Victoria Ashworth 529a4d2bac
Disable sandboxing for macOS apps and tests in CI (#149618)
macOS 14 added new requirements that un-codesigned sandbox apps must be granted access when changed. Waiting for this UI caused macOS tests to fail on macOS 14 because the test runner forced codesigning off. Additionally, adding codesigning is not sufficient, since it must still be approved before codesigning is enough to pass the check. As a workaround, this PR disables sandboxing for macOS apps/tests in CI.

![Screenshot 2024-05-30 at 2 41 33 PM](https://github.com/flutter/flutter/assets/682784/1bc32620-5edb-420a-866c-5cc529b2ac55)

https://developer.apple.com/documentation/updates/security#June-2023)
> App Sandbox now associates your macOS app with its sandbox container using its code signature. The operating system asks the person using your app to grant permission if it tries to access a sandbox container associated with a different app. For more information, see [Accessing files from the macOS App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/accessing_files_from_the_macos_app_sandbox).

And that link explains why this is happening on a macOS 14 update:

> In macOS 14 and later, the operating system uses your app’s code signature to associate it with its sandbox container. If your app tries to access the sandbox container owned by another app, the system asks the person using your app whether to grant access. If the person denies access and your app is already running, then it can’t read or write the files in the other app’s sandbox container. If the person denies access while your app is launching and trying to enter the other app’s sandbox container, your app fails to launch.
> 
> The operating system also tracks the association between an app’s code signing identity and its sandbox container for helper tools, including launch agents. If a person denies permission for a launch agent to enter its sandbox container and the app fails to start, launchd starts the launch agent again and the operating system re-requests access.

Fixes https://github.com/flutter/flutter/issues/149268.
Fixes framework part of https://github.com/flutter/flutter/issues/149264.
Might fix packages issue: https://github.com/flutter/flutter/issues/149329.

Verified framework tests:
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac%20plugin_test_macos/9/overview
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac%20run_debug_test_macos/2/overview
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac%20tool_integration_tests_4_4/2/overview
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac%20integration_ui_test_test_macos/3/overview
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac%20flavors_test_macos/3/overview
https://ci.chromium.org/ui/p/flutter/builders/staging.shadow/Mac_benchmark%20complex_layout_scroll_perf_macos__timeline_summary/6/overview
2024-06-04 21:51:19 +00:00

126 lines
3.4 KiB
Dart

// Copyright 2014 The Flutter Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
import 'dart:async';
import 'package:process/process.dart';
import '../base/file_system.dart';
import '../base/logger.dart';
import '../base/os.dart';
import '../build_info.dart';
import '../desktop_device.dart';
import '../device.dart';
import '../project.dart';
import 'application_package.dart';
import 'build_windows.dart';
import 'windows_workflow.dart';
/// A device that represents a desktop Windows target.
class WindowsDevice extends DesktopDevice {
WindowsDevice({
required ProcessManager processManager,
required Logger logger,
required FileSystem fileSystem,
required OperatingSystemUtils operatingSystemUtils,
}) : _operatingSystemUtils = operatingSystemUtils,
super(
'windows',
platformType: PlatformType.windows,
ephemeral: false,
processManager: processManager,
logger: logger,
fileSystem: fileSystem,
operatingSystemUtils: operatingSystemUtils,
);
final OperatingSystemUtils _operatingSystemUtils;
@override
bool isSupported() => true;
@override
String get name => 'Windows';
@override
Future<TargetPlatform> get targetPlatform async => _targetPlatform;
TargetPlatform get _targetPlatform => switch (_operatingSystemUtils.hostPlatform) {
HostPlatform.windows_arm64 => TargetPlatform.windows_arm64,
_ => TargetPlatform.windows_x64,
};
@override
bool isSupportedForProject(FlutterProject flutterProject) {
return flutterProject.windows.existsSync();
}
@override
Future<void> buildForDevice({
String? mainPath,
required BuildInfo buildInfo,
bool usingCISystem = false,
}) async {
await buildWindows(
FlutterProject.current().windows,
buildInfo,
_targetPlatform,
target: mainPath,
);
}
@override
String executablePathForDevice(covariant WindowsApp package, BuildInfo buildInfo) {
return package.executable(buildInfo.mode, _targetPlatform);
}
}
class WindowsDevices extends PollingDeviceDiscovery {
WindowsDevices({
required ProcessManager processManager,
required Logger logger,
required FileSystem fileSystem,
required OperatingSystemUtils operatingSystemUtils,
required WindowsWorkflow windowsWorkflow,
}) : _fileSystem = fileSystem,
_logger = logger,
_processManager = processManager,
_operatingSystemUtils = operatingSystemUtils,
_windowsWorkflow = windowsWorkflow,
super('windows devices');
final FileSystem _fileSystem;
final Logger _logger;
final ProcessManager _processManager;
final OperatingSystemUtils _operatingSystemUtils;
final WindowsWorkflow _windowsWorkflow;
@override
bool get supportsPlatform => _windowsWorkflow.appliesToHostPlatform;
@override
bool get canListAnything => _windowsWorkflow.canListDevices;
@override
Future<List<Device>> pollingGetDevices({ Duration? timeout }) async {
if (!canListAnything) {
return const <Device>[];
}
return <Device>[
WindowsDevice(
fileSystem: _fileSystem,
logger: _logger,
processManager: _processManager,
operatingSystemUtils: _operatingSystemUtils,
),
];
}
@override
Future<List<String>> getDiagnostics() async => const <String>[];
@override
List<String> get wellKnownIds => const <String>['windows'];
}