NSUpdateSecurityPolicy AllowProcesses where and how to add Items

Hi, in the video wwdc2022-10096 at about 05:45 it is explained how to allow other software to update your software by adding team-idetifiers an signing-identifiers to an Info.plist. I would need a few more details.

  1. Which Info.plist file do I have to change?

I use pkgbuild to build the packages and productbuild to combine them. pkgbuild --analyse --root generates an .plist-file for every single package. Do I have to add the Information there? productbuild --sythesize generates an xml-file discribing the whole thing. This would refer better to the installer as a whole, but it is not an info.plist.

  1. How and where exactly to add the information?

I tried to use plutil, but it doesn't like array-names to start with numbers as team-identifiers often do. Also it crashes quite often. The .plist-files generated by pkgbuild either contain an empty array or several unnamed items.

[

]

Do I even need to add something threre? The other one contains several Items: [

  0 => {

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Library/PreferencePanes/***.prefPane"

  }

  1 => {

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Library/Frameworks/***.framework"

  }

  2 => {

    "BundleHasStrictIdentifier" => 1

    "BundleIsRelocatable" => 0

    "BundleIsVersionChecked" => 1

    "BundleOverwriteAction" => "upgrade"

    "NSUpdateSecurityPolicy" => {

      "AllowProcesses" => {

        "123ABC" => [

          0 => "com.example.pal.about"

        ]

      }

    }

    "RootRelativeBundlePath" => "Applications/***.app"

  }

]

Should it look like this? A more detailed example would be great. Thanks!

Replies

If no one knows, guessing would be appreciated as well. Or maybe a link to some useful documentation.

Came across your post, while trying to identify when an app is using this key.

You probably found this by now, but if not, here you go: https://developer.apple.com/documentation/bundleresources/information_property_list/nsupdatesecuritypolicy

It suggests just letting Xcode do the work for you (using the Info tab) in terms of placement and population of the dictionary.

Hope it all works out for your app.