apache / apache/cordova-electron

Adding `com.apple.security.network.client` to signed MAS build entitlements breaks Electron

Open
#192 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
135
Forks
60
Avg merge
1d 6h
Merged PRs (30d)
5

Description

# Bug Report

## Problem

### What is expected to happen?

Electron runs the app as usual.

### What does actually happen?

Blank screen.

## Information

The app builds and works as expected without the `com.apple.security.network.client` entitlement:
```xml

com.apple.security.app-sandbox

com.apple.security.inherit

com.apple.security.cs.allow-jit

com.apple.security.cs.allow-unsigned-executable-memory

com.apple.security.cs.disable-library-validation

com.apple.security.cs.disable-executable-page-protection

```

But of course there is no network access, so when adding this:
```xml
com.apple.security.network.client

```

It breaks the app, just a blank screen. The logs are unhelpful from what I can see.

I've searched and tried everything I could possibly think of over the past week before making this issue. Many different configurations, provision profiles, cordova/electron versions, etc. Many days going in circles.

### Command or Code

`cordova build electron --release` (also `--debug`) on Mac for the Mac App Store.

I've tried many different `build.json` configs, but it currently looks like this:
```json
{
"electron": {
"mac": {
"package": [
"mas"
],
"signing": {
"release": {
"entitlements": "Entitlements.plist",
"entitlementsInherit": "EntitlementsInherit.plist",
"provisioningProfile": "embedded.provisionprofile",
"hardenedRuntime": false,
"gatekeeperAssess": false,
"asarUnpack": []
}
}
}
}
}
```

### Environment, Platform, Device

Mac OSX

### Version information

Relevant lines from package.json:
```json
{
"devDependencies": {
"cordova-android": "^9.0.0",
"cordova-electron": "git+https://github.com/apache/cordova-electron.git",
"cordova-ios": "^6.2.0",
"cordova-plugin-background-mode": "^0.7.3",
"cordova-plugin-badge": "^0.8.8",
"cordova-plugin-device": "^2.0.3",
"cordova-plugin-inappbrowser": "^5.0.0",
"cordova-plugin-local-notification": "^0.9.0-beta.2",
"cordova-plugin-network-information": "^2.0.2",
"cordova-plugin-purchase": "^10.5.3",
"cordova-plugin-whitelist": "^1.3.4"
}
}
```

I only just recently tried `cordova-electron` version via GitHub, was previously using v2 from NPM.

I'm on macOS Big Sur 11.2.3 if it makes any difference.

## Checklist

- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

Contributor guide

Open the contributing guide

Research direction

Start by reproducing `cordova build electron --release` on macOS with the supplied `build.json`, `Entitlements.plist`, and `EntitlementsInherit.plist`, comparing builds with and without `com.apple.security.network.client`. Inspect how the Electron MAS package applies these entitlement files; done means the signed MAS build launches normally with the required entitlement and no blank screen.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, javascript, macos
Domain
build-system, desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.