Using provision profile to access assessments triggers a keychain popup

Question

DreTaX_SY OP

Created 2w

Replies 2

Boosts 0

Participants 2

Hello!

I do know apple does not support electron, but I do not think this is an electron related issue, rather something I am doing wrong. I'd be curious to find out why the keychain login is happenning after my app has been signed with the bundleid, entitlements, and provision profile. Before using the provision profile I did not have this issue, but it is needed for assessments feature.

I'm trying to ship an Electron / macOS desktop app that must run inside Automatic Assessment Configuration. The build signs and notarizes successfully, and assessment mode itself starts on Apple-arm64 machines, but every single launch shows the system dialog that asks to allow access to the "login" keychain. The dialog appears on totally fresh user accounts, so it's not tied to anything I store there.

It has happened ever since I have added the provision profile to the electron builder to finally test assessment out.

entitlements.inherit.plist keys

<key>com.apple.security.cs.allow-jit</key> <true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/>

entitlements.plist keys:

<key>com.apple.security.cs.allow-jit</key> <true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/>
<key>com.apple.developer.automatic-assessment-configuration</key> <true/>

I'm honestly not sure whether the keychain is expected, but I have tried a lot of entitlement combinations to get rid of It. Electron builder is doing the signing, and we manually use the notary tool to notarize but probably irrelevant.

  mac: {
    notarize: false,
    target: 'dir',
    entitlements: 'buildResources/entitlements.mac.plist',
    provisioningProfile: 'buildResources/xyu.provisionprofile',
    entitlementsInherit: 'buildResources/entitlements.mac.inherit.plist',

Any lead is welcome!

Boost

Answer 1

DreTaX_SY OP

2w

Accepted Answer

Issue was that i used the same bundleid for electron builder that the provision profile had, instead of a different wildcard, like app.company.com

0

Answer 2

DTS Engineer OP

Apple

2w

I can’t speak to the third-party tooling side of this, but it looks like you’re building an app for the Mac. Keychain access on the Mac is complicated because there are two keychain implementations. TN3137 On Mac keychain APIs and implementations has the details.

What this means is that you access control is gated either by entitlements or your designated requirement (DR) depending on whether you’re working with the data protection keychain or the file-based keychain. And that makes it hard to comment on access control issues without information about which keychain you’re targeting.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0