Signing to run locally does not work with network access

Question

Created Sep ’24

Replies 3

Boosts 0

Participants 2

I'm trying to sign an app to run locally because development provisioning does not work for unspecified reasons. I'm adding NSAllowsLocalNetworking to the app transport security section of the entitlements and the result is that the selection to sign the app locally vanishes from the signing section in Xcode. I need to access a local web application which does not provide HTTPS.

I'm not only very confused about this but actually pretty ******. Is this once again Apple playing games for absolutely no reason?

Why can't I build and run an application on my system that does not have to do anything with Apple, the app store, customers or anything? This is just for me and I cannot make it work.

Answered by DTS Engineer in 802509022

I'm adding NSAllowsLocalNetworking to the app transport security section of the entitlements and the result is that the selection to sign the app locally vanishes from the signing section in Xcode.

Interesting. What version of Xcode is this?

I tried to reproduce this and things worked as I expected:

Using Xcode 16.0b6, I created a new project from the macOS > App template.
In Signing & Capabilities, it defaulted to automatic signing with Development in the popup. I switched that off, leaving Sign to Run Locally configurad.
I added the App Transport Security Capability.
It doesn’t let you enable NSAllowsLocalNetworking, so I selected the Info.plist file and added that manually.
Back in Signing & Capabilities, Sign to Run Locally was still set.

Taking a step back:

development provisioning does not work for unspecified reasons.

It’s kinda important that you get this fixed. Sign to Run Locally can cause all sorts of weird issues. For example, you’ll likely encounter with local network privacy on macOS 15 (currently in beta).

… but:

I need to access a local web application which does not provide HTTPS.

You shouldn’t need to disable ATS to do that. Rather, it’s better to set up a test CA and have that issue your local server a certificate. You can then install your test CA’s root on the client, and you don’t need to mess around with ATS at all.

I talk about this in more detail in QA1948 HTTPS and Test Servers.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Sep ’24

Recommended

I'm adding NSAllowsLocalNetworking to the app transport security section of the entitlements and the result is that the selection to sign the app locally vanishes from the signing section in Xcode.

Interesting. What version of Xcode is this?

I tried to reproduce this and things worked as I expected:

Using Xcode 16.0b6, I created a new project from the macOS > App template.
In Signing & Capabilities, it defaulted to automatic signing with Development in the popup. I switched that off, leaving Sign to Run Locally configurad.
I added the App Transport Security Capability.
It doesn’t let you enable NSAllowsLocalNetworking, so I selected the Info.plist file and added that manually.
Back in Signing & Capabilities, Sign to Run Locally was still set.

Taking a step back:

development provisioning does not work for unspecified reasons.

It’s kinda important that you get this fixed. Sign to Run Locally can cause all sorts of weird issues. For example, you’ll likely encounter with local network privacy on macOS 15 (currently in beta).

… but:

I need to access a local web application which does not provide HTTPS.

You shouldn’t need to disable ATS to do that. Rather, it’s better to set up a test CA and have that issue your local server a certificate. You can then install your test CA’s root on the client, and you don’t need to mess around with ATS at all.

I talk about this in more detail in QA1948 HTTPS and Test Servers.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

j.weinert OP

Sep ’24

Unfortunately this trick didn't work for me. I'm currently not in a paid developer team and really just want to explore some ideas for myself. The local web application does not support HTTPS, which isn't great but theoretically not an issue in this particular case. As soon as I add NSAppTransportSecurity into my entitlements Xcode declines to build and requires me to select a signing certificate. When I manage signing automatically Xcode builds the app but that immediately exits with a

Message from debugger: Error 1

error. I'm currently running a really old version of Xcode (11.3) on Mojave for certain reasons.

0

Answer 3

DTS Engineer OP

Apple

Sep ’24

I'm currently not in a paid developer team

None of what we’ve been discussing so far requirements a paid membership. Specifically:

You can use Development code signing using a Personal Team, which you can get by signing in with any Apple ID.
The technique in QA1948 has no relationship to your Apple Developer Program status.
NSAppTransportSecurity is an Info.plist key, not an entitlement, and thus is unrelated to your code signing.

Apropos that last point, I suspect that’s where things are going wrong. You wrote:

As soon as I add NSAppTransportSecurity into my entitlements Xcode declines to build

That property belong is your Info.plist file, not your .entitlements file.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0