Sandbox app for the Mac App Store with Qt 5.8 and QtWebEngineProcess

Wolosocu

I was finally able to get my app to run in sandbox mode with Qt 5.6.2. I have not tried 5.7 yet, but I did have to reduce the version of QtQuick I was using from 2.7 to 2.6. Luckily I am not using any 2.7 specific features.

I was also able to get my app past the Application Loader portion of the app submission. It hasn't been approved yet but we'll see.

I wanted to mention a few things for anyone else that might have a problem with this.

macdeployqt's -codesign option did NOT work. The only way I was able to sign my app correctly was to write a script that manually walked through my app bundle and called codesign on every binary with the entitlements I wanted/needed.
macdeployqt also seems to create a lot of *.dSYM files. This is something I noticed in with 5.8 as well and Apple's Application Loader will reject these. I didn't pay much attention to the error but I just made sure my packaging script deleted them (before signing).
QtWebProcessEngine.app 's Info.plist file needs to be changed before you sign it. The CFBundleIdentifier needs to match that of your signature.

Like I said, my app has only passed Application Loader's loading process. I've had problems in the past with Qt and the App Store system (see http://stackoverflow.com/questions/25694066/submitting-qt-5-3-app-for-review-on-mac-app-store) before I could even submit the app for review, so I'm skeptical that I'm out of the woods yet.

I'll keep this thread updated.

Wolosocu

Attempting Qt 5.7.1 brought its own problem. Namely that on startup the application gives the error:

This application failed to start because it could not find or load the Qt platform plugin "cocoa"
in "".

Available platform plugins are: cocoa.

Reinstalling the application may fix this problem.
Abort trap: 6

I did a little research and tried a couple minor things but nothing worked.

Meanwhile my app was rejected because of an unused sandbox permission. So I've corrected that and resubmitted a new build still using Qt 5.6.2.

Really wish I had been able to get 5.8 to work or even 5.7.

SGaist

That strange, do you have a qt.conf file in your application bundle ?

Wolosocu

@SGaist Yes.

So, my app was rejected using Qt 5.6.2 because of the following:

Your app uses or references the following non-public API(s):

framework: '/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit'
: NSAccessibilityUnregisterUniqueIdForUIElement
: _NSAppendToKillRing
: _NSDrawCarbonThemeBezel
: _NSDrawCarbonThemeListBox
: _NSInitializeKillRing
: _NSNewKillRingSequence
: _NSPrependToKillRing
: _NSSetKillRingToYankedState
: _NSYankFromKillRing

framework: '/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices'
: CGSSetDenyWindowServerConnections
: CGSShutdownServerConnections
: CTFontCopyDefaultCascadeList

The use of non-public APIs is not permitted on the App Store as it can lead to a poor user experience should these APIs change.

Which looks like this is addressed by this: https://doc.qt.io/qt-5/qtwebengine-platform-notes.html#mac-app-store-compatibility

So I tried Qt 5.7 again and for whatever reason it didn't crash this time! However, it has the same exact problem I was seeing with Qt 5.8.

I have built and rebuilt and rebuilt QtWebEngine and yet I still cannot get it to work. Is there anyway to verify that my build of QtWebEngine is actually applying the use_appstore_compliant_code flag?

It seems like this has been a problem for a while: https://bugreports.qt.io/browse/QTBUG-41611

SGaist

The symbol problem is pretty surprising, are you sure you are using your build of the QtWebEngine module that is app store compliant ?

Wolosocu

@SGaist said in Sandbox app for the Mac App Store with Qt 5.8 and QtWebEngineProcess:

The symbol problem is pretty surprising, are you sure you are using your build of the QtWebEngine module that is app store compliant ?

I was using 5.6.2. Should I build 5.6.2 QtWebEngine with the use_appstore_compliant_code?

Wolosocu

@SGaist I'm back to trying Qt 5.8 again. I've gone so far as to manually copy over QtWebEngineCore.framework that is in my build folder and I'm getting the same results:

4/26/17 20:33:04.000 kernel[0]: Sandbox: QtWebEngineProce(86853) deny(1) mach-lookup org.chromium.Chromium.rohitfork.86852
4/26/17 20:33:04.019 QtWebEngineProcess[86853]: [0426/203304:ERROR:mach_port_broker.mm(43)] bootstrap_look_up: Permission denied (1100)
4/26/17 20:33:04.000 kernel[0]: Sandbox: QtWebEngineProce(86854) deny(1) mach-lookup org.chromium.Chromium.rohitfork.86852
4/26/17 20:33:04.020 QtWebEngineProcess[86854]: [0426/203304:ERROR:mach_port_broker.mm(43)] bootstrap_look_up: Permission denied (1100)
4/26/17 20:33:04.000 kernel[0]: Sandbox: QtWebEngineProce(86854) deny(1) forbidden-sandbox-reinit
4/26/17 20:33:04.000 kernel[0]: Sandbox: QtWebEngineProce(86853) deny(1) forbidden-sandbox-reinit

Again, is there anyway by inspecting the QtWebEngineCore.framework to make sure is being built with the app store compliant code?

Wolosocu

Just built QtWebEngine again on 5.8 and made sure to use the QtWebEngineCore.framework that just got built. No luck.

I see the use_appstore_compliant_code config item was added in Qt 5.7. Guess I'll try building that and see if I have any luck. Heck, I may even try 5.9 at this point just to see.

Seriously, has anyone successfully published an app that uses QtWebEngine to the MAS?

Wolosocu

Built 5.7 with use_appstore_compliant_code and am getting the same errors from my app:

4/27/17 07:10:53.000 kernel[0]: Sandbox: QtWebEngineProce(20764) deny(1) mach-lookup org.chromium.Chromium.rohitfork.20763
4/27/17 07:10:53.000 kernel[0]: Sandbox: QtWebEngineProce(20765) deny(1) mach-lookup org.chromium.Chromium.rohitfork.20763
4/27/17 07:10:53.627 QtWebEngineProcess[20764]: [0427/071053:ERROR:mach_broker_mac.mm(52)] bootstrap_look_up: Permission denied (1100)
4/27/17 07:10:53.627 QtWebEngineProcess[20765]: [0427/071053:ERROR:mach_broker_mac.mm(52)] bootstrap_look_up: Permission denied (1100)
4/27/17 07:10:53.000 kernel[0]: Sandbox: QtWebEngineProce(20764) deny(1) forbidden-sandbox-reinit

Are there any apps on the MAS that use Qt 5.x and QtWebEngine?

SGaist

That I don't know.

This thread might link to some clues that could help untangle your situation.

Wolosocu

@SGaist Thank you for trying to help. I discovered that link a few days ago while researching this problem. It did lead me to add the com.apple.security.application-groups entitlement to my app's entitlements file but the problem persists.

I am beginning to wonder if this is a problem with QtWebEngineProcess. I have posted this issue to the QtWebEngine mailing list but so far there has been no response.

I'm at a loss. :(

Wolosocu

As an alternative, is it possible to invoke C++ from a QtWebView? At this point I'm thinking of abandoning QtWebEngine altogether, though I would really like to avoid that.

SGaist

Do you mean from the QtWebView module ?

Wolosocu

@SGaist Yes. That does not use QtWebEngineProcess correct?

What I need is for a link in the HTML of the control to invoke some C++. I'm able to do this in QtWebEngine with QWebChannel. From what I've read, QtWebView doesn't really support that but maybe it's possible?

SGaist

No it doesn't use it.

AFAIK, QtWebView uses the platform native web views so it should be able to run with the QWebChanne module. Note that I haven't personally tested that combo but it's well worth a shot since it will likely make your application more lightweight.

BeastBurst

@Wolosocu said in Sandbox app for the Mac App Store with Qt 5.8 and QtWebEngineProcess:

QtWebEngineProce

@Wolosocu did you manage to overcome this issue? If so how ?

QtWS: Super Early Bird Tickets Available!

Sandbox app for the Mac App Store with Qt 5.8 and QtWebEngineProcess