Unable to get app-scoped bookmark for file - OS X sandbox

Question

I've been scouring the net and Apple help for some sort of guidance on this and coming up short. I wonder if anyone has run into a similar situation, or might have some insight into what is (or isn't) happening.

I'm trying to obtain an app-scoped bookmark for a file to be recalled in a later session by the application. I can confirm that the path itself is properly added to the sandbox after being selected by the user, because I can open (and reopen) it during the session when it is selected.

However, trying to obtain a security-scoped bookmark to access it later isn't working.

Here's what I'm doing:

NSURL *url = [[NSURL alloc] initFileURLWithPath:path];
NSError *error = nil;
NSData *bookmarkData = [url
           bookmarkDataWithOptions:(1UL << 11) //NSURLBookmarkCreationWithSecurityScope
           includingResourceValuesForKeys:nil
           relativeToURL:nil
           error:&error];
[url release];

I've tried it both with url generated from the string path as well as just testing it with, for instance, the result of the NSSavePanel's URL. (The string path is, for legacy reasons, the one I'd like to be able to use.)

I'm having to use the value for bookmarkDataWithOptions instead of the constant because, for reasons of some other legacy code, I'm forced to compile with the 10.6 SDK where NSURLBookmarkCreationWithSecurityScope isn't available.

I can confirm that path points to the file in question as "/Users/me/Documents/document.ext", and that the NSURL seems to initialize properly (or at least reflects that same path).

The application includes the entitlement com.apple.security.files.bookmarks.app-scope.

Anyway, this doesn't work. That code results in both a bookmarkData of 0x0 and an error of 0x0, and the console shows: ScopedBookmarkAgent: Failed to retrieve app-scope key, aborting.

If I change relativeToURL to be url instead of nil and change the entitlement to com.apple.security.files.bookmarks.document-scope, then it seems to work properly — that is, bookmarkData at least gets a non-zero value and no error gets logged. But I'm pretty sure that's not what I want (i.e., a document-scope bookmark).

Is there something obvious I'm doing wrong?

Answer 1

To my everlasting shame, it was my fault.

Somehow in moving the project to a different machine for testing and debugging, code-signing for the Development build got turned off.

Apparently this causes things to (almost) silently fail, with no error code and only a cryptic message in the console, and no other indication that anything else isn't working properly.

Leaving this up here in case someone else mistakenly does the same thing.

Answer 2

Hello 2019 and beyond Googlers. I encountered the same issue and fixed it by redoing my development certs. Simply uncheck the "Automatically manage signing" and recheck (maybe switch to a different team and switch back).