title: Error while implementing Sandbox: "deny file-read-metadata /Library"
body: <p>I realize that I'm a bit late to the game here in getting sandbox-ready, but so it goes.</p>
  
  <p>I'm developing for OS X 10.9. The app displays Calendar event data, but does not allow editing, so I have enabled the Calendars capability.</p>
  
  <p>The app works great with sandboxing enabled when I run it from Xcode, but when I export it signed with Developer ID, the app runs, but can't access the Calendar data. What's more, the system never asks me to allow the app to access Calendar data.</p>
  
  <p>When I run the app, it launches, but doesn't show any data. In Console, sandboxd throws a bunch of errors that look like this:</p>
  
  <p><code>sandboxd: ([54]) appleeventsd(54) deny file-read-metadata /Library</code> </p>
  
  <p>and </p>
  
  <p><code>sandboxd: ([54]) appleeventsd(54) deny mach-lookup com.apple.ocspd</code></p>
  
  <p>I've checked the app's entitlements with <code>codesign -d --entitlements</code>, and it confirms that it's Sandboxed and has calendar entitlements. However, when I check in-app to see if it has permission to access <code>[EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent]</code>, it, unsurprisingly given it has never asked, returns <code>EKAuthorizationStatusNotDetermined</code>.</p>
  
  <p>I feel like I am missing something pretty basic here regarding entitlements, code signing, or deployment, but I'm at a loss to find out what it is. And so I throw myself on your collective mercy and wisdom.</p>