Update error in sandbox application

[MortenBrekkeStensland]

We have tried to implement Sparkle for our Mac OS app, but we are stuck in an error where we get the error
Update error!
An error occurred while launching the installer. Please try again later.
This seems to happen after the new file is downloaded, but before it is extracted.

The console tells that it can be a problem with permissions, we get a "Sandbox denied authorizing" error. There are also other types of errors that has happened while testing. So for me it seems to be a problem with the code-signature, or security issues, but I am not sure.

We have tried to follow all the steps in the guides for sandboxed apps, but we are not making progress. Below is the Github-project we are using for testing.
https://github.com/MortenBrekkeStensland/Sparkle_test_app_public

Would anybody like to look at this project and tell us where we go wrong? Any help would be appreciated.

[zorgiepoo]

It would probably be easier for me to look at an uploaded app/binary than it is to wrestle through cocoa pods and building your project. But it's probably a sandbox configuration issue.

[MortenBrekkeStensland]

It would probably be easier for me to look at an uploaded app/binary than it is to wrestle through cocoa pods and building your project. But it's probably a sandbox configuration issue.

Sure, here is a link to a build version of the app.
https://www.dropbox.com/scl/fo/a0vcvle551sruxejsa89n/h?rlkey=4bkdh0tekrrmaes3g1uik06af&dl=0

Insructions: After downloading, installing and opening the app, go to the dropdown-menu in the taskbar and push "check for updates". The error-popup message should appear after downloading the new version.

[zorgiepoo]

<key>SUEnableInstallerLauncherService </key>

You have an extraneous space character at the end of the key name.

[MortenBrekkeStensland]

Thanks, I removed the space, and now it worked! This is great.

But I have another question:
Is notarizing the DMG file with the new update a required step for the update-process to work?

i have another app where we tried Sparkle and got a similar error, except here the update works in debug-mode, but not in release/after archiving.
Here we didn't have the extraneous space in the SUEEnableInstallerLauncherService command, I just checked. As far as I know, the only difference between this Sparkle test-app, which now works, and the other app, which still doesn't work, is that with the other app, Im not sure if we notarized the DMG file properly.

[zorgiepoo]

The error you got in the console ("If your application is sandboxed please follow steps at..") here should point to a sandbox configuration issue. If you are still getting that error then it likely still means you have some sandbox configuration issue.

If you are getting an actual signing verification error, which may be related to code signing your app, you will get a different error message logged out.

Notarizing the app should not be required if both apps use the same EdDSA keys. However if an app has a broken code signature Sparkle could reject it. You have to see what the error message is.

[MortenBrekkeStensland]

now we are getting this error:
Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for accessing={TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=25120, auid=501, euid=501, binary_path=/Users/mortenbrekkestensland/Library/Caches/com.presentationtools.CueTimer/org.sparkle-project.Sparkle/Launcher/E4ymhBSfm/Updater.app/Contents/MacOS/Updater}, requesting={TCCDProcess: identifier=com.apple.appleeventsd, pid=524, auid=55, euid=55, binary_path=/System/Library/CoreServices/appleeventsd},

[zorgiepoo]

That is a red herring and not logged out from your app or Sparkle

[MortenBrekkeStensland]

ok thanks. so i should look again in the console for other clues?

[zorgiepoo]

Yes

[MortenBrekkeStensland]

ok here is more errors:

(AppleMobileFileIntegrity)
Couldn't build index for org.sparkle-project.Sparkle.Updater: Not eligible for acceleration

Installer (livxps.dylib)
[0x117604080] invalidated after getting a no-senders notification - client is gone

Updater (libxps.dylib)
[0x600000e5c1e0] invalidated after the last release of the connection object

runningoardd (RunningBoard)
com.presentationtools.CueTimer-sparkle-progress: RunningBoard doesn't recognize submitted process - treating as a anonymous process

Updater (libxps.dylib)
[0x147104080] activating connection: mach=false listener=true peer=false name=(anonymous)

Updater (libxps.dylib)
[0x135e04530] activating connection: mach=false listener=false peer=true name=com.apple.xpc.anonymous.0x147104080.peer.0x135e04530

Updater (libMobileGestalt.dylib)
No persisted cache on this platform.

Updater (libxps.dylib)
[0x135e35750] activating connection: mach=true listener=false peer=false name=com.apple.windowmanager.server

[zorgiepoo]

Filter by your process and look at logs coming from your app not the system…don’t look at random errors.

[zorgiepoo]

error​14:54:18.717869+0100​CueTimer​Error: An error occurred while running the updater. Please try again later. The remote port connection was invalidated from the updater. For additional details, please check Console logs for Autoupdate. If your application is sandboxed, please also ensure Installer Connection & Status entitlements are correctly set up: https://sparkle-project.org/documentation/sandboxing/ (URL (null))

[MortenBrekkeStensland]

Thanks, I think the error-message sums up what happens: for some reason the update-process stops before the new file is extracted.

Also, I forgot to say that the update works when we are in debug-mode in Xcode, but the error comes in release mode, or when archiving. Below are logs from the console that I thought could be relevant, after filtering the console with "process" and the app-name.

[C14 6B7DC69F-0ACD-45A7-9715-8D64A18C534B Hostname#130bf3bb:443 tcp, url hash: b74e0fc8, tls, definite, attribution: developer] cancel

User
Continued:
[C14 6B7DC69F-0ACD-45A7-9715-8D64A18C534B Hostname#130bf3bb:443 tcp, url hash: b74e0fc8, tls, definite, attribution: developer] cancelled
[C14.1.1 D8EC3C26-FF1F-4554-A5F2-807090D3D1DC 192.168.1.102:58394<->IPv4#c1821521:443]
Connected Path: satisfied (Path is satisfied), viable, interface: en0[802.11], ipv4, dns, uses wifi
Privacy Stance: Not Eligible
Duration: 0.181s, DNS @0.000s took 0.002s, TCP @0.002s took 0.031s, TLS 1.3 took 0.080s
bytes in/out: 7050/1273, packets in/out: 5/13, rtt: 0.035s, retransmitted bytes: 0, out-of-order bytes: 0
ecn packets sent/acked/marked/lost: 0/0/0/0

User

nw_protocol_tcp_log_summary [C14.1.1:3]
[567F7DA5-1F5F-4040-9DA1-686BC142484F :58394<->:443]
Init: 1, Conn_Time: 30.762ms, SYNs: 1, WR_T: 0/0, RD_T: 0/0, TFO: 0/0/0, ECN: 0/0/0, Accurate ECN (client/server): Disabled/Disabled, TS: 1, TSO: 1
rtt_cache: process, rtt_upd: 5, rtt: 35.812ms, rtt_var: 8.812ms rtt_nc: 31.406ms, rtt_var_nc: 6.000ms base rtt: 27ms
ACKs-compressed: 0, ACKs delayed: 0 delayed ACKs sent: 0

nw_flow_disconnected [C14 IPv4#c1821521:443 cancelled parent-flow ((null))] Output protocol disconnected

nw_connection_report_state_with_handler_on_nw_queue [C14] reporting state cancelled

Connection 14: done

[0x13b640ad0] failed to do a bootstrap look-up: xpc_error=[159: Unknown error: 159]

User
Timeout: Installer never started archive extraction

Error: An error occurred while running the updater. Please try again later. The remote port connection was invalidated from the updater. For additional details, please check Console logs for Autoupdate. If your application is sandboxed, please also ensure Installer Connection & Status entitlements are correctly set up: https://sparkle-project.org/documentation/sandboxing/ (URL (null))

[zorgiepoo]

It most likely means your broken release build does not have the Installer Connection & Status entitlements (the ones under "Communication") correctly applied like the error message says. For any wrongly produced build you can verify the entitlements on your produced app binary via something like

codesign -d --entitlements :- /Applications/MyApp.app/Contents/MacOS/MyApp

..and see if the entitlements exist there. If not, this is most likely something broken in your release process. As the documentation states:

Due to different code signing requirements, please do not add --deep to OTHER_CODE_SIGN_FLAGS or from custom build scripts when signing your application. This is a common source of Sandboxing errors.

See #2172 as a failure example.

If it works after upgrading your project format to Xcode 14, maybe the entitlements are then properly being implied (Xcode 9 sounds pretty old). But I can assure you the failure is not "random" or unexplainable.

[MortenBrekkeStensland]

Suddenly it started working: after I changed project format to Xcode 14, it was on Xcode 9. I will do more testing to confirm.

[MortenBrekkeStensland]

We found the solution: In the build-settings of the main target, the "entitlements" section pointed to a non-existing location for "release", but correct for "debug". Thats why the update-prosess worked in Debug but not for Release.

Thanks so much for Zorgiepoo for helping with this, and for discovering that it could something wrong with entitlements in our project.