upgrade dependencies to enable hardened runtime for easier install?

[micahstubbs]

Got the project to build locally 🎉

I have an enhancement idea 💡

We could upgrade the dependencies to enable hardened runtime. If we do this, I think that it makes it easier for some users on the latest versions of MacOS to install Dozer.

This is what I see when I try to validate the build with Apple:

I think that these are the dependencies that would need to be updated or configured to support this:

• submit
• uploadDYSM
• Autoupdate.app (Sparkle)
• fileop

research

https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

or alternately do some code-signing work-around like the one described here: insidegui/WWDC#540 (comment)

more discussion here: sparkle-project/Sparkle#1389

[Mortennn]

Are you testing this on master because the problem is solved using this script?

Also, Dozer is not sandboxed at the moment so it can't be validated by Apple.

[micahstubbs]

yes, testing on master.

ah hah! this does look one solution the login friction. https://github.com/Mortennn/Dozer/blob/master/Scripts/SignFrameworks.sh

Curious, do you think would it be practical / worth the effort to sandbox Dozer sometime in the future? Does the permissions that it needs to manage the task bar somehow make this difficult to do?

[Mortennn]

Initially, Dozer used accessibility API's which meant it couldn't be sandboxed.

It doesn't anymore so it is possible now.

The "only" benefit of sanboxing is that it limits what Dozer has access to:

App Sandbox provides a last line of defense against stolen, corrupted, or deleted user data if malicious code exploits your app. App Sandbox also minimizes the damage from coding errors in your app or in frameworks you link against. source.

Though, I don't think sandboxing is worth it because it limits future features from being implemented: #38 #51 #55 #67 #69. Also, Dozer has hardened runtime enabled which should at least add some extra protection.

[micahstubbs]

makes sense, thanks for the reply and linking to the other issues. will close this one for now.