Xcode 15 post archive script permission problems

I'm using this build script:

https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow/customizing_the_xcode_archive_process?language=objc

To create and notarize a dmg. In Xcode 15 it fails when calling /usr/bin/hdiutil create .... The fail error message is:

could not access /Volumes/Bike/Bike.app - Operation not permittedhdiutil: create failed - Operation not permitted

I have found that I can work around the problem by giving Xcode 15 full disk access. Is there a way that I can make my script run without having to give Xcode full disk access?

Accepted Reply

Machine restart seems to have fixed. Grrrrg. Wish I had tried that sooner!

Replies

What is /Volumes/Bike in this context?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Ok, I've got something that's reproducible on my machine: https://github.com/jessegrosjean/PostArchiveTest

    My post build script only works if:

    Give Xcode full disk accessOR don't use "Bike" as targets "Product Name".

    To be clear the script works, without giving Xcode full disk access, for all other product names that I've tried. Must be something special about Bike, seems likely to be only a problem on my machine. Looking for hints on how to figure out what's wrong and how to fix.

  • Oh...found fix. Machine restart!

Add a Comment

Thanks for your response. It inspired me to start over and create a demo project so that I could give you a simple example of exactly what was happening... and of course the demo project is working fine... dmgs are created and notarized by the post archive script without requiring that Xcode has full disk access.

I'm now in slow process of trying to figure what in the world is different between my real project and demo.

Will report back when I figure more what is going on.

What is /Volumes/Bike in this context?

I'm pretty sure it's something that hdiutil create is doing. My guess (without much actual knowledge) is that:

  1. My post archive script has access to /tmp, because it's able to create file/directories there
  2. hdiutil create creates an empty Bike.dmg file (I see this temporary show in the finder)
  3. hdiutil create then mounts that Bike.dmg file as Volumes/Bike
  4. When hdiutil create tries to copy content to that volume it fails because my script doesn't have access to that mounted volume?

Machine restart seems to have fixed. Grrrrg. Wish I had tried that sooner!