Swift shell with embedded Python helper over XPC in a sandboxed app
Parent: Mac App Store Readiness: Residual Gaps for Sandboxed Monitors · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for Swift shell with embedded Python helper over XPC in a sandboxed app. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- Python-Apple-support's macOS framework is a relocatable re-bundling of the official macOS build with IDLE, Tkinter and turtle removed and the App Store compliance patch applied; its main branch builds Python 3.15, with 3.11-3.13 on branches, for macOS 11+ on x86_64 and arm64. (low confidence) (verified as of 2026-10-02) [source]
Problems, failure modes and limitations
- com.apple.security.inherit does not apply to XPC services: they keep a separate sandbox and container, so a service cannot read files in the host app bundle unless the app passes access (a plain bookmark worked where security-scoped bookmarks failed in the 2016 write-up). (medium confidence) (verified as of 2016-08-17) [source]
Comparisons and alternatives
- For XPC helpers under App Sandbox, the app and helper both need app-sandbox enabled, and early guidance paired it with a shared application-groups entitlement; mach-lookup is denied by default in a sandbox, though that write-up concerned a login-item helper rather than an embedded XPC service. (low confidence) (verified as of 2015-01-17) [source]
Facts and statements
- XPC services are bundles in Contents/XPCServices of the app bundle, are private to the containing app, and each has its own sandbox and entitlements; by default they run in the most restricted environment, and a service must be code-signed for its entitlements to apply. (medium confidence) [source]
- launchd launches XPC services on demand, restarts them after a crash, and kills idle ones with SIGKILL, so a Python helper must be designed stateless or minimal-state; a crash mid-request invalidates the app's connection until launchd restarts the service. Elevating a service to root is unsupported. (low confidence) [source]
- A child tool (NSTask/posix_spawn) that inherits the parent's sandbox must use exactly two sandbox entitlements, com.apple.security.app-sandbox and com.apple.security.inherit; any other sandbox entitlement aborts the child. Xcode 9 injected get-task-allow, which broke inheritance; workarounds were Export Archive or re-signing, and the later Xcode setting CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO addresses it. (low confidence) (verified as of 2017-09-01) [source]
- Embedding the Python interpreter as a signed framework (BeeWare Python-Apple-support Python.xcframework plus python-stdlib, loaded via PythonKit or the C API) avoids removing the sandbox or disabling library validation; every .so in the stdlib must be re-signed with the team ID and hardened runtime, and PYTHONHOME/PYTHONPATH must be set before Py_Initialize(). (medium confidence) (verified as of 2022-12-03) [source]
- Python 3.12+ ships the string 'itms-services' in Lib/urllib/parse.py, which Apple's automated scan flagged under Guideline 2.5.2 and rejected macOS and iOS apps bundling Python; CPython added a --with-app-store-compliance configure option (PR #120984, refined in #121947) and backported it to 3.12 and 3.13. (medium confidence) (verified as of 2026-10-02) [source]
Children
- No children recorded.