Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

build(macos): ship the unsigned build without the App Sandbox (ReleaseUnsigned.entitlements)

Abierto
  • ¿Algo no está bien?
#1,592 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
dart, github-actions, macos, sqlite
Área
build-system, databases, desktop, security

Línea de trabajo

Read release.yml, the Xcode project settings, and the existing macos/Runner/Release.entitlements and ReleaseSigned.entitlements files. First determine how the no-secrets build currently selects entitlements; the issue leaves the sandbox decision open. Done means adding and wiring the chosen unsigned entitlements for CI and local release builds, then verifying Keychain, SQLite reopen, extensions, MCP endpoint, and updater behavior on a Mac.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement P1 stability

Problem

When the MACOS_* signing secrets are absent (forks, local builds, unsigned releases) the macOS app is built with ad-hoc signing and Release.entitlements, i.e. App Sandbox on. That is a different program from the signed build (ReleaseSigned.entitlements, no sandbox). Inside the sandbox:

  • HOME is ~/Library/Containers/com.queryahub.queryaDesktop/Data; ~/.querya/extensions and themes land in the container, not the real home.
  • Saved SQLite paths are not reopenable after restart (no security-scoped bookmarks); ~/.ssh keys and known_hosts are unreachable.
  • sandbox-exec for extensions cannot be applied from an already sandboxed process.
  • The MCP endpoint file is written to the container's Library/Caches/Querya, while querya-mcp started by an MCP client reads the real ~/Library/Caches/Querya.
  • The in-app updater cannot write to /Applications (see #1587; the app quits and never comes back).
  • Keychain access fails (#1586).

Proposal (recommended)

Add macos/Runner/ReleaseUnsigned.entitlements without the App Sandbox (same hardened-runtime-free set as needed for ad-hoc signing) and use it for the no-secrets path in release.yml and in local release builds, so an unsigned build differs from the signed one only by Gatekeeper.

Alternative: support the sandbox properly (bookmarks, bundled querya-mcp, explicit capability errors). Much more work.

Tasks

  • Decide sandbox vs no sandbox for unsigned builds.
  • New entitlements file and wiring in release.yml / Xcode project (CI step without secrets passes it via CODE_SIGN_ENTITLEMENTS).
  • Verify on a Mac: Keychain, SQLite reopen, extensions, MCP endpoint, updater.

Depends on / relates to #1586, #1587, #1591.

Lenguaje dominante
Dart
Estrellas
23
Forks
1
Merge medio
31 min
PR fusionados (30 d)
570

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de QueryaHub/Querya-Desktop

Todos los issues de QueryaHub/Querya-Desktop

Issues similares

Más issues de Dart

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.