It seems that there are limitations in IPC between network system extensions and other apps in our product. The network extension is signed to use Developer ID.The network extension is NOT sandboxed. Nor are any other components.None of the components use App Groups. I tried the network extension with and without an app group with no luck.I have specified an NEMachServiceName and left it blank as well. Neither worked.At this point, it seems that it is being flat out denied by then system, but I don't can't find any documentation that suggests this is how it should be. The closest thing I have seen is that App Groups allow for sandboxed apps to talk (though XPC wasn't explicitly listed) and sandboxed to unsandboxed apps to talk. I do not want to put any of our apps in the sandbox, nor do I want to put all of our apps into an App Group either.Thanks!

I have been tasked to "try out" the instructions in the Jan 14 response from this post, and figure out how to integrate it into our development process. I thought I had done it correctly, but when I build I get this error :error: No certificate for team 'TeamName (Company)' matching 'Developer ID Application: TeamName' found: Select a different signing certificate for CODE_SIGN_IDENTITY, a team that matches your selected certificate, or switch to automatic provisioning. (in target 'AppName-macOS' from project 'AppName')The only explanation I have for this error is that when I created the provisioning profile, I chose may have chose the production certificate, which I do not have on my machine. I couldn't tell which certificate was which, they were all named similarly, so I chose the one whose date was furtherest out.Follow up question, is there any documentation on how to carry out this task via command line (codesign) tool? Production signing happens on a different machine on a different network, so we have a development certificate for everyday tasks and signing. This signing happens via command line.Thanks!

I want to make sure I understand the implications of some of the answers in the Network Entitlement FAQ post -> https://forums.developer.apple.com/thread/67613My current commercial enterprise-focused app uses the NKE APIs to protect the user from network threats. It is installed, updated and controlled by a management system built for the administration of the product. If we use the newly provided APIs from the Network Extensions, then it must be distributed by the Mac App Store? If we use these APIs we no longer control the installation/update of (at least) that portion of the product?Is this correct?