When enable sandbox in entitlement file for signing for Mac store, signed app crashes.

[lanyusan]

Describe the bug
On MacAir M1 chip, with net6.0-macos as target framework, if sandbox enabled, app always crashes. If disable sandbox, app works.

To Reproduce

git clone https://github.com/lanyusan/avanolia-iap-bug1
open it with visual studio for Mac
choose release build.
build

sign it with apple dev cert:

codesign --force --options runtime --entitlements ./Entitlements.plist --deep \
  --sign "3rd Party Mac Developer Application: [xxxx]" \
  --timestamp bin/Release/net6.0-macos/osx-x64/AvanoliaInAppPluginBug.app

open AvanoliaInAppPluginBug.app

Expected behavior

app is launched successfully

Additional context

I have tried the publish command stated by official packaging guide to generate single exe:

https://docs.avaloniaui.net/docs/distribution-publishing/macos#sandbox-entitlements-and-signing

the command:

dotnet publish ../../ProjectFolder/AppName.csproj -c release -f net6.0-macos -r osx-x64 --self-contained true -p:PublishSingleFile=true

which had this error:

error NETSDK1098: Applications published to a single-file are required to use the application host. You must either set PublishSingleFile to false or set UseAppHost to true. [/Users/fqye/study/avanolia-iap-bug1/AvanoliaInAppPluginBug.csproj]

So according the command was changed to :

dotnet publish -c release -f net6.0-macos -r osx-x64 --self-contained true -p:PublishSingleFile=true -p:UseAppHost=true

Following build errors popped up:

/usr/local/share/dotnet/sdk/7.0.101/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(904,5): error MSB4018: The "GenerateBundle" task failed unexpectedly. [/Users/fqye/study/avanolia-iap-bug1/AvanoliaInAppPluginBug.csproj]

/usr/local/share/dotnet/sdk/7.0.101/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(904,5): error MSB4018: System.ArgumentException: Invalid input specification: Must specify the host binary [/Users/fqye/study/avanolia-iap-bug1/AvanoliaInAppPluginBug.csproj]

Not sure if this is the root cause. If yes, how to fix the above single file publish problem.

Screenshots
Crash report:

-------------------------------------
Translated Report (Full Report Below)
-------------------------------------

Process:               AvanoliaInAppPluginBug [13032]
Path:                  /Users/USER/*/AvanoliaInAppPluginBug.app/Contents/MacOS/AvanoliaInAppPluginBug
Identifier:            cn.shanglianyi.layermixer
Version:               1.0.3 (1.0.3)
Code Type:             X86-64 (Translated)
Parent Process:        launchd [1]
User ID:               502

Date/Time:             2022-12-23 15:54:23.9149 +0800
OS Version:            macOS 13.1 (22C65)
Report Version:        12
Anonymous UUID:        905BE678-C6B0-EAC0-5EB7-83FB26EB8BB9


Time Awake Since Boot: 24000 seconds

System Integrity Protection: enabled

Crashed Thread:        0

Exception Type:        EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid))
Exception Codes:       UNKNOWN_0x32 at 0x00000001097c5000
Exception Codes:       0x0000000000000032, 0x00000001097c5000

Termination Reason:    Namespace CODESIGNING, Code 2 Invalid Page

VM Region Info: 0x1097c5000 is in 0x1097c5000-0x1097e8000;  bytes after start: 0  bytes before end: 143359
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      Rosetta Generic             1097c4000-1097c5000    [    4K] rw-/rwx SM=PRV  
--->  mapped file                 1097c5000-1097e8000    [  140K] r--/rwx SM=COW  ...ct_id=139a2b3
      GAP OF 0xf7960000 BYTES
      __TEXT                      201148000-2011e0000    [  608K] r-x/r-x SM=COW  /usr/lib/dyld

Desktop (please complete the following information):

• OS: [e.g. Windows, Mac, Linux (State distribution)]

Mac M1, Ventura 13.1

• Version [e.g. 0.10.0-rc1 or 0.9.12]

0.10.18

I have stuck here for a couple of days. Help much appreciated.

[kekekeks]

Note that instructions were written for .NET SDK 6.0, something might have changed in 7.0. Especially since something fails in MSBuild during bundle generation

[lanyusan]

@kekekeks

Switched to 6, still same problem:

command: dotnet publish -c release -r osx-x64 --self-contained true -p:PublishSingleFile=true

errors:

/usr/local/share/dotnet/sdk/6.0.404/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(104,5): error NETSDK1098: Applications published to a single-file are required to use the application host. You must either set PublishSingleFile to false or set UseAppHost to true.

with UseAppHost option dotnet publish -c release -r osx-x64 --self-contained true -p:PublishSingleFile=true -p:UseAppHost=true:

errors:

/usr/local/share/dotnet/sdk/6.0.404/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(898,5): error MSB4018: The "GenerateBundle" task failed unexpectedly. [/Users/fqye/projects/layer-mixer-avalonia/LayerMixer.csproj]
/usr/local/share/dotnet/sdk/6.0.404/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(898,5): error MSB4018: System.ArgumentException: Invalid input specification: Must specify the host binary [/Users/fqye/projects/layer-mixer-avalonia/LayerMixer.csproj]

How do I specify the host binary? Can't find any documentation about it.

Many thanks.

[kekekeks]

It might somehow be related to the fact that you are using net6.0-macos TargetFramework which enables extra packaging targets from .NET SDK that seem to be failing there. The guide assumes net6.0 target framework.

[lanyusan]

@kekekeks

I do need to use net6.0-macos for IAP APIs.

I have tried to publish with the latest <PublishReadyToRun>true</PublishReadyToRun> option, which builds AOT single file package and got this error:

/usr/local/share/dotnet/sdk/7.0.101/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.CrossGen.targets(465,5): error : Error: [S.P.CoreLib]System.Runtime.InteropServices.NFloat._value [/Users/fqye/projects/layer-mixer-avalonia/LayerMixer.csproj]

Trying to get help from dotnet community as well:

dotnet/runtime#79947

Any idea how to fix that?