Error trying to use Sandbox with codeign command

Question

I am trying to use Sandbox for my OS X using the codesign (this is a normal lisp application and does not use Xcode). I created a very simple set of rights that looks like this:

 <?xml version="1.0" encoding="utf-8"?> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> </dict> </plist> 

and I call the codesign command:

 codesign -s - -f --entitlements "/path/to/my/app/MyApp.app/Contents/entitlements.plist" "/path/to/my/app/MyApp.app/" 

But this command returns the following error:

 /path/to/my/app/MyApp.app/Contents/entitlements.plist: cannot read entitlement data 

Does this error mean that I used the wrong command? If so, what is wrong with the team?

Answer 1

The generated Xcode plist is a binary format and looks like this, as a rule, for the standard standard sandbox setting:

 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.ubiquity-container-identifiers</key> <array> <string>$(TeamIdentifierPrefix)com.company.appanme</string> </array> <key>com.apple.developer.ubiquity-kvstore-identifier</key> <string>$(TeamIdentifierPrefix)com.company.appname</string> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.assets.movies.read-only</key> <true/> <key>com.apple.security.assets.music.read-only</key> <true/> <key>com.apple.security.assets.pictures.read-only</key> <true/> <key>com.apple.security.files.user-selected.read-write</key> <true/> <key>com.apple.security.network.client</key> <true/> <key>com.apple.security.print</key> <true/> <key>com.apple.security.files.bookmarks.document-scope</key> <true/> </dict> </plist> 

All I can offer is to use Xcode to create a plist and delete those keys that you do not need manually. In your case ...

 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.files.user-selected.read-write</key> <true/> <key>com.apple.security.network.client</key> <true/> </dict> </plist> 

I'm just wondering if the !DOCTYPE element is required for some reason with a signature tool, and the encoding attribute should be in uppercase.

I also left a few keys that may be needed even if, as you say, this is a basic lisp application, in particular the com.apple.security.files.user-selected.read-write key, which will provide your process file.