electron: Electron broken on OS X in Apple Sandboxed apps (App Store)

For people watching this issue, you can just follow the latest guide to get Electron sandboxed for Mac App Store, there is no need to wait for next release.

The key change is adding an entry to entitlements:

    <key>com.apple.security.temporary-exception.sbpl</key>
    <string>(allow mach-lookup (global-name-regex #"^org.chromium.Chromium.rohitfork.[0-9]+$"))</string>

@zcbenz Lemme try to get set up with building custom libchromiumcontent and I’ll have a go tomorrow

@sethlu My app also started freezing when sandboxed after updating Electron from v1.1.0 to 1.2.0. The problem went away after I upgraded electron-packager to the latest version and I added com.apple.security.application-groups and ElectronTeamID keys as described in the updated MAS submission guide.

FYI: I submitted an app (electron 0.37.3) with these changes and it got approved.

This is a super important bug for us at Slack, we’ll probably have a look at this soon

@sethlu Remember, many node.js / web devs have no idea about PLists so, being Opinionated and just filling out everything for them from the package.json info might be A Better Thing (as long as people can opt-out and choose their own way of course) - I would assume the input Info.plist is junk / incorrectly configured and prioritize info in package.json as much as possible

It would be real neat if electron-osx-sign handled fixing up entitlements automatically /cc @sethlu

sad thing I need API introduced at 0.36.11 and can’t just use old mas build. any workaround ideas?

Just tested some of the recent releases of Electron:

• Electron v0.36.x darwin builds all work very well.
• Electron v0.36.x mas builds work with some glitch in graphics after sandboxed (I assume with CSS transitions and animations, or for things related to GPU)?
• Electron v0.37.0 darwin/mas fails to start (fixed in v0.37.1).
• Electron v0.37.1 darwin build has some glitch like that in Electron v0.36.x mas builds (before and after code signed for distribution).
• Electron v0.37.1 mas build has some glitch like that in Electron v0.36.x mas builds; however, it fails to load after sandboxed?

okay, I found what kills app when it is signed http://electron.atom.io/docs/all/#appmakesingleinstancecallback shouldQuit === true in this example from old official doc:

const shouldQuit = app.makeSingleInstance(() => {
  const {mainWindow} = state
  // Someone tried to run a second instance, we should focus our window
  if (mainWindow) showMainWindow()
  return true
})

if (shouldQuit) quit()

@sethlu it looks like it is same as here: electron-userland/electron-osx-sign/issues/59 any update on that problem?

@sethlu as I said, my app after being signed can’t run and exit after launch, same things happen and on App Store reviews. and sandboxing is still rise questions from App Store, here is answer:

Performance - 2.1 We noticed that with a valid receipt installed, your app quits on launch. The Console reports the app “Exited with exit code: 173” and the OS states the app “is damaged and can’t be opened”. This generally indicates that the app is not verifying its receipt correctly.

Next Steps Please revise your app and test it to ensure that it runs as expected.

Performance - 2.4.5

We’ve determined that one or more temporary entitlement exceptions requested for this app are not appropriate and will not be granted:

com.apple.security.temporary-exception.sbpl - (allow mach-lookup (global-name-regex #“^org.chromium.Chromium.rohitfork.[0-9]+$”))

We understand this may prevent the app from being approved for the Mac App Store. We encourage you to investigate other ways of implementing the desired functionality.

@tyv I suspect a lot of people are getting caught up here: https://github.com/electron-userland/electron-osx-sign/blob/master/index.js#L155, which seems to require them to half fill-out their PList file. electron-osx-sign should just have a --mas option that does everything

@sethlu - looks like one of the node modules that’s a required dependency is being ignored by electron-packager, the regex that used to work --ignore=.+\.o$ is now including anything that ends with o, rather than .o, which caused an uncaught javascript error (really need to look into how to handling those properly 😃 ) . changing it up to --ignore=.+\\.o$ fixed that, and it now works! 🎉

So now I guess the question is, from here, what do I need to change up to be able to submit it to the app store? I’m guessing I don’t include the provisionprofile?

Thanks for all your help!

@jpittner The app should be launched correctly I think… May you try adding the following into your main.js, or equivalent, script someplace after the window’s created, just to confirm some web page is shown?

mainWindow.webContents.openDevTools()

If the dev tools shows, the loaded page should be found somewhere in the panels. Otherwise we may have to think about some other resolutions to this issue.

@sethlu just a white screen, no spinning cursor. In fact can access the App menu (which just has Quit) and can quit.