Mac OSX App: AIR framework executables not includes "com.apple.security.app-sandbox"

[Santanu_Karar]

Hi.

We were recently trying to package our application with latest AIR SDK 22.0 and submit to iTunesConnect. We already has a version of the app in App Store which packaged with AIR SDK 16.0. Since 22.0 we came by following errors while uploading through Application Loader followed by no-upload at all.

1 package(s) were not uploaded because they had problems:
/var/folders/1b/8qtyjnc154jfq_5bysrxcht40000gv/T/55EA97A7-5A0A-4540-A715-C0B46D63044F/1099109346.itmsp - Error Messages:
ERROR ITMS-90296: "App sandbox not enabled. The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list: [( "com.moonshine-ide.pkg/Payload/Moonshine.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR_64 Helper", "com.moonshine-ide.pkg/Payload/Moonshine.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/ExtendedAppEntryTemplate64" )] Refer to App Sandbox page at https://developer.apple.com/devcenter/mac/app-sandbox/ for more information on sandboxing your app."

We are signing requisite assets to our PKG file in a fashioned manner prior to upload. These includes following signing (so we at least clear that the above error not causing by any non-signing assets at our side):

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Resources/Flash\ Player.plugin/Contents/MacOS/FlashPlayer-10.6

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Adobe\ AIR_64\ Helper

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Adobe\ AIR_64

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Adobe\ AIR

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Resources/Adobe\ AIR.vch

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0/Resources/ExtendedAppEntryTemplate64

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework/Versions/1.0

- ${desktopBinaryFilename}/Contents/Frameworks/Adobe\ AIR.framework

While working on this error I came by one of the forum link here: Air Apps for OSX: Terminal Script is not working anymore -> code object is not signed at all

The above thread discussed about some of the things which are relevant to ours' error, too. In last reply from @dasessig where Apple told him exactly against the executable those thrown us errors:

...some of the issues you're seeing are because Adobe hasn't followed the rules in Nested Code. You should be working with Adobe on those issues at this point or at least bringing them to their attention.
The entitlements issues arise because Adobe AIR_64 Helper and ExtendedAppEntryTemplate64 are apparently executables, so they need to be sandboxed as well. Since sandboxing can affect code's behavior, you really need to talk to Adobe about this. We can't say whether just adding the entitlements will cause your app to break, nor can we offer support if it does.
This also applies to the Russian localization issue. OS X handles Russian just fine, but it sounds like something in the app didn't include a Russian localization. That goes back to how one would specify localizations in Flash.

I'm not clear if that was a suggestion to him by Apple but in our case it's simply an error and for which we are not able to upload our build to App Store for review.

Is there any workaround for the problem we're having, or Adobe already aware of this and working on a fix?

Please, suggest.

Regards.

[dasessig]

Hi,

no - Adobe did not fix this issue (as far as I know). The "workaround" I used in order to publish my macOS Apps on the Mac App Store  is -> that I went back to AIR 19.0.0.198 😉 and I used this Terminal Script:

cd /Users/essig/Desktop

cp MacProcess/Info.plist easy.app/Contents/Info.plist

cp MacProcess/Icon.icns easy.app/Contents/Resources/Icon.icns

chmod -R 777 easy.app

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" easy.app/Contents/Frameworks/Adobe\ AIR.framework/Versions/Current/Adobe\ AIR_64\ Helper

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" easy.app/Contents/Frameworks/Adobe\ AIR.framework/Versions/Current/Adobe\ AIR_64

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" easy.app/Contents/Frameworks/Adobe\ AIR.framework/Versions/Current/Adobe\ AIR

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" easy.app/Contents/MacOS/easy!

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" easy.app

codesign -f -v -s "3rd Party Mac Developer Application: Jan Essig" --entitlements MacProcess/entitlement.plist easy.app

codesign --display --entitlements - easy.app

productbuild --component easy.app /Applications easyInstaller.pkg --sign "3rd Party Mac Developer Installer: Jan Essig"

Yes - it was Apple suggestion to get in touch with Adobe but I didn't receive any reply/help etc. so far.

However - it works with AIR 19.0.0.198 🙂

Hope this will help a bit.

Best regards

Jan

[Guest]

Hi Jan,

We have spent weeks trying to get this working to no avail. We are building with FlashBuilder 4.6 but we have AIR 19 installed. Can you provide any additional information or suggestions on how your setup was, as well as anything else that could help?

[Vivek_Negi]

Hi,

Please work through the following workaround.

1) Delete both Adobe AIR_64 Helper and ExtendedAppEntryTemplate64.

2) Sign AIR.framework using command codesign -f -v -s "3rd Party Mac Developer Application: XXXXX (XXXXXXXXXX)" "Path to AIR.framework" ( Please note you need to sign both Adobe AIR and Adobe_64  before you could sign Adobe AIR.framework)

You need to sign whole app with Entitlement file so that app works in Sandbox mode. Create a Sandbox entitlement file by pasting following,

<?xml version="1.0" encoding="UTF-8"?>

<plist version="1.0">

<dict>

  <key>com.apple.security.app-sandbox</key>

<true/>

</dict>

</plist>

and save it as entitlement.plist.

Now sign the app with this entitlement.plist as:

codesign -f -s "3rd Party Mac Developer Application: XXXXX (XXXXXXXXXX)" --entitlements "path to entitlement.plist" "path to your app"

after this, create .pkg of your app and submit.

-Vivek