title: Sandboxing QtWebengine for apple store
body: <p>For the last 4 days I've been trying to publish my app in the apple store (which I've never done before). In it I use qt 5.12.1 with qtwebengine. But I really got stuck with sandboxing webengine because after sandboxing app won't even start. I followed this <a href="https://mediaarea.net/blog/2018/02/14/QtWebEngine-MacAppStore" rel="nofollow noreferrer">https://mediaarea.net/blog/2018/02/14/QtWebEngine-MacAppStore</a> initially without recompiling and changing webengine but afterwards doing this as well (Unsuccessfully though 'cause they used qt 5.9). I tried as well suggestions from this thread <a href="https://forum.qt.io/topic/102212/qtwebengine-signing-issues/4" rel="nofollow noreferrer">https://forum.qt.io/topic/102212/qtwebengine-signing-issues/4</a> but had no luck. So I thought maybe you guys could give me some tips on how could I do this. Here's my script for signing package.</p>
  
  <pre><code>echo SIGN PACKAGE
  # special case for QtWebEngineCore
  
  find dist/MyApp.app -name Info.plist -exec plutil -replace CFBundleIdentifier -string "com.MyApp.desktop" {} \;
  
  find dist/MyApp.app -name _CodeSignature -exec rm -fr {} \;
  find dist/MyApp.app -name "*.dSYM" -exec rm -fr {} \;
  
  # 1*
  
  for f in $(find dist/MyApp.app/Contents/Frameworks -name '*.framework' -type d)
  do
      codesign --force --verbose -s "3rd Party Mac Developer Application: MyApp (*)" $f
  done
  
  for f in $(find dist/MyApp.app/Contents -name '*.dylib' -type f)    
  do
      codesign --force --verbose -s "3rd Party Mac Developer Application: MyApp (*)" $f  
  done
  
  codesign --entitlements app/MyApp.entitlements -s "3rd Party Mac Developer Application: MyApp (*)" dist/MyApp.app/Contents/MacOS/MyAppUpdater
  codesign --entitlements app/MyApp.entitlements -s "3rd Party Mac Developer Application: MyApp (*)" dist/MyApp.app/Contents/MacOS/crashpad_handler
  
  # 2*
  codesign --force --verify --verbose -s "3rd Party Mac Developer Application: MyApp (*)" --entitlements app/MyApp.entitlements dist/MyApp.app 
  
  codesign --force --verify --verbose --sign "3rd Party Mac Developer Application: MyApp (*)" --identifier "com.MyApp.desktop" --entitlements app/webengine.entitlements dist/MyApp.app/Contents/Frameworks/QtWebEngineCore.framework/Helpers/QtWebEngineProcess.app
  
  # 3*
  codesign --entitlements app/MyApp.entitlements -s "3rd Party Mac Developer Application: MyApp (*)" dist/MyApp.app/Contents/MacOS/MyApp 
  </code></pre>
  
  <p>It is kinda mixture of all suggestions of those posts. Eventually I managed to get rid of all apple errors except of this one.</p>
  
  <pre><code>ITMS-90296: App sandbox not enabled - The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list: [( "com.MyApp.desktop.pkg/Payload/MyApp.app/Contents/MacOS/MyApp" )] Refer to App Sandbox page at https://developer.apple.com/devcenter/mac/app-sandbox/ for more information on sandboxing your app. 
  </code></pre>
  
  <p>The problem with it is if I move part where I sign webengine to (1*) I'll get my app through apple checks but it will crash. But if I leave it where it is right now I will receive error above. I had initially 3* above 2* and tried the combination of moving around webengine signature.</p>
  
  <p>For more details I will attach my MyApp.plist, MyApp.entitlements and webengine.entitlements below.
  I run macos mojave 10.14.3 on VirtualBox, qt 5.12.1</p>
  
  <p><strong>webengine.entitlements</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
  &lt;plist version="1.0"&gt;
  &lt;dict&gt;
      &lt;key&gt;com.apple.security.inherit&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.cs.disable-executable-page-protection&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  
  <p><strong>MyApp.plist</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
  &lt;plist version="1.0"&gt;
  &lt;dict&gt;
      &lt;key&gt;CFBundleDisplayName&lt;/key&gt;
      &lt;string&gt;MyApp&lt;/string&gt;
      &lt;key&gt;CFBundleExecutable&lt;/key&gt;
      &lt;string&gt;MyApp&lt;/string&gt;
      &lt;key&gt;CFBundleIdentifier&lt;/key&gt;
      &lt;string&gt;com.MyApp.desktop&lt;/string&gt;
      &lt;key&gt;CFBundleSpokenName&lt;/key&gt;
      &lt;string&gt;MyApp&lt;/string&gt;
      &lt;key&gt;CFBundleGetInfoString&lt;/key&gt;
      &lt;string&gt;blalba&lt;/string&gt;
      &lt;key&gt;CFBundleIconFile&lt;/key&gt;
      &lt;string&gt;MyApp.icns&lt;/string&gt;
      &lt;key&gt;CFBundlePackageType&lt;/key&gt;
      &lt;string&gt;APPL&lt;/string&gt;
      &lt;key&gt;LSMinimumSystemVersion&lt;/key&gt;
      &lt;string&gt;10.11&lt;/string&gt;
      &lt;key&gt;NSPrincipalClass&lt;/key&gt;
      &lt;string&gt;NSApplication&lt;/string&gt;
      &lt;key&gt;NSMicrophoneUsageDescription&lt;/key&gt;
      &lt;string&gt;Microphone is required for voice messages and calls&lt;/string&gt;
      &lt;key&gt;NSSupportsAutomaticGraphicsSwitching&lt;/key&gt;
      &lt;false/&gt;
      &lt;key&gt;CFBundleVersion&lt;/key&gt;
      &lt;string&gt;0.5.1225&lt;/string&gt;
      &lt;key&gt;CFBundleShortVersionString&lt;/key&gt;
      &lt;string&gt;0.5.1225&lt;/string&gt;
      &lt;key&gt;LSApplicationCategoryType&lt;/key&gt;
      &lt;string&gt;public.app-category.social-networking&lt;/string&gt;
      &lt;key&gt;NSHighResolutionCapable&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  
  <p><strong>MyApp.entitlements</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
  &lt;plist version="1.0"&gt;
  &lt;dict&gt;
      &lt;key&gt;com.apple.security.inherit&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  
  <p>I ran out of ideas and information of how to solve this problem. One more problem is that I've never published app in apple store before and I don't usually develop under macos as well. So everything is new to me(love it). And if I don't do this my team lead is going to hang me if I don't do this myself first. 
  So any help appreciated.</p>