fix(updates): enable macOS self-update by dropping the App Sandbox#97
Merged
Conversation
The in-place self-updater never applied on macOS: "Download & install" downloaded and verified the DMG, then silently did nothing. Root cause is the App Sandbox — a sandboxed app can't spawn the swap helper (hdiutil/bash/chmod/open) via Process, nor write over /Applications/Daccord.app, so _installMacOs died at hdiutil attach while Windows/Linux (unsandboxed) worked. The sandbox is only required for Mac App Store distribution; this app ships as a DMG via GitHub Releases, so drop it (the same posture Sparkle-based self-updating Mac apps use): - Remove com.apple.security.app-sandbox from Release + Debug entitlements (Debug too, so the updater is exercisable in local builds). - Add NSCameraUsageDescription / NSMicrophoneUsageDescription to Info.plist. With the sandbox off, camera/mic are governed by TCC instead of the device.* entitlements; without these strings the app would crash on device access, breaking voice/video. - Flip the Xcode com.apple.Sandbox capability flag to 0 so the UI stays in sync and won't re-add the entitlement. Takes effect from the next tagged release forward; the shipped v0.2.1 DMG is still sandboxed and can't self-apply. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes the in-place self-updater actually work on macOS by removing the App Sandbox from the macOS build, and adds the camera/mic usage strings that become required once the sandbox is gone.
Why
On macOS, "Download & install" downloaded and verified the DMG, then silently did nothing — no swap, no relaunch. The updater code was fully wired (installer,
.dmgasset matching, release DMG all present), but the app was built sandboxed.A sandboxed app fundamentally can't do what
_installMacOsneeds:hdiutil/bash/chmod/openviaProcess(arbitrary exec is denied), nor/Applications/Daccord.appis denied.So the apply step died at
hdiutil attach; Windows/Linux work because those builds aren't sandboxed. The sandbox is only required for Mac App Store distribution — this app ships as a DMG via GitHub Releases, so dropping it is the right call (the same posture Sparkle-based self-updating Mac apps take).Changes
Release.entitlements/DebugProfile.entitlements— removecom.apple.security.app-sandbox. Debug too, so the updater can be exercised in local builds.Info.plist— addNSCameraUsageDescription+NSMicrophoneUsageDescription. With the sandbox off, camera/mic are governed by TCC instead of thedevice.*entitlements; without these strings the app would crash on device access, breaking voice/video (a hard project requirement).project.pbxproj— flip the Xcodecom.apple.Sandboxcapability flag to0so the UI stays in sync and won't silently re-add the entitlement.Reviewer notes
plutil -lintpasses on all three plists; theapp-sandboxkey is gone from both entitlement files; both usage strings are present; no other sandbox injection exists in the macos tree/Podfile; the Release config'sCODE_SIGN_ENTITLEMENTSpoints at the editedRelease.entitlements. Since CI builds unsigned,codesignembeds that file verbatim, so the produced bundle will not be sandboxed.macos-15runner or a macOS 14+ Mac:codesign -d --entitlements - build/macos/Build/Products/Release/Daccord.appshows noapp-sandboxand the usage strings.🤖 Generated with Claude Code