build(macos): ship the unsigned build without the App Sandbox (ReleaseUnsigned.entitlements)
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 35/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- dart, github-actions, macos, sqlite
- 領域
- build-system, databases, desktop, security
研究方向
Read release.yml, the Xcode project settings, and the existing macos/Runner/Release.entitlements and ReleaseSigned.entitlements files. First determine how the no-secrets build currently selects entitlements; the issue leaves the sandbox decision open. Done means adding and wiring the chosen unsigned entitlements for CI and local release builds, then verifying Keychain, SQLite reopen, extensions, MCP endpoint, and updater behavior on a Mac.
由索引模型根據 Issue 內容生成。
描述
Problem
When the MACOS_* signing secrets are absent (forks, local builds, unsigned releases) the macOS app is built with ad-hoc signing and Release.entitlements, i.e. App Sandbox on. That is a different program from the signed build (ReleaseSigned.entitlements, no sandbox). Inside the sandbox:
HOMEis~/Library/Containers/com.queryahub.queryaDesktop/Data;~/.querya/extensionsand themes land in the container, not the real home.- Saved SQLite paths are not reopenable after restart (no security-scoped bookmarks);
~/.sshkeys andknown_hostsare unreachable. sandbox-execfor extensions cannot be applied from an already sandboxed process.- The MCP endpoint file is written to the container's
Library/Caches/Querya, whilequerya-mcpstarted by an MCP client reads the real~/Library/Caches/Querya. - The in-app updater cannot write to
/Applications(see #1587; the app quits and never comes back). - Keychain access fails (#1586).
Proposal (recommended)
Add macos/Runner/ReleaseUnsigned.entitlements without the App Sandbox (same hardened-runtime-free set as needed for ad-hoc signing) and use it for the no-secrets path in release.yml and in local release builds, so an unsigned build differs from the signed one only by Gatekeeper.
Alternative: support the sandbox properly (bookmarks, bundled querya-mcp, explicit capability errors). Much more work.
Tasks
- Decide sandbox vs no sandbox for unsigned builds.
- New entitlements file and wiring in
release.yml/ Xcode project (CI step without secrets passes it viaCODE_SIGN_ENTITLEMENTS). - Verify on a Mac: Keychain, SQLite reopen, extensions, MCP endpoint, updater.
Depends on / relates to #1586, #1587, #1591.
- 主要語言
- Dart
- 星號
- 23
- 分支
- 1
- 平均合併
- 49 分鐘
- 30 天內合併 PR
- 496
環境準備
在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
QueryaHub/Querya-Desktop 的其他 Issue
-
bug P3 ux
難度 2/5 1-3 小時 新手友好度 79/100
QueryaHub/Querya-Desktop#1837 ·
維護者通常 1 天內回覆
-
enhancement P3
難度 4/5 3-5 天 新手友好度 50/100
QueryaHub/Querya-Desktop#1838 ·
維護者通常 1 天內回覆
-
enhancement
難度 5/5 一週以上 新手友好度 45/100
QueryaHub/Querya-Desktop#1690 ·
維護者通常 1 天內回覆
-
enhancement
難度 4/5 1-2 天 新手友好度 55/100
QueryaHub/Querya-Desktop#1683 ·
維護者通常 1 天內回覆
-
enhancement
難度 5/5 一週以上 新手友好度 20/100
QueryaHub/Querya-Desktop#1625 · 2 則留言 ·
維護者通常 1 天內回覆
查看 QueryaHub/Querya-Desktop 的全部 Issue
相似的 Issue
-
area::build area::tests
難度 2/5 1-3 小時 新手友好度 69/100
linagora/twake-on-matrix#3504 · 1 則留言 ·
維護者通常 3 天內回覆
-
[Packages] [flutter_shaders] InkWell shader golden test fails on Flutter stable and Master channels未關閉from: manual-qa
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
-
documentation
難度 2/5 1-3 小時 新手友好度 72/100
patarapolw/lingua_srs#22 ·
-
interruptRestart fails with "Tool <name> not found" for namespaced tools (ns/tool)可能已有人在做 @esrakadah 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 78/100
genkit-ai/genkit-dart#657 ·
維護者通常 1 天內回覆
-
ai-driven-qa bug Cosmetic
難度 2/5 1-3 小時 新手友好度 76/100
linagora/tmail-flutter#5067 ·
維護者通常 1 天內回覆