Code signing on macOS using com.apple.webinspector.allow entitlement

Question

chockenberry OP

Created Jan ’24

Replies 1

Boosts 0

Participants 2

I'm working on a macOS app that uses a JSContext and I want to debug it with the Safari Web Inspector.

According to Session 402 at WWDC 2016 the following entitlement is required:

	<key>com.apple.webinspector.allow</key>
	<true/>

This is easy enough to add, but it causes the app to crash at launch with a code signing issue. The console shows that taskgated-helper is reporting just before the crash:

Unsatisfied entitlements: com.apple.webinspector.allow

For anyone who finds this, here's what you need to know:

https://webkit.org/blog/13936/enabling-the-inspection-of-web-content-in-apps/

Basically, there's now a inspectable property on both the WKWebView and JSContext. Unfortunately, there's no mention of the old entitlement in the WebKit blog post, so it's impossible for folks using the old technique to find.

Hopefully this post will bridge this gap.

It also might be something for @eskimo to add to his (always helpful) code signing documentation.

-ch

Boost

Answer 1

DTS Engineer OP

Apple

Jan ’24

I’ve no idea what’s up with com.apple.webinspector.allow. AFAICT it’s a restricted entitlement and thus must be authorised by a provisioning profile. However, I can’t see any way to create a profile with that in its allowlist. I had a look in both Xcode’s Signing & Capabilities tab and in the Developer website App ID > Capabilities list and there’s nothing that seems even vaguely related to this.

AFAIK the only public entitlement related to Web Inspector is [com.apple.security.]get-task-allow, which is set on development-signed code and was what enabled Web Inspector prior to the advent of the shiny new isInspectable properties.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0