test: add macOS-CLI sample to reproduce sandbox profiling issue#7294
test: add macOS-CLI sample to reproduce sandbox profiling issue#7294
Conversation
Add a sample macOS CLI application to investigate app launch profiling failures in sandboxed environments. The sample includes two executables: - cli-with-binary: Uses binary Sentry dependency (reproduces error) - cli-with-spm: Uses SentrySPM dependency (works correctly) The binary dependency fails when trying to create directories in /Users/.../Library/Caches/ due to sandbox restrictions, while the SPM version works fine. Disabled library evolution for SentrySPM to reproduce the issue. Added grpc-swift dependency as it's required to trigger the error. Refs #7281
philprime
requested review from
itaybre,
noahsmartin and
philipphofmann
as code owners
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨
Bug Fixes 🐛
Internal Changes 🔧Deps
Other
Other
🤖 This preview updates automatically when you update the PR. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| path: "Sources/Swift", | ||
| swiftSettings: [ | ||
| .unsafeFlags(["-enable-library-evolution"]) | ||
| // .unsafeFlags(["-enable-library-evolution"]) |
There was a problem hiding this comment.
Production library evolution flag accidentally disabled in main Package
High Severity
The -enable-library-evolution flag is being commented out in the main Package.swift, affecting the production SentrySwift target used by all SentrySPM consumers. This PR is described as adding a test sample to reproduce an issue, but this change modifies production code and disables Swift library evolution for the entire library. Library evolution provides ABI stability guarantees; disabling it could break binary compatibility for downstream consumers who depend on stable module interfaces.
| swift build --product cli-with-binary | ||
|
|
||
| exec-sandboxed-cli-with-binary: build-cli-with-binary | ||
| sandbox-exec -f sandbox.sb -- .build/arm64-apple-macosx/debug/cli-with-binary |
There was a problem hiding this comment.
Hardcoded arm64 architecture path excludes Intel Macs
Low Severity
The Makefile hardcodes .build/arm64-apple-macosx/debug/ paths for the executable targets. This path is architecture-specific and won't exist on Intel Macs, where Swift build output goes to .build/x86_64-apple-macosx/debug/ instead. The sample will fail to run on Intel-based macOS systems.
Additional Locations (1)
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7294 +/- ##
=============================================
- Coverage 85.038% 84.609% -0.429%
=============================================
Files 472 467 -5
Lines 28466 28355 -111
Branches 12475 12339 -136
=============================================
- Hits 24207 23991 -216
- Misses 4212 4315 +103
- Partials 47 49 +2 see 24 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
|
1 participant
Add a sample macOS CLI application to investigate app launch profiling failures in sandboxed environments.
Problem
When using the binary Sentry dependency in a sandboxed macOS CLI application, app launch profiling fails with permission errors when trying to create directories in
/Users/.../Library/Caches/. The error occurs because the sandbox restricts file system access.Investigation Setup
This PR adds a minimal reproduction sample with two executables:
cli-with-binary: Uses binary Sentry dependency (reproduces the error)cli-with-spm: Uses SentrySPM dependency (works correctly)The sample includes:
sandbox.sb) that denies access to/Usersdirectorygrpc-swiftas it's required to trigger the errorError Observed
When running
make exec-sandboxed-cli-with-binary, the following error occurs:The SPM version (
cli-with-spm) runs successfully without errors.Next Steps
This sample will help investigate why the binary dependency behaves differently from the SPM dependency in sandboxed environments and determine the appropriate fix.
Closes #7281