also looking at this
fix(release): prevent the standalone macOS CLI sandbox crash
#291
5 files
+120
-31
| @@ -1,36 +1,20 @@ | ||
| 1 | 1 | <?xml version="1.0" encoding="UTF-8"?> |
| 2 | 2 | <!-- |
| 3 | Distribution entitlements for the Craft binary shipped to end users. | |
| 3 | Distribution entitlements for the standalone Craft CLI installed by Pantry. | |
| 4 | 4 | |
| 5 | We deliberately request the *minimum* set of capabilities here — the dev | |
| 6 | plist (`entitlements-dev.plist`) is what disables the sandbox and library | |
| 7 | validation for local-iteration ergonomics. End users should never run with | |
| 8 | those flags turned off, since that disables the macOS exploit-mitigation | |
| 9 | story we otherwise rely on. | |
| 5 | App Sandbox requires a bundle identity. This raw executable has no embedded | |
| 6 | Info.plist and must accept user-supplied paths from the shell; enabling App | |
| 7 | Sandbox here traps in libsecinit before main. Hardened runtime is enabled | |
| 8 | separately by codesign's runtime option, and library validation stays on. | |
| 10 | 9 | |
| 11 | If your app needs extra capabilities (camera, microphone, user-selected | |
| 12 | files, etc.), generate a custom plist via | |
| 13 | `generateEntitlements({ camera: true, ... })` from the SDK or fork this | |
| 14 | file in your own project. | |
| 10 | Application bundles have their own identity and entitlement policy, generated | |
| 11 | by the SDK. This plist is only for the standalone CLI release artifact. | |
| 15 | 12 | --> |
| 16 | 13 | <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> |
| 17 | 14 | <plist version="1.0"> |
| 18 | 15 | <dict> |
| 19 | <!-- Run inside the macOS app sandbox. --> | |
| 20 | <key>com.apple.security.app-sandbox</key> | |
| 21 | <true/> | |
| 22 | ||
| 23 | <!-- WebKit needs JIT for modern JS performance. Limited to the runtime | |
| 24 | WebView, not arbitrary code. --> | |
| 16 | <!-- Allow the runtime's JIT under hardened runtime. --> | |
| 25 | 17 | <key>com.apple.security.cs.allow-jit</key> |
| 26 | 18 | <true/> |
| 27 | ||
| 28 | <!-- Allow outbound HTTP. Required for the auto-updater and fetch API. --> | |
| 29 | <key>com.apple.security.network.client</key> | |
| 30 | <true/> | |
| 31 | ||
| 32 | <!-- Allow user-selected files (open dialog returns sandbox-scoped URLs). --> | |
| 33 | <key>com.apple.security.files.user-selected.read-write</key> | |
| 34 | <true/> | |
| 35 | 19 | </dict> |
| 36 | 20 | </plist> |