Bundled app error with Electron app on Mac App Store

Question

benzima OP

Created 2w

Replies 4

Boosts 0

Participants 2

Hi,

I built an Electron app that uses puppeteer-cluster to open a bundled version of Chrome. Everything works before packaging/signing with electron builder. Transporter does not report any issues and the app opens in TestFlight.

the Chrome.app is signed separately before running builder
hardenedRuntime = false

However, a permission error occurs when cluster attempts to launch Chrome:

Error: Unable to launch browser, error message: Failed to launch the browser process! [0601/152740.225314:ERROR:bootstrap.cc(65)] bootstrap_check_in org.chromium.crashpad.child_port_handshake.9915.63117.BUEXLMXFWPLCEONM: Permission denied (1100) [0601/152740.226091:ERROR:file_io.cc(94)] ReadExactly: expected 4, observed 0 [0601/152740.229808:ERROR:bootstrap.cc(65)] bootstrap_check_in org.chromium.crashpad.child_port_handshake.9913.63115.VVKELOQUCWUYPFMQ: Permission denied (1100) [0601/152740.230244:ERROR:file_io.cc(94)] ReadExactly: expected 4, observed 0 [9911:45571:0601/152740.506968:ERROR:named_platform_channel_mac.cc(44)] bootstrap_check_in com.google.chrome.for.testing.apps.52995c87946bbcc94fc9a27df1478a13: Permission denied (1100) [9911:62467:0601/152740.507564:FATAL:mach_port_rendezvous.cc(281)] Check failed: kr == KERN_SUCCESS. bootstrap_check_in com.google.chrome.for.testing.MachPortRendezvousServer.9911: Permission denied (1100)

at Cluster.<anonymous> (/Applications/MyApp.app/Contents/Resources/app.asar/node_modules/puppeteer-cluster/dist/Cluster.js:119:23)
at Generator.throw (<anonymous>)
at rejected (/Applications/MyApp.app/Contents/Resources/app.asar/node_modules/puppeteer-cluster/dist/Cluster.js:6:65)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

I'm wondering if it's an issue with entitlements, or something more.
The entitlements.mas.plist (aside from identifiers):

<key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.cs.allow-jit</key> <true/> <key>com.apple.security.cs.allow-unsigned-executable-memory<key> <true/> <key>com.apple.security.cs.allow-dyld-environment-variables</key> <true/> <key>com.apple.security.network.client</key> <true/> <key>com.apple.security.network.server</key> <true/> <key>com.apple.security.files.user-selected.read-write</key> <true/> <key>com.apple.security.cs.disable-executable-page-protection<key> <true/> <key>com.apple.security.files.user-selected.executable</key> <true/>

I've spent many hours searching for a solution. Any help or insight would be greatly appreciated.

Answered by DTS Engineer in 841505022

Unfortunately I don’t have an easy answer for you here. This error is coming from deep within the third-party code that you’re using. There are two ways you can approach that:

Debug it yourself.
Escalate it via the support channel for that code.

Either way, I have some hints below. Even if you don’t try to debug this yourself, these hints might be good search engine fodder.

If I had to guess, I’d say that the code is using Mach messaging and it’s failing when you sandbox the app. The App Sandbox limits your app’s usage of Mach messaging. While you’re able to access many system services, any custom service name must be a ‘child’ of an app group. The App Groups Entitlement docs explain that.

Note I have a lot more info about app groups in App Groups: macOS vs iOS: Working Towards Harmony.

A good diagnostic here is to create a Development-signed but sandboxed version of your app. If that fails in this way, but the Development-signed unsandboxed version works, that’s strong evidence that sandboxing is the issue.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

2w

Recommended

Unfortunately I don’t have an easy answer for you here. This error is coming from deep within the third-party code that you’re using. There are two ways you can approach that:

Debug it yourself.
Escalate it via the support channel for that code.

Either way, I have some hints below. Even if you don’t try to debug this yourself, these hints might be good search engine fodder.

If I had to guess, I’d say that the code is using Mach messaging and it’s failing when you sandbox the app. The App Sandbox limits your app’s usage of Mach messaging. While you’re able to access many system services, any custom service name must be a ‘child’ of an app group. The App Groups Entitlement docs explain that.

Note I have a lot more info about app groups in App Groups: macOS vs iOS: Working Towards Harmony.

A good diagnostic here is to create a Development-signed but sandboxed version of your app. If that fails in this way, but the Development-signed unsandboxed version works, that’s strong evidence that sandboxing is the issue.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

benzima OP

2w

It's a sandbox issue 100%. I think you're correct about the app group entitlement causing the issue here - thanks for the lead.

The Info.plist needs to include the com.apple.security.application-groups key for both apps from what I understand.

Electron builder does have a property for adding keys to that plist (https://www.electron.build/mas#extendinfo) so that's my next adventure.

0

Answer 3

DTS Engineer OP

Apple

2w

The Info.plist needs to include the com.apple.security.application-groups key …

Ah, um, no. com.apple.security.application-groups is a code signing entitlement, not an Info.plist key. You’ll need to research how to set entitlements with your tooling.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

benzima OP

1w

com.apple.security.application-groups is a code signing entitlement, not an Info.plist key

I was confused when I read something suggesting it needed to be included in each Info.plist.

My entitlements.mas.plist already includes this key with the proper value and format. That should be the extent of what is needed for group permissions from what I can find.

After more research, I'm suspecting the permission issue might be a broader issue with Electron itself.

There were permission errors when initially installing that package and I'm wondering if something wasn't resolved there.

I also discovered the TestFlight version was somehow launching from the project's root and not the sandboxed Applications folder at one point ('fixed' by running under another user account).

Planning to try a full reinstall.

0