What is the new option ENABLE_USER_SCRIPT_SANDBOXING in Xcode 15?

Question

After downloading the Xcode 15 beta and running my project, I get a warning to update the project to recommended settings with

Enable User Script Sandboxing

Enabling user script sandboxing is recommended to ensure correctness of the build. This will enable the ENABLE_USER_SCRIPT_SANDBOXING build setting.

What are the implications? When should it enabled/disabled? What if I have i.e. SwiftGen set as a build phase?

Answer 1

If it gives problems for your project, you can simply change ENABLE_USER_SCRIPT_SANDBOXING = YES back to NO in project.pbxproj if needed. In the Xcode GUI it is a boolean pick list or ASCII text (depending what you select for "open as".

I tried the recommended YES setting on my own project, but I got complaints that my case (SwiftLint) was trying to read some non-Swift files. These were .git, .github, projectname.xcodeproj and a file related to string localisation. Clearly none of these 4 files were .swift files, so SwiftLint was over-zealous in opening these 4 files. And Xcode was more-or-less right to cause the build to fail when SwiftLint runs in a sandbox.

Surprisingly, I didn't find others complaining about this yet. But I expect SwiftLint will address this during the Xcode 14 beta phase.

Where to change the setting, and the error messages that I got. Ignore the 6779 number - probably a line number rather than an error code

Answer 2

User Script Sandboxing Setting name: ENABLE_USER_SCRIPT_SANDBOXING

If enabled, the build system will sandbox user scripts to disallow undeclared input/output dependencies.

A typical error like this:

Sandbox: swiftlint(97252) deny(1) file-read-data /YourProject/.swiftlint.yml

is solved with

Input Files
$(SRCROOT)/.swiftlint.yml

But for a whole list of files you can do

Input File Lists
$(SRCROOT)/inputFiles.xcfilelist

which you can create with

find . \( -name "*.swift" -o -name ".swiftlint.yml" \) > inputFiles.xcfilelist

But this is still a problem, how can you create the list of files on every compilation?