Fix Quick Look extension entitlements stripped by release signing#494
Merged
Conversation
The release signing pipeline overwrote the QL extension's entitlements with the main app's in two places: a global CODE_SIGN_ENTITLEMENTS override on the xcodebuild command line, and codesign --deep re-signing all nested components with the app's entitlements. The extension shipped without com.apple.security.app-sandbox, so macOS refused to load it. Additionally, the extension was missing com.apple.security.network.client, which WKWebView requires for its subprocess IPC even when rendering local HTML inside a sandbox. - Remove CODE_SIGN_ENTITLEMENTS override from build action - Replace --deep with inside-out signing (extension first, then app) - Add network.client entitlement to QL extension - Add sandbox entitlement verification gates in release and staple workflows Related to #284
Contributor
Code Coverage ReportCurrent Coverage: 62.98% Coverage Details (Summary) |
schuyler
added a commit
that referenced
this pull request
Jul 1, 2026
## Summary - Remove global `CODE_SIGN_ENTITLEMENTS` override from build action — each target now uses its own entitlements as declared in the Xcode project - Replace `codesign --deep` with inside-out signing — QL extension signed with its own entitlements first, then outer app bundle - Add `com.apple.security.network.client` to QL extension entitlements (WKWebView needs it for subprocess IPC in sandbox) - Add sandbox entitlement verification gates in release and staple workflows ## Context The Quick Look extension shipped in RC 3000.0.7-rc.2 without `com.apple.security.app-sandbox` because the release pipeline overwrote its entitlements in two places. macOS refused to load the unsandboxed extension. Additionally, the extension was missing `network.client`, causing WKWebView's subprocesses to crash inside the sandbox. Verified locally: QL preview renders markdown after these changes. Related to #284 ## Test plan - [x] 1026 tests pass (0 unexpected), matches baseline - [x] Local QL preview confirmed working (Finder Space on .md file) - [ ] CI release-build workflow passes with new entitlement gates - [ ] Next RC: @caius confirms QL preview works in signed/notarized build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CODE_SIGN_ENTITLEMENTSoverride from build action — each target now uses its own entitlements as declared in the Xcode projectcodesign --deepwith inside-out signing — QL extension signed with its own entitlements first, then outer app bundlecom.apple.security.network.clientto QL extension entitlements (WKWebView needs it for subprocess IPC in sandbox)Context
The Quick Look extension shipped in RC 3000.0.7-rc.2 without
com.apple.security.app-sandboxbecause the release pipeline overwrote its entitlements in two places. macOS refused to load the unsandboxed extension. Additionally, the extension was missingnetwork.client, causing WKWebView's subprocesses to crash inside the sandbox.Verified locally: QL preview renders markdown after these changes.
Related to #284
Test plan