. The Setting up the entitlement for Tap to Pay on iPhone guide says to look for "Additional Capabilities." I do not see it under my Certificates, Identifiers & Profiles. Where should I look?

Do I need an entitlement to use the ARWorldTrackingConfiguration and get that data in RoomPlan enhancements being done?

I encountered a problem while implementing DNS Proxy for Network Extension. It consists of MyMyExt, a System Extension that implements DNS Proxy, and MyMyService, a container. The system extension consists of classes that inherit the NEDNSProxyProvider. Class has overrided "override init(), override func startProxy(...), override func stopProxy(...) override func handleNewFlow(...)" Since the manager.loadFromPreferences(...) and manager.saveToPreferences(...) calls, system extensions and DNS Proxy have been added. However, contrary to expectations, init(), startProxy(...), etc. are not being called. (In System Settings → Network → Filter, DNS Proxy has been added, but is displayed as "Activated" and a yellow circle) Here is the information that appears on the console. ... Omitted ... MyMyService.MyMyExt [Info] DNSProxyManager.swift: 51 [-] DNSProxy: saved nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Adding a connection for client mDNSResponder[167] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: handleNetworkDetectionNotification <MyMyService.MyMyExt> nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Received a restart command from nesessionmanager[1011] nesessionmanager Registering session NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Resetting VPN On Demand nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)] in state NESMVPNSessionStateIdle: update configuration nesessionmanager <NESMServer: 0x13ae0ac90>: <MyMyService.MyMyExt> Register DNS Proxy Session: NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)] nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Successfully registered nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: status changed to connecting nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)] in state NESMVPNSessionStateIdle: received start message nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Leaving state NESMVPNSessionStateIdle nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Entering state NESMVPNSessionStatePreparingNetwork nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Cannot create agent for plugin type MyMyService.MyMyExt, missing designated requirement nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Failed to create an NEAgent nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Leaving state NESMVPNSessionStatePreparingNetwork nesessionmanager NESMDNSProxySession[Primary Tunnel:MyMyService.MyMyExt:<GUID>:(null)]: Entering state NESMVPNSessionStateStopping, timeout 20 seconds ... Omitted ... Perhaps the key is the "Cannot create agent for plugin type MyMyService.MyMyExt, missing designated requirement" recorded in the log. But I can't find out what this message is about or how to resolve it. and, here is my code, more info at my previous post. I ask for your help. Thank you, for your attention.

I am using TapToPay with stripe it is working fine on the development mode but when i try to create build for app store it shows 2 errors.

Hi, I've an OSX app packages up outside of XCode (because it's based on a legacy cross-platform build system). The layout looks like this: App App/Contents <- info.plist is here App/Contents/Frameworks <- Dylibs go here App/Contents/MacOS <- Main executable and bash startup script go here App/Contents/Resources <- Non-executable resources. There are no helper apps, etc that I know of. info.plist, the Frameworks, Main Executable and App are all signed. The Main Executable includes entitlements with the sandbox entitlements. On startup, we crash in the usual Sandbox place: 0 libsystem_secinit.dylib 0x7ff811fcc2a5 _libsecinit_appsandbox.cold.9 + 49 1 libsystem_secinit.dylib 0x7ff811fcb636 _libsecinit_appsandbox + 1749 2 libsystem_trace.dylib 0x7ff8044029e9 _os_activity_initiate_impl + 50 3 libsystem_secinit.dylib 0x7ff811fcaf20 _libsecinit_initializer + 67 4 libSystem.B.dylib 0x7ff811fe08a1 libSystem_initializer + 292 5 dyld 0x20905939f invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const::$_0::operator()() const + 185 (Even though I'm not signing the bash startup script, which invokes the main executable, it's still getting signed and has entitlements. And I'm not using --deep. I've tried setting com.apple.security.inherit - that didn't work. I've tried explicitly signing the bash startup script - that didn't work. It fails not matter how I start the app - by clicking on it, command line, just launching the main executable via the command line, and of course using LLDB. Any ideas? Crash report enclosed. ProgUhost-2024-02-17-171425.ips

Since the macOS 14.2 update, services installed with SMAppService are required to be sandboxed when the main app is sandboxed as well (113037504). I had developed a daemon to communicate with the pmset interface, as that requires root privileges to make changes. Since the macOS 14.2 this daemon executable has to be sandboxed as well if I want my main app to be sandboxed. When sandboxing the daemon, it requires a temporary exception entitlement as the pmset command writes to one of the following two preference located in /Library/Preferences/: com.apple.PowerManagement.plist com.apple.PowerManagement.{UUID}.plist The specific command I use writes to the latter, which includes some specific UUID, that is specific to that device. When I use the: com.apple.security.temporary-exception.shared-preference.read-write entitlement with com.apple.PowerManagement.0000 where 0000 is the exact UUID string as on my Mac, the daemon is able successfully use the pmset command. This results however in that on other user devices it would not work as the UUID in the preference name would be different. When I try setting it to a wildcard variation such as com.apple.PowerManagement.*, the command doesn't run anymore as this format for the exception entitlement seems to be unsupported. My question is now, is there any way to get an exception entitlement which accounts for the unique identifier or is that impossible and must I disable the sandbox altogether? (as I have to use a daemon, I am not developing for the Mac App Store and a sandbox isn't strictly necessary so it wouldn't break my app. Its more I would prefer to use sandboxing if possible) Thanks in advance! For reference, this is the error I get when the entitlement is set incorrectly or not set: rejecting write of key(s) AC Power in { com.apple.PowerManagement.0000, kCFPreferencesAnyUser, kCFPreferencesCurrentHost, /Library/Preferences/com.apple.PowerManagement.0000.plist, managed: 0 } from process 15694 (pmset) because setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access

I am using Godot 4.2.1 and C# (.NET 8.0.1) to create an app. In Godot the app is exported to an XCode project so it can then be built to run on IOS devices. Access WiFi is checked in the Godot presets I have the multicast entitlement from Apple. Communication over UDP using Unicast to send and receive packets works correctly on iOS, macOS and Android devices. To set the multicast entitlement, the project name is selected in XCode, to open a big dialog box with multiple tabs. Click on the tab Signing and Capabilities. To add the multicast to the project "+ Capability" is clicked, search for "multi" which brings up multicast networking. Click on multicast networking to add it to the project. Then in the same dialog box, click the tab build settings and under "Signing" code signing identity is changed to iOS developer for all Debug and release items. The project is then built and run on the iOS device. The symptom is that no multicast packets are received. The multicast receiving code below works on macOS and Android devices so there must be something going on with the iOS devices that I'm missing. The UDP server is configured in C# code as a _listener: private const string MULTICAST_ADDRESS = "239.255.1.1"; private const int BCON_PORT = 49707; _listener = new UdpClient(); _listener.ExclusiveAddressUse = false; _listener.JoinMulticastGroup(IPAddress.Parse(MULTICAST_ADDRESS)); _listener.Client.Bind(new IPEndPoint(IPAddress.Any, BCON_PORT));

Hello, I requested entitlement 4 times from 4 days ago. But I did not get any kind of response mail. I need entitlement for only development, to check file IO events. Is there any way to request entitlement ? Regards, Daehong

When we added a com.apple.developer.associated-domains entitlement to our apps, they crash on launch with a code signing error on our old 2011 Mac running 10.13.6 High Sierra. The signature is accepted on current Macs, and the associated domains do work. The command line utilities say everything is ok, the entitlement is in the signature and the embedded profile. The apps will run fine on High Sierra without the entitlement. The only guess I have is perhaps High Sierra is rejecting any unknown entitlement? The error is Code has restricted entitlements, but the validation of its code signature failed. Unsatisfied Entitlements: No Unsatisfied Entitlements are listed. Removing the entitlements from the signature lets the apps run on High Sierra.

Hi, our account holder did the networking.multicast entitlement request on November 24th through the appropriate form: https://developer.apple.com/contact/request/networking-multicast but we never received any kind of answer, positive or negative. We also tried to submit again the request 3 weeks ago and still no answer. I already checked if the entitlement was granted without an answer and we don't have it. I tried to write also with the feedback assistant but no answer. What I can do to unblock this situation?

I am developing a Mac application. Within this application, I need to execute certain commands and expressions with root privilege access. I am working to perform this action, and once authenticated, it should persist throughout the entire app lifecycle. Similar to allowing keychain access for Xcode applications by selecting the 'Always allow' permission. Please let me know: 1. Is it possible for a third-party application to exhibit such behavior? 2. If it is possible, what type of permissions do I need to set? 3. Do I need any specific entitlements for this? Thank you for your insights and assistance. Your responses are highly valued, and any guidance you can provide will be greatly appreciated.

There are several questions regaring the following guide about Interoperability requests in the EU. Will other developers be able to use all the APIs that have been created? For non-EU applications? If it's a private API, would there be a list of all the APIs that have been implemented to see who has which one? Will there be a difference in priority between feature requests submitted through Feedback Assistant and interoperability requests?

Hello! I have never distributed an apple app before. Right now, I am trying to distribute a macOS app. I created a provisioning profile of type "Developer ID Application" and it has the following capabilities enabled. Now, when I download the profile and use it for my app, xcode gives me the following error: Lmk what I need to do since I am super unfamiliar with this process.