AU requires flagging as sandboxSAFE in the plist

[UMCorps]

Bug Description:

Current version of the AU does not pass validation for hosts downloaded from the Mac App Store (ie hardened runtime sandboxed apps). It is not an issue for hosts such as Logic

Description of the discovery of this problem and its solution is in this thread

https://forum.juce.com/t/sandboxsafe-and-macos-host-au2-hardened-runtime-disable-library-validation/47281/5

Computer Information (please complete the following information):

• OS: [Mac OS 11.6.1]
• Host: [Wotja 22 Pro. https://intermorphic.com/blog/posts/211214-Wotja-22-Will-Be-Here-Soon.html]

[baconpaul]

When you say current version, do you mean 1.9 or XT?
XT we sign with mac credentials and the hardened runtime.

[baconpaul]

Also: Are you the author of wotja? How can our team get an NFR to test?
Thanks

[sseyod]

@baconpaul just go to the contact page on https://intermorphic.com ... best, Pete

[UMCorps]

Apologies. I'm using....

Surge Synthesizer
System: macOS 64-bit AU on Apple M1 (Apple Silicon)
Build Info: Built on 2021-04-21 at 11:26:22, using pipeline host 'Mac-1619004058536.local' with 'AppleClang-12.0.0.12000032'
Version: 1.9.0.91069f8

sseyod (Pete) above is the dev

[baconpaul]

Great right so that version isn't signed. It will never work.

Can you try the version from here: https://surge-synthesizer.github.io/nightly_XT which both asks for the permissions it needs in the plist and is signed and hardened?

[baconpaul]

I also dropped in a note for an NFR in the event it doesn't work.

[UMCorps]

the nightly XT didn't pass either

[baconpaul]

huh well that is a major bummer

[baconpaul]

Wow of the hundreds of plugins I have, about 6 of them are sandboxSafe keyed. But one of them is pianoteq which is a juce plugin so must be doable somehow.

[baconpaul]

Huh ok a note to self there is a property in juce cmake IS_AU_SANDBOX_SAFE
I wonder if setting it will make us lose our filesystem access though
can you compile surge from source @UMCorps?

[UMCorps]

I'm afraid I struggle with things like that

Best would be to talk to Pete directly. He will probably know if there are implications for filesystem access

[baconpaul]

ok. i'm trying to figure out how to test this without running our full pipeline.
will wait for my NFR of the daw to come through and give it a try over the holidays.