[net6][Catalyst] Testflight published app fails to start with `security policy does not allow @ path expansion`

[jeromelaban]

Steps to Reproduce

1. Publish a Catalyst app to TestFlight

Expected Behavior

Application starts up properly

Actual Behavior

-------------------------------------
Translated Report (Full Report Below)
-------------------------------------

Process:               Calculator.Mobile [80989]
Path:                  /Applications/Calculator.Mobile.app/Contents/MacOS/Calculator.Mobile
Identifier:            uno.platform.calculator-canary
Version:               1.2.5 (868)
App Item ID:           1617866830
Code Type:             X86-64 (Native)
Parent Process:        launchd [1]
User ID:               504

Date/Time:             2022-04-06 23:08:26.2482 -0400
OS Version:            macOS 12.3 (21E230)
Report Version:        12
Bridge OS Version:     6.4 (19P4242)
Anonymous UUID:        


Time Awake Since Boot: 1400000 seconds

System Integrity Protection: enabled

Crashed Thread:        0

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace DYLD, Code 1 Library missing
Library not loaded: @executable_path/../MonoBundle/libSystem.IO.Compression.Native.dylib
Referenced from: /Applications/Calculator.Mobile.app/Contents/MacOS/Calculator.Mobile
Reason: tried: '/usr/lib/libSystem.IO.Compression.Native.dylib' (no such file), (security policy does not allow @ path expansion)
(terminated at launch; ignore backtrace)

Application Specific Information:
Library not loaded: @executable_path/../MonoBundle/libSystem.IO.Compression.Native.dylib
Referenced from: /Applications/Calculator.Mobile.app/Contents/MacOS/Calculator.Mobile
Reason: tried: '/usr/lib/libSystem.IO.Compression.Native.dylib' (no such file), (security policy does not allow @ path expansion)


Thread 0 Crashed:
0   dyld                          	       0x109f710de __abort_with_payload + 10
1   dyld                          	       0x109f87212 abort_with_payload_wrapper_internal + 80
2   dyld                          	       0x109f87244 abort_with_payload + 9
3   dyld                          	       0x109f3576f dyld4::halt(char const*) + 375
4   dyld                          	       0x109f315a5 dyld4::prepare(dyld4::APIs&, dyld3::MachOAnalyzer const*) + 3995
5   dyld                          	       0x109f304d4 start + 388


Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x0000000002000209  rbx: 0x0000000000000000  rcx: 0x00007ff7b86705c8  rdx: 0x00007ff7b8670a30
  rdi: 0x0000000000000006  rsi: 0x0000000000000001  rbp: 0x00007ff7b8670610  rsp: 0x00007ff7b86705c8
   r8: 0x00007ff7b8670630   r9: 0x0000000000000000  r10: 0x000000000000009e  r11: 0x0000000000000246
  r12: 0x000000000000009e  r13: 0x00007ff7b8670a30  r14: 0x0000000000000001  r15: 0x0000000000000006
  rip: 0x0000000109f710de  rfl: 0x0000000000000246  cr2: 0x0000000109f37e74
  
Logical CPU:     0
Error Code:      0x02000209 
Trap Number:     133


Binary Images:
       0x109f2b000 -        0x109f96fff dyld (*) <dd9e80de-fb3b-349b-96a4-46874ad34d11> /usr/lib/dyld

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=2964K resident=0K(0%) swapped_out_or_unallocated=2964K(100%)
Writable regions: Total=9220K written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=9220K(100%)

Environment

• Catalyst 15.2.303-rc.1.55
• Azure Devops agent macos-11

Build Logs

I can provide a binlog on request.

Example Project (If Possible)

I don't have a simple repro project, but a larger project, if that's useful.

[rolfbjarne]

I don't have a simple repro project, but a larger project, if that's useful.

Yes, please, anything we can use the reproduce this would be useful.

[jeromelaban]

Here's the project csproj I'm using to get there, for catalyst specifically:
https://github.com/unoplatform/calculator/blob/canaries/dev/src/Calculator.Mobile/Calculator.Mobile.csproj#L110-L144

[spouliot]

my quick guess...

Publish a Catalyst app to TestFlight

It's a released (TestFlight) app and Catalyst requires the use of (full) AOT and static builds (unless a user .framework is used).

Library not loaded: @executable_path/../MonoBundle/libSystem.IO.Compression.Native.dylib

In such case you should not have a .dylib being referenced from the main native executable.

So having a security policy error make sense - even if the exact error message is not very helpful to diagnose the issue.

[jeromelaban]

Thanks @spouliot! I searched for some AOT options for catalyst, and assuming that it's closer to Xamarin.Mac, would AOTMode=All be enough? (I'm currently trying it out, I'll report if it helps).

[spouliot]

@jeromelaban I have not closely followed lately but it should be closer to the iOS settings/options since it shares the same restrictions (like requiring full AOT).

[jeromelaban]

@rolfbjarne So from what I can see, the only configuration which enforces AOT is arm64, and in my case, it's an x64 build.

https://github.com/xamarin/xamarin-macios/blob/9c185e1fff40f49746c42e3888244b2ef3e7ff62/dotnet/targets/Xamarin.Shared.Sdk.targets#L867-L877

Are there options to build with AOT for both x64 and arm64?

[jeromelaban]

I've tried forcing _RunAotCompiler to true, but it's not helping and I'm getting the same runtime error. I'm using the maccatalyst-x64 RID.

[rolfbjarne]

I'm having some trouble reproducing the issue, but could you attach the .ipa you uploaded to Test Flight?

It would also be nice to have the exact commands to build the Mac Catalyst project from a clean checkout.

I also believe these properties might be able to work around the problem, can you try this and see if it works?

<_LibMonoLinkMode>Static</_LibMonoLinkMode>
<_LibXamarinLinkMode>Static</_LibXamarinLinkMode>

[jeromelaban]

Thanks! I've tried again, and it does not seem to help (the AOT compiler is not being run). Here's a full binlog of what I'm trying to build: 14686-20220422-build.zip

[rolfbjarne]

Thanks! I've tried again, and it does not seem to help (the AOT compiler is not being run). Here's a full binlog of what I'm trying to build: 14686-20220422-build.zip

Those two properties won't run the AOT compiler, instead they will make the build use static (.a) libraries instead of dynamic (.dylib) libraries, so this won't happen:

Library not loaded: @executable_path/../MonoBundle/libSystem.IO.Compression.Native.dylib

because the dylib won't be there (and the main executable won't have a reference to it).

If the app still fails with these properties, please attach a new crash report.

[jeromelaban]

Ah! Got it, thanks. I'll let the app through testflight and will let you know.

[emorell96]

I am working on a MAUI .NET app and on MacCatalyst I have the same issue found here. I am guessing MAUI uses this under the hood for maccatalyst support.

The thing that started causing this was when I added an Entitlements.plist file to make it work with MSAL.

The file contains this:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>keychain-access-groups</key>
  <array>
    <string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
  </array>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
</dict>
</plist>

The property group doing the signing:

<PropertyGroup Condition="$(TargetFramework.Contains('-mac')) and '$(Configuration)' == 'Release'">
		<!-- <RuntimeIdentifier>ios-arm64</RuntimeIdentifier> -->
			<!-- Only needed when you have a need for entitlements -->
<ProvisionType>Manual</ProvisionType>
			<EnableAssemblyILStripping>false</EnableAssemblyILStripping>
		<CodesignEntitlement>Entitlements.plist</CodesignEntitlement>
		<CodesignKey>Apple Development: Your name</CodesignKey>
		<CodesignProvision>Your provision</CodesignProvision>
	</PropertyGroup>

Using static linking got it to build and run. Thanks!