Updater fails with "Sandbox: deny mach-lookup <Identifier>-spki/spks" #2290

ktraunmueller · 2022-11-28T20:59:22Z

ktraunmueller
Nov 28, 2022

Description of the problem

After upgrading to Sparkle 2.3 and macOS Ventura, the Sparkle Updater for my app (which previously worked) now fails with

Error: An error occurred while running the updater. Please try again later. The remote port connection was invalidated from the updater.

followed by

Sandbox: Compositor(81909) deny(1) mach-lookup com.microlarge.Compositor-spki
Sandbox: Compositor(81909) deny(1) mach-lookup com.microlarge.Compositor-spks

after downloading an update for my app (more detailed output see below).

I have read (and re-read) all the documentation on upgrading from older versions of Sparkle and sandboxing, and I can't figure out what the problem is here.

Do you use Sandboxing in your app?

Yes. I don't use Xcode's Archive & Export, though. I have a custom scripted build system that roughly performs the following steps:

xcodebuild workspace
re-sign Sparkle
check app for Gatekeeper conformance
create and code-sign disk image
notarize & staple the disk image
create Sparkle update zip, generate Sparkle signature with sign_update, and generate Sparkle appcast item

The Sparkle re-signing in my build script looks like this:

# https://sparkle-project.org/documentation/sandboxing/
echo ">> Re-signing Sparkle for distribution..."
codesign -f -s "$CODE_SIGNING_IDENTITY" -o runtime "${PRODUCT_BUNDLE}/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Installer.xpc"
codesign -f -s "$CODE_SIGNING_IDENTITY" -o runtime "${PRODUCT_BUNDLE}/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
codesign -f -s "$CODE_SIGNING_IDENTITY" -o runtime "${PRODUCT_BUNDLE}/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"
codesign -f -s "$CODE_SIGNING_IDENTITY" -o runtime "${PRODUCT_BUNDLE}/Contents/Frameworks/Sparkle.framework"
echo ">> Code-signing app bundle..."
codesign -f -s "$CODE_SIGNING_IDENTITY" -o runtime --entitlements "SupportingFiles/Compositor.entitlements" "${PRODUCT_BUNDLE}"

Version of `Sparkle.framework` in the latest version of your app

2.30.0

Version of `Sparkle.framework` in the old version of app that your users have (or N/A)

2.30.0

Sparkle's output from Console.app

error	21:29:18.812450+0100	sandboxd	Sandbox: Compositor(81909) deny(1) mach-lookup com.microlarge.Compositor-spki
Violation:       deny(1) mach-lookup com.microlarge.Compositor-spki
Process:         Compositor [81909]
Path:            /Applications/Compositor.app/Contents/MacOS/Compositor
Load Address:    0x104e7c000
Identifier:      com.microlarge.Compositor
Version:         1.20.6 (1.20.6)
Code Type:       arm64 (Native)
Parent Process:  Compositor [1]
Responsible:     /Applications/Compositor.app/Contents/MacOS/Compositor
User ID:         502

Date/Time:       2022-11-28 21:29:18.776 GMT+1
OS Version:      macOS 13.0.1 (22A400)
Release Type:    User
Report Version:  8

MetaData: {"hardware":"J316s","process":"Compositor","responsible-process-signing-id":"com.microlarge.Compositor","primary-filter-value":"com.microlarge.Compositor-spki","errno":1,"platform-policy":false,"binary-in-trust-cache":false,"platform-binary":false,"profile-flags":0,"container":"\/Users\/karl\/Library\/Containers\/com.microlarge.Compositor\/Data","pid":81909,"mach_namespace":1,"policy-description":"Sandbox","checker":"launchd","build":"macOS 13.0.1 (22A400)","operation":"mach-lookup","platform_binary":"no","normalized_target":["com.microlarge.Compositor-spki"],"global-name":"com.microlarge.Compositor-spki","process_path":["Applications","Compositor.app","Contents","MacOS","Compositor"],"target":"com.microlarge.Compositor-spki","profile-in-collection":false,"signing-id":"com.microlarge.Compositor","responsible-process-team-id":"JJ7PAGDU5C","responsible-process-path":"\/Applications\/Compositor.app\/Contents\/MacOS\/Compositor","action":"deny","primary-filter":"global-name","summary":"deny(1) mach-lookup com.microlarge.Compositor-spki","uid":502,"process-path":"\/Applications\/Compositor.app\/Contents\/MacOS\/Compositor","flags":3221225477,"apple-internal":false,"checker-pid":1,"team-id":"JJ7PAGDU5C","sandbox_checker":"launchd","release-type":"User"}

Thread 0 (id: 9666894):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   libxpc.dylib                  	0x00000001a49aec80 _xpc_pipe_mach_msg + 56
4   libxpc.dylib                  	0x00000001a49ae4fc _xpc_pipe_routine + 356
5   libxpc.dylib                  	0x00000001a4987e40 _xpc_interface_routine + 208
6   libxpc.dylib                  	0x00000001a498d87c _xpc_look_up_endpoint + 268
7   libxpc.dylib                  	0x00000001a498d704 _xpc_connection_bootstrap_look_up_slow + 396
8   libxpc.dylib                  	0x00000001a498d034 _xpc_connection_init + 1004
9   libxpc.dylib                  	0x00000001a498cbd4 _xpc_connection_activate_if_needed + 296
10  libxpc.dylib                  	0x00000001a498f4a0 xpc_connection_resume + 92
11  Sparkle                       	0x0000000105a745ac -[SUInstallerConnection _setServiceName:systemDomain:] + 560 (SUInstallerConnection.m:109)
12  Sparkle                       	0x0000000105a748a0 -[SUInstallerConnection setServiceName:systemDomain:] + 176 (SUInstallerConnection.m:121)
13  Sparkle                       	0x0000000105a53a64 -[SPUInstallerDriver setUpConnection] + 556 (SPUInstallerDriver.m:197)
14  Sparkle                       	0x0000000105a55abc __58-[SPUInstallerDriver launchAutoUpdateSilently:completion:]_block_invoke_2.211 + 152 (SPUInstallerDriver.m:470)
15  libdispatch.dylib             	0x00000001a4a999dc _dispatch_call_block_and_release + 32
16  libdispatch.dylib             	0x00000001a4a9b504 _dispatch_client_callout + 20
17  libdispatch.dylib             	0x00000001a4aa9d1c _dispatch_main_queue_drain + 928
18  libdispatch.dylib             	0x00000001a4aa996c _dispatch_main_queue_callback_4CF + 44
19  CoreFoundation                	0x00000001a4d42d6c __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
20  CoreFoundation                	0x00000001a4d007ec __CFRunLoopRun + 2036
21  CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
22  HIToolbox                     	0x00000001ae3733bc RunCurrentEventLoopInMode + 292
23  HIToolbox                     	0x00000001ae373200 ReceiveNextEventCommon + 672
24  HIToolbox                     	0x00000001ae372f48 _BlockUntilNextEventMatchingListInModeWithFilter + 72
25  AppKit                        	0x00000001a7f58630 _DPSNextEvent + 632
26  AppKit                        	0x00000001a7f577c0 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 728
27  AppKit                        	0x00000001a7f4bbf0 -[NSApplication run] + 464
28  AppKit                        	0x00000001a7f23058 NSApplicationMain + 880
29  Compositor                    	0x0000000104ee2324 main + 12
30  dyld                          	0x00000001a48f7e50 start + 2544

Thread 1 (id: 9667051):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   Compositor                    	0x00000001051ad3bc exception_server_thread + 188
4   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
5   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 2 (id: 9667062, com.apple.NSEventThread):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   CoreFoundation                	0x00000001a4d01bdc __CFRunLoopServiceMachPort + 160
4   CoreFoundation                	0x00000001a4d004c8 __CFRunLoopRun + 1232
5   CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
6   AppKit                        	0x00000001a8082248 _NSEventThread + 172
7   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
8   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 3 (id: 9667181, com.apple.NSURLConnectionLoader):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   CoreFoundation                	0x00000001a4d01bdc __CFRunLoopServiceMachPort + 160
4   CoreFoundation                	0x00000001a4d004c8 __CFRunLoopRun + 1232
5   CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
6   CFNetwork                     	0x00000001a96c8bac
7   Foundation                    	0x00000001a5c01470 __NSThread__start__ + 716
8   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
9   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 4 (id: 9667204, com.apple.coreanimation.render-server):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   QuartzCore                    	0x00000001ac389654 CA::Render::Server::server_thread(void*) + 564
4   QuartzCore                    	0x00000001ac389410 thread_fun(void*) + 32
5   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
6   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 5 (id: 9667903):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 6 (id: 9667954):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 7 (id: 9668538):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 8 (id: 9668555, JavaScriptCore libpas scavenger):
0   libsystem_kernel.dylib        	0x00000001a4be65e4 __psynch_cvwait + 8
1   JavaScriptCore                	0x00000001bde8917c scavenger_thread_main + 1364
2   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
3   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 9 (id: 9668556):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 10 (id: 9668557):

Binary Images:
       0x104e7c000 -        0x104e80f87  com.microlarge.Compositor (1.20.6 - 1.20.6) <c57a588d-d6db-304b-b06a-7606c51ce03d> /Applications/Compositor.app/Contents/MacOS/Compositor
       0x105a44000 -        0x105a4835b  org.sparkle-project.Sparkle (2.3.0 - 2021) <baa801db-601e-35f9-bc9e-e91214ae7edb> /Applications/Compositor.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle
       0x1a48f2000 -        0x1a48f2fff  com.apple.darwin.ignition (1.0.0 - 46.41.2) <de46dd52-4994-3fd8-b4b4-e352a1a19354> /usr/lib/dyld
       0x1a4982000 -        0x1a498329b  libxpc.dylib <44992a1e-d222-3d40-841d-e2cf9e26f67e> /usr/lib/system/libxpc.dylib
       0x1a4a97000 -        0x1a4a98fd3  libdispatch.dylib <40c9c98c-00d6-3e8e-9ad3-2ed6cf0d0cfe> /usr/lib/system/libdispatch.dylib
       0x1a4be2000 -        0x1a4be297f  libsystem_kernel.dylib <6d6644d3-3db3-34c4-b1e3-c675ec5360f0> /usr/lib/system/libsystem_kernel.dylib
       0x1a4c1b000 -        0x1a4c1bae3  libsystem_pthread.dylib <886caca0-5762-3640-8db2-3fa3b911c062> /usr/lib/system/libsystem_pthread.dylib
       0x1a4c80000 -        0x1a4c818ef  com.apple.CoreFoundation (6.9 - 1953.1) <f4ff83fc-e62c-30b4-b3a9-876c8a1fd595> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
       0x1a5bab000 -        0x1a5bad20f  com.apple.Foundation (6.9 - 1953.1) <52b2f83f-586d-32a2-8b66-ce651400ac8c> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
       0x1a7f1f000 -        0x1a7f223cb  com.apple.AppKit (6.9 - 2299) <af9f6891-70ad-3c26-af08-b747344892d2> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
       0x1a9477000 -        0x1a94789bb  com.apple.CFNetwork (1399.4 - 1399.4) <86c036e0-4a25-3600-a5b5-31b1caedbe4a> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
       0x1ac342000 -        0x1ac3446d7  com.apple.QuartzCore (1.11 - 1042.20) <6eae8b05-2af0-3057-91fc-cf2d9c74dd40> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
       0x1ae341000 -        0x1ae344b0f  com.apple.HIToolbox (2.1.1) <02b9797f-c47d-30b7-b7b0-802d0d26f31c> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
       0x1bdc43000 -        0x1bdc441df  com.apple.JavaScriptCore (18614 - 18614.2.9.1.12) <be3862d6-2576-3f55-9334-fb997db344d0> /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore
default	21:29:19.006912+0100	tccd	AUTHREQ_ATTRIBUTION: msgID=163.2846, attribution={accessing={TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=81957, auid=502, euid=502, binary_path=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/MacOS/Updater}, requesting={TCCDProcess: identifier=com.apple.syspolicyd, pid=163, auid=0, euid=0, binary_path=/usr/libexec/syspolicyd}, },
default	21:29:19.023994+0100	lsd	Non-fatal error enumerating at <private>, continuing: Error Domain=NSCocoaErrorDomain Code=260 "The file “PlugIns” couldn’t be opened because there is no such file." UserInfo={NSURL=PlugIns/ -- file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/, NSFilePath=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/PlugIns, NSUnderlyingError=0x12105b3a0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}
default	21:29:19.024521+0100	lsd	Non-fatal error enumerating at <private>, continuing: Error Domain=NSCocoaErrorDomain Code=260 "The file “Extensions” couldn’t be opened because there is no such file." UserInfo={NSURL=Extensions/ -- file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/, NSFilePath=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/Extensions, NSUnderlyingError=0x121006530 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}
default	21:29:19.025118+0100	lsd	- 45683955: Checking whether application is managed at file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app//org.sparkle-project.Sparkle.Updater
default	21:29:19.043869+0100	tccd	-[TCCDAccessIdentity staticCode]: static code for: identifier org.sparkle-project.Sparkle.Updater, type: 0: 0x124487be0 at /Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app
default	21:29:19.079372+0100	tccd	AUTHREQ_ATTRIBUTION: msgID=81957.1, attribution={requesting={TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=81957, auid=502, euid=502, binary_path=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/MacOS/Updater}, },
default	21:29:19.083503+0100	tccd	-[TCCDAccessIdentity staticCode]: static code for: identifier org.sparkle-project.Sparkle.Updater, type: 0: 0x1241c62d0 at /Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app
default	21:29:19.092572+0100	tccd	AUTHREQ_ATTRIBUTION: msgID=164.12312, attribution={accessing={TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=81957, auid=502, euid=502, binary_path=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/MacOS/Updater}, requesting={TCCDProcess: identifier=com.apple.WindowServer, pid=164, auid=88, euid=88, binary_path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer}, },
default	21:29:19.092648+0100	tccd	requestor: TCCDProcess: identifier=com.apple.WindowServer, pid=164, auid=88, euid=88, binary_path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer is checking access for accessor TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=81957, auid=502, euid=502, binary_path=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/MacOS/Updater
default	21:29:19.099353+0100	tccd	-[TCCDAccessIdentity staticCode]: static code for: identifier org.sparkle-project.Sparkle.Updater, type: 0: 0x1242e5310 at /Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app
default	21:29:19.112257+0100	Updater	Received configuration update from daemon (initial)
default	21:29:19.112464+0100	Updater	CHECKIN: pid=81957
default	21:29:19.119486+0100	Updater	CHECKEDIN: pid=81957 asn=0x0-0x14ec4eb foreground=0
default	21:29:19.119627+0100	runningboardd	com.microlarge.Compositor-sparkle-progress: RunningBoard doesn't recognize submitted process - treating as a anonymous process
default	21:29:19.121768+0100	Updater	FRONTLOGGING: version 1
default	21:29:19.121778+0100	Updater	Registered, pid=81957 ASN=0x0,0x14ec4eb
default	21:29:19.124150+0100	Updater	BringForward: pid=81957 asn=0x0-0x14ec4eb bringForward=0 foreground=0 uiElement=1 launchedByLS=0 modifiersCount=0 allDisabled=0
default	21:29:19.127502+0100	Updater	Current system appearance, (HLTB: 1), (SLS: 0)
default	21:29:19.130209+0100	Updater	No persisted cache on this platform.
default	21:29:19.131880+0100	Updater	Current system appearance, (HLTB: 1), (SLS: 0)
default	21:29:19.132344+0100	Updater	Post-registration system appearance: (HLTB: 1)
default	21:29:19.143467+0100	lsd	Non-fatal error enumerating at <private>, continuing: Error Domain=NSCocoaErrorDomain Code=260 "The file “PlugIns” couldn’t be opened because there is no such file." UserInfo={NSURL=PlugIns/ -- file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/, NSFilePath=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/PlugIns, NSUnderlyingError=0x15d311ec0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}
default	21:29:19.144097+0100	lsd	Non-fatal error enumerating at <private>, continuing: Error Domain=NSCocoaErrorDomain Code=260 "The file “Extensions” couldn’t be opened because there is no such file." UserInfo={NSURL=Extensions/ -- file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/, NSFilePath=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/Extensions, NSUnderlyingError=0x15d606110 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}
default	21:29:19.144373+0100	lsd	- 45683955: Checking whether application is managed at file:///Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app//org.sparkle-project.Sparkle.Updater
default	21:29:19.183865+0100	Updater	Registering for test daemon availability notify post.
default	21:29:19.183969+0100	Updater	notify_get_state check indicated test daemon not ready.
default	21:29:19.184067+0100	Updater	notify_get_state check indicated test daemon not ready.
default	21:29:19.184169+0100	Updater	notify_get_state check indicated test daemon not ready.
default	21:29:19.186541+0100	Updater	SignalReady: pid=81957 asn=0x0-0x14ec4eb
default	21:29:19.186731+0100	Updater	SIGNAL: pid=81957 asn=0x0x-0x14ec4eb
default	21:29:19.197016+0100	tccd	-[TCCDAccessIdentity staticCode]: static code for: identifier org.sparkle-project.Sparkle.Updater, type: 0: 0x122fb5a20 at /Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app
error	21:29:19.212130+0100	tccd	Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for accessing={TCCDProcess: identifier=org.sparkle-project.Sparkle.Updater, pid=81957, auid=502, euid=502, binary_path=/Users/karl/Library/Caches/com.microlarge.Compositor/org.sparkle-project.Sparkle/Launcher/0i5Jp84oG/Updater.app/Contents/MacOS/Updater}, requesting={TCCDProcess: identifier=com.apple.appleeventsd, pid=271, auid=55, euid=55, binary_path=/System/Library/CoreServices/appleeventsd},
default	21:29:20.204858+0100	Compositor	order window: 9c24 op: 0 relative: 0 related: 0
error	21:29:20.211066+0100	Compositor	Error: An error occurred while running the updater. Please try again later. The remote port connection was invalidated from the updater. For additional details, please check Console logs for Autoupdate. If your application is sandboxed, please also ensure Installer Connection & Status entitlements are correctly set up: https://sparkle-project.org/documentation/sandboxing/ (URL (null))
default	21:29:20.214086+0100	runningboardd	Invalidating assertion 172-164-747227 (target:[app<application.com.microlarge.Compositor.50954917.50955175(502)>:81909]) from originator [osservice<com.apple.WindowServer(88)>:164]
default	21:29:20.214410+0100	runningboardd	Invalidating assertion 172-164-747228 (target:[app<application.com.microlarge.Compositor.50954917.50955175(502)>:81909]) from originator [osservice<com.apple.WindowServer(88)>:164]
error	21:29:20.270869+0100	sandboxd	Sandbox: Compositor(81909) deny(1) mach-lookup com.microlarge.Compositor-spks
Violation:       deny(1) mach-lookup com.microlarge.Compositor-spks
Process:         Compositor [81909]
Path:            /Applications/Compositor.app/Contents/MacOS/Compositor
Load Address:    0x104e7c000
Identifier:      com.microlarge.Compositor
Version:         1.20.6 (1.20.6)
Code Type:       arm64 (Native)
Parent Process:  Compositor [1]
Responsible:     /Applications/Compositor.app/Contents/MacOS/Compositor
User ID:         502

Date/Time:       2022-11-28 21:29:20.217 GMT+1
OS Version:      macOS 13.0.1 (22A400)
Release Type:    User
Report Version:  8

MetaData: {"hardware":"J316s","process":"Compositor","responsible-process-signing-id":"com.microlarge.Compositor","primary-filter-value":"com.microlarge.Compositor-spks","errno":1,"platform-policy":false,"binary-in-trust-cache":false,"platform-binary":false,"profile-flags":0,"container":"\/Users\/karl\/Library\/Containers\/com.microlarge.Compositor\/Data","pid":81909,"mach_namespace":1,"policy-description":"Sandbox","checker":"launchd","build":"macOS 13.0.1 (22A400)","operation":"mach-lookup","platform_binary":"no","normalized_target":["com.microlarge.Compositor-spks"],"global-name":"com.microlarge.Compositor-spks","process_path":["Applications","Compositor.app","Contents","MacOS","Compositor"],"target":"com.microlarge.Compositor-spks","profile-in-collection":false,"signing-id":"com.microlarge.Compositor","responsible-process-team-id":"JJ7PAGDU5C","responsible-process-path":"\/Applications\/Compositor.app\/Contents\/MacOS\/Compositor","action":"deny","primary-filter":"global-name","summary":"deny(1) mach-lookup com.microlarge.Compositor-spks","uid":502,"process-path":"\/Applications\/Compositor.app\/Contents\/MacOS\/Compositor","flags":3221225477,"apple-internal":false,"checker-pid":1,"team-id":"JJ7PAGDU5C","sandbox_checker":"launchd","release-type":"User"}

Thread 0 (id: 9666894):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   libxpc.dylib                  	0x00000001a49aec80 _xpc_pipe_mach_msg + 56
4   libxpc.dylib                  	0x00000001a49ae4fc _xpc_pipe_routine + 356
5   libxpc.dylib                  	0x00000001a4987e40 _xpc_interface_routine + 208
6   libxpc.dylib                  	0x00000001a498d87c _xpc_look_up_endpoint + 268
7   libxpc.dylib                  	0x00000001a498d704 _xpc_connection_bootstrap_look_up_slow + 396
8   libxpc.dylib                  	0x00000001a498d034 _xpc_connection_init + 1004
9   libxpc.dylib                  	0x00000001a498cbd4 _xpc_connection_activate_if_needed + 296
10  libxpc.dylib                  	0x00000001a498f4a0 xpc_connection_resume + 92
11  Sparkle                       	0x0000000105a76e50 -[SUInstallerStatus _setServiceName:] + 428 (SUInstallerStatus.m:74)
12  Sparkle                       	0x0000000105a77138 -[SUInstallerStatus setServiceName:] + 164 (SUInstallerStatus.m:86)
13  Sparkle                       	0x0000000105a57638 +[SPUProbeInstallStatus probeInstallerUpdateItemForHostBundleIdentifier:completion:] + 296 (SPUProbeInstallStatus.m:120)
14  Sparkle                       	0x0000000105a6284c __72-[SPUUpdater scheduleNextUpdateCheckFiringImmediately:usingCurrentDate:]_block_invoke + 236 (SPUUpdater.m:486)
15  Sparkle                       	0x0000000105a626ac -[SPUUpdater scheduleNextUpdateCheckFiringImmediately:usingCurrentDate:] + 300 (SPUUpdater.m:533)
16  Sparkle                       	0x0000000105a64590 __72-[SPUUpdater checkForUpdatesWithDriver:updateCheck:installerInProgress:]_block_invoke.352 + 232 (SPUUpdater.m:766)
17  Sparkle                       	0x0000000105a4bcdc __86-[SPUBasicUpdateDriver abortUpdateAndShowNextUpdateImmediately:resumableUpdate:error:]_block_invoke + 100 (SPUBasicUpdateDriver.m:276)
18  libdispatch.dylib             	0x00000001a4a999dc _dispatch_call_block_and_release + 32
19  libdispatch.dylib             	0x00000001a4a9b504 _dispatch_client_callout + 20
20  libdispatch.dylib             	0x00000001a4aa9d1c _dispatch_main_queue_drain + 928
21  libdispatch.dylib             	0x00000001a4aa996c _dispatch_main_queue_callback_4CF + 44
22  CoreFoundation                	0x00000001a4d42d6c __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
23  CoreFoundation                	0x00000001a4d007ec __CFRunLoopRun + 2036
24  CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
25  HIToolbox                     	0x00000001ae3733bc RunCurrentEventLoopInMode + 292
26  HIToolbox                     	0x00000001ae373200 ReceiveNextEventCommon + 672
27  HIToolbox                     	0x00000001ae372f48 _BlockUntilNextEventMatchingListInModeWithFilter + 72
28  AppKit                        	0x00000001a7f58630 _DPSNextEvent + 632
29  AppKit                        	0x00000001a7f577c0 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 728
30  AppKit                        	0x00000001a7f4bbf0 -[NSApplication run] + 464
31  AppKit                        	0x00000001a7f23058 NSApplicationMain + 880
32  Compositor                    	0x0000000104ee2324 main + 12
33  dyld                          	0x00000001a48f7e50 start + 2544

Thread 1 (id: 9667051):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   Compositor                    	0x00000001051ad3bc exception_server_thread + 188
4   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
5   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 2 (id: 9667062, com.apple.NSEventThread):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   CoreFoundation                	0x00000001a4d01bdc __CFRunLoopServiceMachPort + 160
4   CoreFoundation                	0x00000001a4d004c8 __CFRunLoopRun + 1232
5   CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
6   AppKit                        	0x00000001a8082248 _NSEventThread + 172
7   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
8   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 3 (id: 9667181, com.apple.NSURLConnectionLoader):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   CoreFoundation                	0x00000001a4d01bdc __CFRunLoopServiceMachPort + 160
4   CoreFoundation                	0x00000001a4d004c8 __CFRunLoopRun + 1232
5   CoreFoundation                	0x00000001a4cff8a4 CFRunLoopRunSpecific + 612
6   CFNetwork                     	0x00000001a96c8bac
7   Foundation                    	0x00000001a5c01470 __NSThread__start__ + 716
8   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
9   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 4 (id: 9667204, com.apple.coreanimation.render-server):
0   libsystem_kernel.dylib        	0x00000001a4be2df0 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	0x00000001a4beb638 mach_msg_overwrite + 540
2   libsystem_kernel.dylib        	0x00000001a4be316c mach_msg + 24
3   QuartzCore                    	0x00000001ac389654 CA::Render::Server::server_thread(void*) + 564
4   QuartzCore                    	0x00000001ac389410 thread_fun(void*) + 32
5   libsystem_pthread.dylib       	0x00000001a4c2206c _pthread_start + 148
6   libsystem_pthread.dylib       	0x00000001a4c1ce2c thread_start + 8

Thread 5 (id: 9667903):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 6 (id: 9667954):
0   libsystem_kernel.dylib        	0x00000001a4be2d84 semaphore_timedwait_trap + 8
1   AppKit                        	0x00000001a88be95c __NSCGSTransactionAddPostDecodeAction_block_invoke_2 + 76
2   libdispatch.dylib             	0x00000001a4a999dc _dispatch_call_block_and_release + 32
3   libdispatch.dylib             	0x00000001a4a9b504 _dispatch_client_callout + 20
4   libdispatch.dylib             	0x00000001a4aa2bbc _dispatch_lane_serial_drain + 672
5   libdispatch.dylib             	0x00000001a4aa373c _dispatch_lane_invoke + 436
6   libdispatch.dylib             	0x00000001a4aae34c _dispatch_workloop_worker_thread + 652
7   libsystem_pthread.dylib       	0x00000001a4c1e100 _pthread_wqthread + 288
8   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 7 (id: 9668538):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 8 (id: 9668556):
0   libsystem_kernel.dylib        	0x00000001a4be4a9c __workq_kernreturn + 8
1   libsystem_pthread.dylib       	0x00000001a4c1ce20 start_wqthread + 8

Thread 9 (id: 9668557):

Binary Images:
       0x104e7c000 -        0x104e80f87  com.microlarge.Compositor (1.20.6 - 1.20.6) <c57a588d-d6db-304b-b06a-7606c51ce03d> /Applications/Compositor.app/Contents/MacOS/Compositor
       0x105a44000 -        0x105a4835b  org.sparkle-project.Sparkle (2.3.0 - 2021) <baa801db-601e-35f9-bc9e-e91214ae7edb> /Applications/Compositor.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle
       0x1a48f2000 -        0x1a48f2fff  com.apple.darwin.ignition (1.0.0 - 46.41.2) <de46dd52-4994-3fd8-b4b4-e352a1a19354> /usr/lib/dyld
       0x1a4982000 -        0x1a498329b  libxpc.dylib <44992a1e-d222-3d40-841d-e2cf9e26f67e> /usr/lib/system/libxpc.dylib
       0x1a4a97000 -        0x1a4a98fd3  libdispatch.dylib <40c9c98c-00d6-3e8e-9ad3-2ed6cf0d0cfe> /usr/lib/system/libdispatch.dylib
       0x1a4be2000 -        0x1a4be297f  libsystem_kernel.dylib <6d6644d3-3db3-34c4-b1e3-c675ec5360f0> /usr/lib/system/libsystem_kernel.dylib
       0x1a4c1b000 -        0x1a4c1bae3  libsystem_pthread.dylib <886caca0-5762-3640-8db2-3fa3b911c062> /usr/lib/system/libsystem_pthread.dylib
       0x1a4c80000 -        0x1a4c818ef  com.apple.CoreFoundation (6.9 - 1953.1) <f4ff83fc-e62c-30b4-b3a9-876c8a1fd595> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
       0x1a5bab000 -        0x1a5bad20f  com.apple.Foundation (6.9 - 1953.1) <52b2f83f-586d-32a2-8b66-ce651400ac8c> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
       0x1a7f1f000 -        0x1a7f223cb  com.apple.AppKit (6.9 - 2299) <af9f6891-70ad-3c26-af08-b747344892d2> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
       0x1a9477000 -        0x1a94789bb  com.apple.CFNetwork (1399.4 - 1399.4) <86c036e0-4a25-3600-a5b5-31b1caedbe4a> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
       0x1ac342000 -        0x1ac3446d7  com.apple.QuartzCore (1.11 - 1042.20) <6eae8b05-2af0-3057-91fc-cf2d9c74dd40> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
       0x1ae341000 -        0x1ae344b0f  com.apple.HIToolbox (2.1.1) <02b9797f-c47d-30b7-b7b0-802d0d26f31c> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox

Steps to reproduce the behavior

Download Compositor 1.20.6
Try to update to the latest version (1.20.8 as of today)

Answered by zorgiepoo

Nov 29, 2022

Please check the "Communication" section on the Sandboxing guide.

Your application does not have those entitlements in there:

> codesign -d --entitlements :- /Volumes/Compositor/Compositor.app 
Executable=/Volumes/Compositor/Compositor.app/Contents/MacOS/Compositor
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>com.apple.security.app-sandbox</key><true/><key>com.apple.security.files.bookmarks.document-scope</key><true/><key>com.apple.security.files.user-selected.read-write</key><true/><key>com.apple.security.network.client</key><true/><key>com.apple.security.print<…

View full answer

zorgiepoo · 2022-11-29T01:55:07Z

zorgiepoo
Nov 29, 2022
Maintainer

Please check the "Communication" section on the Sandboxing guide.

Your application does not have those entitlements in there:

> codesign -d --entitlements :- /Volumes/Compositor/Compositor.app 
Executable=/Volumes/Compositor/Compositor.app/Contents/MacOS/Compositor
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>com.apple.security.app-sandbox</key><true/><key>com.apple.security.files.bookmarks.document-scope</key><true/><key>com.apple.security.files.user-selected.read-write</key><true/><key>com.apple.security.network.client</key><true/><key>com.apple.security.print</key><true/></dict></plist>

It looks like you accidentally put these in your Info.plist which is incorrect.

Yes. I don't use Xcode's Archive & Export, though. I have a custom scripted build system that roughly performs the following steps:

You can also consider doing an Archive & Export in the command line via xcodebuild archive and xcodebuild -exportArchive and avoid manual code signing scripts / steps.

Be sure to test your changes in development before pushing a release out in production. If you tried to update without the mentioned entitlments, you should get this log message in your app (for some reason the error message you pasted is only partial / cut off but I see the full log in the sandbox violation report you pasted):

 [Sparkle] Error: An error occurred while running the updater. Please try again later. The remote port connection was invalidated from the updater. For additional details, please check Console logs for Autoupdate. If your application is sandboxed, please also ensure Installer Connection & Status entitlements are correctly set up: https://sparkle-project.org/documentation/sandboxing/ (URL (null))

You may be able to post an informational only update for users that are stuck updating (this notifies them of the update and gives them a link to your webpage / download).

0 replies

ktraunmueller · 2022-11-29T19:12:18Z

ktraunmueller
Nov 29, 2022
Author

Thanks so much for the quick response and spot-on analysis.

After moving the entitlements to the correct place, the update process now works 👍

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updater fails with "Sandbox: deny mach-lookup <Identifier>-spki/spks" #2290

{{title}}

Replies: 2 comments

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Updater fails with "Sandbox: deny mach-lookup <Identifier>-spki/spks" #2290

ktraunmueller Nov 28, 2022

Description of the problem

Do you use Sandboxing in your app?

Version of Sparkle.framework in the latest version of your app

Version of Sparkle.framework in the old version of app that your users have (or N/A)

Sparkle's output from Console.app

Steps to reproduce the behavior

Replies: 2 comments

zorgiepoo Nov 29, 2022 Maintainer

ktraunmueller Nov 29, 2022 Author

ktraunmueller
Nov 28, 2022

Version of `Sparkle.framework` in the latest version of your app

Version of `Sparkle.framework` in the old version of app that your users have (or N/A)

zorgiepoo
Nov 29, 2022
Maintainer

ktraunmueller
Nov 29, 2022
Author