{"action":"created","issue":{"url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/20","repository_url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues","labels_url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/20/comments","events_url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/20/events","html_url":"https://github.com/zorgiepoo/sparkle-ui-xpc-issues/issues/20","id":143889661,"number":20,"title":"Review Sandbox Model","user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-03-28T04:33:33Z","updated_at":"2016-04-01T16:22:55Z","closed_at":null,"body":"Current model: sandbox[Application] -> xpc-not-sandboxed[Updater] -> privileged-app[Installer]\r\n\r\nDo we want this to also be possible: sandbox[Application & Updater] -> xpc-not-sandboxed[Some Updater Components] -> privileged-app[Installer]\r\n\r\nI'm thinking what falls under \"some updater components\" would be testing writability permissions for automatic updates, and possibly launching the AutoUpdate installer application. The latter would be easy to set up, but would have disadvantages: instability in the updater will affect the app, they must have shared entitlements/exceptions unless they're moved into more XPC components (hard), updater has to stay alive with the app even when idle.\r\n\r\nI think:\r\nsandbox[Application] -> xpc-sandbox[Updater] -> xpc-not-sandboxed[Some Updater Components] -> privileged-app[Installer]\r\n\r\nwould be another possibility, but maybe too difficult. For starters, the updater wouldn't be able to read the bundle from the application as they're sandboxed and different processes.\r\n\r\nThe simplicity of our current model (the entire of the updater not being sandboxed) means we don't have any XPC services in our framework, but it is a rather large portion of un-sandboxed code.."},"comment":{"url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/comments/204458682","html_url":"https://github.com/zorgiepoo/sparkle-ui-xpc-issues/issues/20#issuecomment-204458682","issue_url":"https://api.github.com/repos/zorgiepoo/sparkle-ui-xpc-issues/issues/20","id":204458682,"user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T16:22:55Z","updated_at":"2016-04-01T16:22:55Z","body":"> From my understanding of my fork (tried with a sandbox app) : The downloading, the extracting, validating is done within the sandbox. This is not a problem as the extraction is performed within the sandbox container (Caches).\r\n\r\nThe reason why previous sandbox forks were rejected from being merged into Sparkle are because the \"extracting, validating, installation\" are not done in the same process. If AutoUpdate doesn't do the extraction and validation, then it's trusting whatever comes before it, which is the problem.\r\n\r\n> What I was surprised (I agree with you) is the Autoupdate is not dying when the old app is terminated. Which was a surprise for me. As the AutoUpdate, launched by the XPC linked to the old app should die too.\r\n\r\nI would test by doing a sleep(20) somewhere in AutoUpdate to really be certain that it may not automatically die off when spawned as a task.\r\n\r\n> The launchd helper (sandboxed) yes can use XPC APIs. I'm using this architecture (for another purpose) in one of my app.\r\n\r\nYep. Like above, the launchd helper can't trust whatever is communicating to it though. I have tested the `SMJobBless()` samples out before; basically anything can communicate to the helper (only during installing the tool, code signature verification may be checked). Apple's sample code touches on this topic too."}}