From 470680cb1f1055b80b2d7d5b066452b3984c04fa Mon Sep 17 00:00:00 2001 From: Mariusz Klochowicz Date: Fri, 7 Nov 2025 09:15:56 +1030 Subject: [PATCH] chore(apple): Migrate to latest Xcode recommended settings (#10766) Prompted by Xcode warning at project startup. Most of the changes are simple migrations from entitlements files to build settings, which is the recommended approach, and were done automatically by Xcode. new settings: - REGISTER_APP_GROUPS - Automatically registers app groups with provisioning profile (I had to set this manually when setting up, so it's a welcome change) - STRING_CATALOG_GENERATE_SYMBOLS - type-safe localization (no regression, we're not doing any localization currently) - ENABLE_USER_SCRIPT_SANDBOXING - sandboxing all the build scripts Note: I had to turn off the recommended `ENABLE_USER_SCRIPT_SANDBOXING` as it would interfere with our building of connlib during the build. Also: make Makefile more ergonomic to use (setup LSP config during first build) --- .../apple/Firezone.xcodeproj/project.pbxproj | 28 ++++++++++++++++++- .../xcshareddata/xcschemes/Firezone.xcscheme | 2 +- .../FirezoneNetworkExtensionmacOS.xcscheme | 2 +- swift/apple/Firezone/Firezone.entitlements | 20 +++++-------- .../FirezoneNetworkExtension.entitlements | 16 ++++------- swift/apple/Makefile | 15 ++++++++-- 6 files changed, 53 insertions(+), 30 deletions(-) diff --git a/swift/apple/Firezone.xcodeproj/project.pbxproj b/swift/apple/Firezone.xcodeproj/project.pbxproj index 1ebec2226..ca8f43225 100644 --- a/swift/apple/Firezone.xcodeproj/project.pbxproj +++ b/swift/apple/Firezone.xcodeproj/project.pbxproj @@ -353,7 +353,7 @@ attributes = { BuildIndependentTargetsInParallel = 1; LastSwiftUpdateCheck = 1610; - LastUpgradeCheck = 1630; + LastUpgradeCheck = 2600; TargetAttributes = { 05CF1CEF290B1CEE00CF4755 = { CreatedOnToolsVersion = 14.0.1; @@ -567,6 +567,9 @@ CODE_SIGN_STYLE = "$(inherited)"; CURRENT_PROJECT_VERSION = "$(inherited)"; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; + ENABLE_INCOMING_NETWORK_CONNECTIONS = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; FRAMEWORK_SEARCH_PATHS = ""; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = FirezoneNetworkExtension/Info.iOS.plist; @@ -611,6 +614,9 @@ CODE_SIGN_STYLE = "$(inherited)"; CURRENT_PROJECT_VERSION = "$(inherited)"; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; + ENABLE_INCOMING_NETWORK_CONNECTIONS = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; FRAMEWORK_SEARCH_PATHS = ""; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = FirezoneNetworkExtension/Info.iOS.plist; @@ -653,7 +659,10 @@ CODE_SIGN_STYLE = "$(inherited)"; CURRENT_PROJECT_VERSION = "$(inherited)"; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; + ENABLE_INCOMING_NETWORK_CONNECTIONS = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = FirezoneNetworkExtension/Info.macOS.plist; INFOPLIST_KEY_CFBundleDisplayName = FirezoneNetworkExtension; @@ -674,6 +683,7 @@ PRODUCT_BUNDLE_IDENTIFIER = "$(inherited).network-extension"; PRODUCT_NAME = "$(PRODUCT_BUNDLE_IDENTIFIER)"; PROVISIONING_PROFILE_SPECIFIER = "$(NE_PROFILE_ID)"; + REGISTER_APP_GROUPS = YES; SDKROOT = macosx; SKIP_INSTALL = YES; SUPPORTED_PLATFORMS = macosx; @@ -695,7 +705,10 @@ CURRENT_PROJECT_VERSION = "$(inherited)"; DEAD_CODE_STRIPPING = YES; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; + ENABLE_INCOMING_NETWORK_CONNECTIONS = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = FirezoneNetworkExtension/Info.macOS.plist; INFOPLIST_KEY_CFBundleDisplayName = FirezoneNetworkExtension; @@ -716,6 +729,7 @@ PRODUCT_BUNDLE_IDENTIFIER = "$(inherited).network-extension"; PRODUCT_NAME = "$(PRODUCT_BUNDLE_IDENTIFIER)"; PROVISIONING_PROFILE_SPECIFIER = "$(NE_PROFILE_ID)"; + REGISTER_APP_GROUPS = YES; SDKROOT = macosx; SKIP_INSTALL = YES; SUPPORTED_PLATFORMS = macosx; @@ -769,6 +783,7 @@ DEVELOPMENT_TEAM = 47R2M6779T; ENABLE_STRICT_OBJC_MSGSEND = YES; ENABLE_TESTABILITY = YES; + ENABLE_USER_SCRIPT_SANDBOXING = NO; GCC_C_LANGUAGE_STANDARD = gnu11; GCC_DYNAMIC_NO_PIC = NO; GCC_NO_COMMON_BLOCKS = YES; @@ -790,6 +805,7 @@ MTL_FAST_MATH = YES; ONLY_ACTIVE_ARCH = YES; OTHER_SWIFT_FLAGS = "-enable-upcoming-feature ExistentialAny"; + STRING_CATALOG_GENERATE_SYMBOLS = YES; SUPPORTED_PLATFORMS = "macosx iphoneos"; SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; SWIFT_OPTIMIZATION_LEVEL = "-Onone"; @@ -841,6 +857,7 @@ DEVELOPMENT_TEAM = 47R2M6779T; ENABLE_NS_ASSERTIONS = NO; ENABLE_STRICT_OBJC_MSGSEND = YES; + ENABLE_USER_SCRIPT_SANDBOXING = NO; GCC_C_LANGUAGE_STANDARD = gnu11; GCC_NO_COMMON_BLOCKS = YES; GCC_TREAT_WARNINGS_AS_ERRORS = YES; @@ -855,6 +872,7 @@ MTL_ENABLE_DEBUG_INFO = NO; MTL_FAST_MATH = YES; OTHER_SWIFT_FLAGS = "-enable-upcoming-feature ExistentialAny"; + STRING_CATALOG_GENERATE_SYMBOLS = YES; SUPPORTED_PLATFORMS = "macosx iphoneos"; SWIFT_COMPILATION_MODE = wholemodule; SWIFT_OPTIMIZATION_LEVEL = "-O"; @@ -876,8 +894,11 @@ CURRENT_PROJECT_VERSION = "$(inherited)"; DEAD_CODE_STRIPPING = YES; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; ENABLE_PREVIEWS = YES; + ENABLE_USER_SELECTED_FILES = readwrite; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = Firezone/Info.plist; INFOPLIST_KEY_CFBundleDisplayName = Firezone; @@ -898,6 +919,7 @@ PRODUCT_BUNDLE_IDENTIFIER = "$(inherited)"; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = "$(APP_PROFILE_ID)"; + REGISTER_APP_GROUPS = YES; SDKROOT = auto; SUPPORTED_PLATFORMS = "iphoneos macosx"; SWIFT_EMIT_LOC_STRINGS = YES; @@ -926,8 +948,11 @@ DEFINES_MODULE = NO; DEVELOPMENT_ASSET_PATHS = "\"Firezone/Preview Content\""; DEVELOPMENT_TEAM = "$(inherited)"; + ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; + ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES; ENABLE_PREVIEWS = YES; + ENABLE_USER_SELECTED_FILES = readwrite; GENERATE_INFOPLIST_FILE = YES; INFOPLIST_FILE = Firezone/Info.plist; INFOPLIST_KEY_CFBundleDisplayName = Firezone; @@ -948,6 +973,7 @@ PRODUCT_MODULE_NAME = "$(PRODUCT_NAME:c99extidentifier)"; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = "$(APP_PROFILE_ID)"; + REGISTER_APP_GROUPS = YES; SDKROOT = auto; SUPPORTED_PLATFORMS = "iphoneos macosx"; SWIFT_EMIT_LOC_STRINGS = YES; diff --git a/swift/apple/Firezone.xcodeproj/xcshareddata/xcschemes/Firezone.xcscheme b/swift/apple/Firezone.xcodeproj/xcshareddata/xcschemes/Firezone.xcscheme index 45810606c..fdee75633 100644 --- a/swift/apple/Firezone.xcodeproj/xcshareddata/xcschemes/Firezone.xcscheme +++ b/swift/apple/Firezone.xcodeproj/xcshareddata/xcschemes/Firezone.xcscheme @@ -1,6 +1,6 @@ com.apple.developer.networking.networkextension - + packet-tunnel-provider$(PACKET_TUNNEL_PROVIDER_SUFFIX) - com.apple.security.app-sandbox + com.apple.developer.system-extension.install com.apple.security.application-groups $(APP_GROUP_ID) - - $(APP_GROUP_ID_PRE_1_4_0) + + $(APP_GROUP_ID_PRE_1_4_0) - com.apple.developer.system-extension.install - - com.apple.security.files.user-selected.read-write - - com.apple.security.network.client - diff --git a/swift/apple/FirezoneNetworkExtension/FirezoneNetworkExtension.entitlements b/swift/apple/FirezoneNetworkExtension/FirezoneNetworkExtension.entitlements index e217ddcff..be3553e36 100644 --- a/swift/apple/FirezoneNetworkExtension/FirezoneNetworkExtension.entitlements +++ b/swift/apple/FirezoneNetworkExtension/FirezoneNetworkExtension.entitlements @@ -10,17 +10,11 @@ com.apple.security.application-groups $(APP_GROUP_ID) - - $(APP_GROUP_ID_PRE_1_4_0) + + $(APP_GROUP_ID_PRE_1_4_0) - com.apple.security.app-sandbox - - com.apple.security.network.client - - com.apple.security.network.server - diff --git a/swift/apple/Makefile b/swift/apple/Makefile index fe54aa164..e249ef56a 100644 --- a/swift/apple/Makefile +++ b/swift/apple/Makefile @@ -55,12 +55,21 @@ uniffi-bindings: $(GENERATED_DIR)/connlib.swift $(GENERATED_DIR)/connlibFFI.h # Info for sourcekit-lsp (LSP server for other IDEs) .PHONY: lsp lsp: - @xcode-build-server config \ - -project Firezone.xcodeproj \ - -scheme Firezone + @if command -v xcode-build-server >/dev/null 2>&1; then \ + xcode-build-server config \ + -project Firezone.xcodeproj \ + -scheme Firezone; \ + else \ + echo "xcode-build-server not installed, skipping LSP configuration"; \ + echo " Install with: brew install xcode-build-server"; \ + fi .PHONY: build build: $(GENERATED_DIR)/connlib.swift $(GENERATED_DIR)/connlibFFI.h + @if [ ! -f buildServer.json ]; then \ + echo "buildServer.json not found, generating LSP configuration..."; \ + $(MAKE) lsp; \ + fi @echo "Building Xcode project for ${PLATFORM}, ${ARCH}" @echo "Git SHA: ${GIT_SHA}" @xcodebuild build \