Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

build(macos): ship the unsigned build without the App Sandbox (ReleaseUnsigned.entitlements)

Offen
  • Stimmt etwas nicht?
#1,592 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
35/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
dart, github-actions, macos, sqlite
Bereich
build-system, databases, desktop, security

Rechercherichtung

Read release.yml, the Xcode project settings, and the existing macos/Runner/Release.entitlements and ReleaseSigned.entitlements files. First determine how the no-secrets build currently selects entitlements; the issue leaves the sandbox decision open. Done means adding and wiring the chosen unsigned entitlements for CI and local release builds, then verifying Keychain, SQLite reopen, extensions, MCP endpoint, and updater behavior on a Mac.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

enhancement P1 stability

Problem

When the MACOS_* signing secrets are absent (forks, local builds, unsigned releases) the macOS app is built with ad-hoc signing and Release.entitlements, i.e. App Sandbox on. That is a different program from the signed build (ReleaseSigned.entitlements, no sandbox). Inside the sandbox:

  • HOME is ~/Library/Containers/com.queryahub.queryaDesktop/Data; ~/.querya/extensions and themes land in the container, not the real home.
  • Saved SQLite paths are not reopenable after restart (no security-scoped bookmarks); ~/.ssh keys and known_hosts are unreachable.
  • sandbox-exec for extensions cannot be applied from an already sandboxed process.
  • The MCP endpoint file is written to the container's Library/Caches/Querya, while querya-mcp started by an MCP client reads the real ~/Library/Caches/Querya.
  • The in-app updater cannot write to /Applications (see #1587; the app quits and never comes back).
  • Keychain access fails (#1586).

Proposal (recommended)

Add macos/Runner/ReleaseUnsigned.entitlements without the App Sandbox (same hardened-runtime-free set as needed for ad-hoc signing) and use it for the no-secrets path in release.yml and in local release builds, so an unsigned build differs from the signed one only by Gatekeeper.

Alternative: support the sandbox properly (bookmarks, bundled querya-mcp, explicit capability errors). Much more work.

Tasks

  • Decide sandbox vs no sandbox for unsigned builds.
  • New entitlements file and wiring in release.yml / Xcode project (CI step without secrets passes it via CODE_SIGN_ENTITLEMENTS).
  • Verify on a Mac: Keychain, SQLite reopen, extensions, MCP endpoint, updater.

Depends on / relates to #1586, #1587, #1591.

Vorherrschende Sprache
Dart
Sterne
23
Forks
1
Ø Merge
31 Min.
Gemergte PRs (30 T.)
570

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus QueryaHub/Querya-Desktop

Alle Issues in QueryaHub/Querya-Desktop

Ähnliche Issues

Weitere Issues zu Dart

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.