title: cocoa sandbox embedded command line not work
body: <p>I have a third-party command line tool that launches from a main cocoa app which will be distributed in Mac App Store.</p>
  
  <p>I need to sandbox the third-party command line tool, but when I run it (with NSTask), it crashes with error </p>
  
  <blockquote>
    <p>“Application Specific Signatures: Container object initialization failed: failed to get bundleid for app XXX” </p>
  </blockquote>
  
  <p>(In the Console I can see the following error message).
  Here is what I do in the main cocoa app:</p>
  
  <pre><code>NSTask* task          = [[NSTask alloc]init];
  NSString* commandPath = [[[NSBundle mainBundle] resourcePath] stringByAppendingPathComponent:@"command"];
  task.launchPath       = commandPath;
  [task setArguments:args];
  [task launch];
  </code></pre>
  
  <p>And every time I run this, There’s a popup window appears with the information “OS X needs to repair your Library to run applications. Type youre password to allow this.” I’ve signed this command line tool using the command: </p>
  
  <pre><code>codesign --entitlements ./XXX.entitlements -s "3rd Party Mac Developer Application: XXX" ./commandlinetool 
  </code></pre>
  
  <p>To make sure, I double checked it using this command:</p>
  
  <pre><code>codesign --display --entitlements - ./commandlinetool  
  </code></pre>
  
  <p>Here is the information :</p>
  
  <pre><code>&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
  &lt;plist version="1.0"&gt;
  &lt;dict&gt;
      &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.files.downloads.read-write&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.files.user-selected.read-write&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.network.client&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  
  <p>I also checked through this command:</p>
  
  <pre><code>codesign --display --verbose=4 XXX
  </code></pre>
  
  <p>and got this information:</p>
  
  <pre><code>Identifier=com.XXX.XXX.XXX
  Format=Mach-O thin (x86_64)
  CodeDirectory v=20100 size=75902 flags=0x0(none) hashes=3786+5 location=embedded
  Hash type=sha1 size=20
  CDHash=24fdcb9b5444a91f60xxxxx3a66bafa7030109e63fb1c
  Signature size=4347
  Authority=3rd Party Mac Developer Application: XXX
  Authority=Apple Worldwide Developer Relations Certification Authority
  Authority=Apple Root CA
  Signed Time=May 10, 2014, 12:04:34 PM
  Info.plist=not bound
  Sealed Resources=none
  Internal requirements count=1 size=216
  </code></pre>
  
  <p>I also try to add an info.plist file to the command line tool, stepped by this chapter <a href="https://stackoverflow.com/questions/12959958/how-to-sandbox-a-command-line-tool">enter link description here</a> but nothing happened, the result of Info.plist still is "no bound".</p>
  
  <p>How to sandbox third-party command line tool and how to add an info.plist file to the command line tool? Did I miss something?
  Is there anybody can help me on this? Any help or pointer will be very much appreciated.</p>