Skip to content

Add support for enable/disable-get-task-allow-entitlement with swiftbuild build system #8378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cmcgee1024 opened this issue Mar 17, 2025 · 1 comment
Labels
swift build Changes impacting `swift build`

Comments

@cmcgee1024
Copy link
Member

cmcgee1024 commented Mar 17, 2025

The test case BuildCommandSwiftBuildTests.testGetTaskAllowEntitlement is currently skipped because the test doesn't work with the swiftbuild build system. The test is in place to verify that a specific entitlement com.apple.security.get-task-allow is codesigned into an executable or not based on factors, such as the build configuration (release or debug), and also certain hidden flags --enable/disable-get-task-allow-entitlement that override the configuration. The entitlement itself, like all entitlements, is macOS specific and it grants extra debugging capabilities with the executable. https://developer.apple.com/documentation/security/resolving-common-notarization-issues#Avoid-the-get-task-allow-entitlement

This test case needs to be adjusted to not rely so heavily on parsing the build output. Instead, it should verify the executables after each build to see if the entitlement is present, or not. It can use something like the following command and check the output for the get-task-allow entitlement:

codesign -d --entitlements - <path_to_executable>
--
[Dict]
        [Key] com.apple.security.get-task-allow
        [Value]
                [Bool] true

Also, the SwiftBuildSupport will need to pass along the command-line option override, if present to swift-build as a build setting: ENTITLEMENTS_DONT_REMOVE_GET_TASK_ALLOW for the test to succeed in some of the cases.

On non-macOS systems, the test case checks for a warning message to be emitted indicating that entitlements are not available on the platform, and they are essentially ignored. Those checks should remain in place since the warning message should be emitted when using the swiftbuild build system.

@cmcgee1024 cmcgee1024 added the swift build Changes impacting `swift build` label Mar 17, 2025
@jakepetroules
Copy link
Contributor

See checkEntitlements in https://github.com/swiftlang/swift-build/blob/main/Sources/SwiftBuildTestSupport/CoreQualificationTester.swift for an implementation of reading entitlements (which also handles a bunch of edge cases with the simulator).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
swift build Changes impacting `swift build`
Projects
None yet
Development

No branches or pull requests

2 participants