Problem Overview
I'm trying to upload an Electron app to the Mac App Store, but I keep hitting an error saying App Sandbox isn't enabled, and I haven't been able to resolve it.
Error Message
Validation failed (409)
App sandbox not enabled. The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list: [
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/Frameworks/Sonivium Helper (GPU).app/Contents/MacOS/Sonivium Helper (GPU)",
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/Frameworks/Sonivium Helper (Plugin).app/Contents/MacOS/Sonivium Helper (Plugin)",
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/Frameworks/Sonivium Helper (Renderer).app/Contents/MacOS/Sonivium Helper (Renderer)",
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/Frameworks/Sonivium Helper.app/Contents/MacOS/Sonivium Helper",
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/Library/LoginItems/Sonivium Login Helper.app/Contents/MacOS/Sonivium Login Helper",
"coiai.net.sonivium.pkg/Payload/Sonivium.app/Contents/MacOS/Sonivium"Environment
– **OS**: macOS (darwin 25.0.0)
– **Electron**: 39.2.7
– **electron-builder**: 25.1.8
– **App ID**: `coiai.net.sonivium`
– **Team ID**: `45J6U33V86`
Current Configuration
package.json (mas config)
"mas": {
"category": "public.app-category.utilities",
"icon": "logo/Output/macOS/AppIcon.appiconset/Icon-mac-512.png",
"hardenedRuntime": true,
"gatekeeperAssess": false,
"entitlements": "build/entitlements.mas.plist",
"entitlementsInherit": "build/entitlements.mas.plist",
"target": [
{
"target": "mas",
"arch": ["arm64", "x64"]
}
],
"bundleVersion": "1",
"extendInfo": {
"LSHasLocalizedDisplayName": true,
"CFBundleDevelopmentRegion": "ja",
"CFBundleURLName": "coiai.net.sonivium",
"ElectronTeamID": "45J6U33V86"
},
"electronLanguages": ["ja", "en"],
"identity": "Apple Distribution: Akira Hattori (45J6U33V86)",
"preAutoEntitlements": false
}build/entitlements.mas.plist
“`xml
<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<!– Entitlements for the App Store – App Sandbox is required –>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.device.audio-input</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
</dict>
</plist>
“`
Solutions Tried
1. entitlementsInherit setting
Initially I pointed this at a separate file (`entitlements.mas.child.plist`), but since the error persisted, I changed it to point at the same file as the main entitlements file.
“`json
“entitlementsInherit”: “build/entitlements.mas.plist”
“`
2. Checking the certificates
– ✅ **Apple Distribution**: present in the keychain, already specified in `package.json`
– ✅ **Mac Installer Distribution (3rd Party Mac Developer Installer)**: present in the keychain
– ⚠️ Doesn't show up under `security find-identity -v -p codesigning`, but does appear in Keychain Access
3. Build command
“`bash
npm run build:mas
“`
This generates a `.pkg` file under `release/mas-arm64/`.
4. Verifying code signing
I've explicitly specified `identity`:
“`json
“identity”: “Apple Distribution: Akira Hattori (45J6U33V86)”
“`
The Problem
1. **The entitlements are applied to the main app**, but **not to the helper apps**
2. Even though `entitlementsInherit` is set, `com.apple.security.app-sandbox` is not being applied to the helper apps
3. I'm using `electron-builder`'s `mas` target, but entitlements are not being correctly applied to the helper apps
What I've Checked
### Checking entitlements after the build
I checked the helper apps' entitlements with the following command, but haven't confirmed the result yet:
“`bash
codesign -d –entitlements – release/mas-arm64/Sonivium.app/Contents/Frameworks/Sonivium\ Helper\ \(GPU\).app/Contents/MacOS/Sonivium\ Helper\ \(GPU\)
“`
References
– [Electron official docs – Mac App Store Submission Guide](https://www.electronjs.org/ja/docs/latest/tutorial/mac-app-store-submission-guide)
– [electron-builder official docs](https://www.electron.build/)
– [Qiita – Registering an Electron app with the Mac App Store](https://qiita.com/bontaro_1/items/cbe29883900740eb9859)
What I Need Help With
1. **Why doesn't `entitlementsInherit` work?**
– What's the correct way to apply entitlements to helper apps using `electron-builder`'s `mas` target?
2. **Are there alternative approaches?**
– Is there a way to apply entitlements to helper apps outside of `electron-builder`'s configuration?
– Is there a way to apply entitlements manually after the build?
3. **Am I missing something in the configuration?**
– Is there anything missing from the `mas` settings in `package.json`?
– Is there anything missing from `entitlements.mas.plist`?
4. **Could this be an electron-builder version issue?**
– Are there any known issues with `electron-builder` 25.1.8?
– Has anyone resolved this with a different version?
5. **Compatibility with Electron 39.2.7**
– Are there any known issues with the combination of Electron 39.2.7 and `electron-builder` 25.1.8?
Additional Information
– The build succeeds and the `.pkg` file is generated
– Code signing also succeeds (since `identity` is specified)
– The upload to App Store Connect succeeds, but validation fails with an error
Request
I'd really appreciate any advice on resolving this issue, or hearing from anyone who's run into and solved a similar problem.
In particular, I'm looking for a concrete solution for reliably applying entitlements to an Electron app's helper apps using `electron-builder`'s `mas` target.