Enable sandboxing

Vienna Tests/DirectoryMonitorTests.swift

@@ -44,31 +44,31 @@ class DirectoryMonitorTests: XCTestCase {
 
     var testExpectation: XCTestExpectation?
 
-    override func setUp() {
-        super.setUp()
+    override func setUpWithError() throws {
+        try super.setUpWithError()
 
         // Set the test expectation.
         testExpectation = expectation(description: "The monitor's event handler is called")
 
         // Create the temp directory.
-        XCTAssertNoThrow(try fileManager.createDirectory(at: tempDirectory, withIntermediateDirectories: false))
+        tempDirectory = try fileManager.url(for: .itemReplacementDirectory, in: .userDomainMask, appropriateFor: fileManager.applicationScriptsDirectory, create: true)
 
         // Create the monitor.
         monitor = DirectoryMonitor(directories: [tempDirectory])
     }
 
-    override func tearDown() {
+    override func tearDownWithError() throws {
         // Deinitialize the monitor and reset the failsafe.
         monitor = nil
         hasHandlerBeenCalled = false
 
         // Delete the temp directory.
-        XCTAssertNoThrow(try fileManager.removeItem(at: tempDirectory))
+        try fileManager.removeItem(at: tempDirectory)
 
         // Unset the test expectation.
         testExpectation = nil
 
-        super.tearDown()
+        try super.tearDownWithError()
     }
 
     // MARK: Test methods
@@ -167,7 +167,7 @@ class DirectoryMonitorTests: XCTestCase {
 
     let fileManager = FileManager.default
 
-    let tempDirectory = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent(ProcessInfo.processInfo.globallyUniqueString, isDirectory: true)
+    var tempDirectory: URL!
 
     var tempDirectoryItemCount: Int {
         return (try? fileManager.contentsOfDirectory(at: tempDirectory, includingPropertiesForKeys: nil))?.count ?? -1

Vienna Tests/ExportTests.swift

@@ -21,6 +21,21 @@ import XCTest
 
 class ExportTests: XCTestCase {
 
+    var tempURL: URL!
+
+    override func setUpWithError() throws {
+        try super.setUpWithError()
+
+        let downloadsDirectory = FileManager.default.downloadsDirectory
+        tempURL = try FileManager.default.url(for: .itemReplacementDirectory, in: .userDomainMask, appropriateFor: downloadsDirectory, create: true)
+    }
+
+    override func tearDownWithError() throws {
+        try FileManager.default.removeItem(at: tempURL)
+
+        try super.tearDownWithError()
+    }
+
     /// Test helper method to return an array of folders for export
     func foldersArray() -> [Any] {
         guard let database = Database.shared else {
@@ -35,24 +50,16 @@ class ExportTests: XCTestCase {
     func testExportWithoutGroups() {
         // Test exporting feeds to opml file without groups
         let folders = self.foldersArray()
-        guard let tmpUrl = URL(string: "/tmp/vienna-test-nogroups.opml") else {
-            XCTAssertTrue(false)
-            fatalError("cannot happen")
-        }
-
-        let countExported = Export.export(toFile: tmpUrl.absoluteString, from: folders, in: nil, withGroups: false)
+        let tmpUrl = tempURL.appendingPathComponent("vienna-test-nogroups.opml", isDirectory: false)
+        let countExported = Export.export(toFile: tmpUrl.path, from: folders, in: nil, withGroups: false)
         XCTAssertGreaterThan(countExported, 0, "Pass")
     }
 
     func testExportWithGroups() {
         // Test exporting feeds to opml file without groups
         let folders = self.foldersArray()
-        guard let tmpUrl = URL(string: "/tmp/vienna-test-groups.opml") else {
-            XCTAssertTrue(false)
-            fatalError("cannot happen")
-        }
-
-        let countExported = Export.export(toFile: tmpUrl.absoluteString, from: folders, in: nil, withGroups: true)
+        let tmpUrl = tempURL.appendingPathComponent("vienna-test-groups.opml", isDirectory: false)
+        let countExported = Export.export(toFile: tmpUrl.path, from: folders, in: nil, withGroups: true)
         XCTAssertGreaterThan(countExported, 0, "Pass")
     }
 

Vienna Tests/NSFileManagerExtensionTests.swift

@@ -26,11 +26,14 @@ class NSFileManagerExtensionTests: XCTestCase {
 
     func testApplicationScriptsPath() throws {
         let result = FileManager.default.applicationScriptsDirectory
-        let fullPath = "\(homePath)/Library/Scripts/Applications/Vienna"
+        let userDirectory = try FileManager.default.url(for: .userDirectory, in: .localDomainMask, appropriateFor: nil, create: false)
+            .appendingPathComponent(NSUserName(), isDirectory: true)
+        let bundleID = try XCTUnwrap(bundleID)
+        let fullPath = "\(userDirectory.path)/Library/Application Scripts/\(bundleID)"
         XCTAssertEqual(result.path, fullPath)
     }
 
-    func testApplicationSupportPath() throws {
+    func testApplicationSupportPath() {
         let result = FileManager.default.applicationSupportDirectory
         let fullPath = "\(homePath)/Library/Application Support/Vienna"
         XCTAssertEqual(result.path, fullPath)
@@ -43,7 +46,7 @@ class NSFileManagerExtensionTests: XCTestCase {
         XCTAssertEqual(result.path, fullPath)
     }
 
-    func testDownloadsPath() throws {
+    func testDownloadsPath() {
         let result = FileManager.default.downloadsDirectory
         let fullPath = "\(homePath)/Downloads"
         XCTAssertEqual(result.path, fullPath)

Vienna.xcodeproj/project.pbxproj

@@ -160,6 +160,7 @@
 		F6164C591E32A6660086261C /* DisclosureView.m in Sources */ = {isa = PBXBuildFile; fileRef = F6164C581E32A6660086261C /* DisclosureView.m */; };
 		F61CEA661F039E57009C878E /* ButtonToolbarItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F61CEA651F039E56009C878E /* ButtonToolbarItem.swift */; };
 		F61CEA681F03F277009C878E /* PlugInToolbarItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F61CEA671F03F277009C878E /* PlugInToolbarItem.swift */; };
+		F6209C4423D3B87C00D5537D /* container-migration.plist in Resources */ = {isa = PBXBuildFile; fileRef = F6209C4323D3B87C00D5537D /* container-migration.plist */; };
 		F6209C5A23D3FFA700D5537D /* Vienna.sdef in Resources */ = {isa = PBXBuildFile; fileRef = F6209C5923D3FFA700D5537D /* Vienna.sdef */; };
 		F6257FF51E28485F0035E43C /* Downloads.xib in Resources */ = {isa = PBXBuildFile; fileRef = F6257FF71E28485F0035E43C /* Downloads.xib */; };
 		F625801C1E2853B90035E43C /* ActivityViewer.xib in Resources */ = {isa = PBXBuildFile; fileRef = F625801E1E2853B90035E43C /* ActivityViewer.xib */; };
@@ -212,6 +213,7 @@
 		F6B355DB256025D3008CA1ED /* PreferenceTabViewItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F6B355DA256025D3008CA1ED /* PreferenceTabViewItem.swift */; };
 		F6B3561525616313008CA1ED /* DownloadItem.m in Sources */ = {isa = PBXBuildFile; fileRef = F6B3561425616313008CA1ED /* DownloadItem.m */; };
 		F6B7BC3624A2A9A40051D76F /* FMDB in Frameworks */ = {isa = PBXBuildFile; productRef = F6B7BC3524A2A9A40051D76F /* FMDB */; };
+		F6C9B03A26E6F3E0003C1058 /* undo-container-migration.sh in Copy Shared Support Files */ = {isa = PBXBuildFile; fileRef = F668C10E26886CB6009AD505 /* undo-container-migration.sh */; };
 		F6C9DA70271BB3BB00FC3027 /* RSSFeed.m in Sources */ = {isa = PBXBuildFile; fileRef = F6C9DA6F271BB3BB00FC3027 /* RSSFeed.m */; };
 		F6C9DA73271BB55000FC3027 /* AtomFeed.m in Sources */ = {isa = PBXBuildFile; fileRef = F6C9DA72271BB55000FC3027 /* AtomFeed.m */; };
 		F6CE47131E7E3DCB0045EAD7 /* ActivityItem.m in Sources */ = {isa = PBXBuildFile; fileRef = F6CE47121E7E3DCB0045EAD7 /* ActivityItem.m */; };
@@ -260,6 +262,7 @@
 			files = (
 				B27CD00C1100E728001F3C83 /* Plugins in Copy Shared Support Files */,
 				AA67F353089728AD008BBC37 /* Styles in Copy Shared Support Files */,
+				F6C9B03A26E6F3E0003C1058 /* undo-container-migration.sh in Copy Shared Support Files */,
 			);
 			name = "Copy Shared Support Files";
 			runOnlyForDeploymentPostprocessing = 0;
@@ -349,8 +352,8 @@
 		3A7BD0DB1989AC7700E9444B /* VNAVerticallyCenteredTextFieldCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VNAVerticallyCenteredTextFieldCell.h; sourceTree = "<group>"; };
 		3A7BD0DC1989AC7700E9444B /* VNAVerticallyCenteredTextFieldCell.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = VNAVerticallyCenteredTextFieldCell.m; sourceTree = "<group>"; };
 		3A8D9AE225A9DA4B0016F30F /* ArticleTests.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ArticleTests.swift; sourceTree = "<group>"; };
-		3A932D8823BB999A009B8061 /* Vienna.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Vienna.entitlements; sourceTree = "<group>"; };
-		3A932D8923BB999A009B8061 /* ViennaDeployment.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = ViennaDeployment.entitlements; sourceTree = "<group>"; };
+		3A932D8823BB999A009B8061 /* Development.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Development.entitlements; sourceTree = "<group>"; };
+		3A932D8923BB999A009B8061 /* Deployment.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Deployment.entitlements; sourceTree = "<group>"; };
 		3AC411A426BBFDFD004A8700 /* WebKitArticleView.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = WebKitArticleView.swift; sourceTree = "<group>"; };
 		3ADBA70C23DDAFCA00156722 /* Notarize.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = Notarize.sh; sourceTree = "<group>"; };
 		430C4ADB1661753F0079C9FC /* autorevision.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = autorevision.h; sourceTree = "<group>"; };
@@ -469,6 +472,7 @@
 		F6164C581E32A6660086261C /* DisclosureView.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = DisclosureView.m; sourceTree = "<group>"; };
 		F61CEA651F039E56009C878E /* ButtonToolbarItem.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; lineEnding = 0; path = ButtonToolbarItem.swift; sourceTree = "<group>"; };
 		F61CEA671F03F277009C878E /* PlugInToolbarItem.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; lineEnding = 0; path = PlugInToolbarItem.swift; sourceTree = "<group>"; };
+		F6209C4323D3B87C00D5537D /* container-migration.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "container-migration.plist"; sourceTree = "<group>"; };
 		F6209C5923D3FFA700D5537D /* Vienna.sdef */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; lineEnding = 0; path = Vienna.sdef; sourceTree = "<group>"; usesTabs = 1; };
 		F6232EF72B4B402F00D01D2A /* sv */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = sv; path = sv.lproj/Predicates.strings; sourceTree = "<group>"; };
 		F6257FF61E28485F0035E43C /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/Downloads.xib; sourceTree = "<group>"; };
@@ -538,6 +542,7 @@
 		F64C2CCA1E83825D00ED4E04 /* DateFormatterExtension.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateFormatterExtension.h; sourceTree = "<group>"; };
 		F64C2CCB1E83825D00ED4E04 /* DateFormatterExtension.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = DateFormatterExtension.m; sourceTree = "<group>"; };
 		F65F2313294E4B5200605F06 /* SeparatorPredicateEditorRowTemplate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SeparatorPredicateEditorRowTemplate.swift; sourceTree = "<group>"; };
+		F668C10E26886CB6009AD505 /* undo-container-migration.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; lineEnding = 0; path = "undo-container-migration.sh"; sourceTree = "<group>"; };
 		F66A7E542A019006002F5D5E /* fr */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = fr; path = fr.lproj/Predicates.strings; sourceTree = "<group>"; };
 		F672876624A2D20A0043432F /* UpdatePreferencesViewController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UpdatePreferencesViewController.h; sourceTree = "<group>"; };
 		F672876724A2D2170043432F /* UpdatePreferencesViewController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = UpdatePreferencesViewController.m; sourceTree = "<group>"; };
@@ -963,6 +968,7 @@
 				F63DA1741F1CF04F007CBED4 /* Lists */,
 				F63DA1721F1CEFC3007CBED4 /* Strings */,
 				03F33D951DF2A2F900B04FAF /* Assets.xcassets */,
+				F6209C4323D3B87C00D5537D /* container-migration.plist */,
 				F6209C5923D3FFA700D5537D /* Vienna.sdef */,
 			);
 			path = Resources;
@@ -993,6 +999,7 @@
 			children = (
 				B27CCFFD1100E728001F3C83 /* Plugins */,
 				AA67F32E089727FB008BBC37 /* Styles */,
+				F668C10E26886CB6009AD505 /* undo-container-migration.sh */,
 			);
 			path = SharedSupport;
 			sourceTree = "<group>";
@@ -1123,8 +1130,8 @@
 				F63DA16E1F1CEC69007CBED4 /* Resources */,
 				F63DA1751F1CF182007CBED4 /* SharedSupport */,
 				430C4AE0166175C20079C9FC /* Info.plist */,
-				3A932D8823BB999A009B8061 /* Vienna.entitlements */,
-				3A932D8923BB999A009B8061 /* ViennaDeployment.entitlements */,
+				3A932D8823BB999A009B8061 /* Development.entitlements */,
+				3A932D8923BB999A009B8061 /* Deployment.entitlements */,
 				3A6CC18623BBA49D0084ABEE /* Codesigning.xcconfig */,
 			);
 			path = Vienna;
@@ -1540,6 +1547,7 @@
 				F6D572B71E26AAA100CDA909 /* RSSFeed.xib in Resources */,
 				F6832F631F10C4C9007920D4 /* ExportAccessoryViewController.xib in Resources */,
 				AACAEA3E0954E71100ACD502 /* DemoFeeds.plist in Resources */,
+				F6209C4423D3B87C00D5537D /* container-migration.plist in Resources */,
 				F65D6D711E74619E00A30974 /* Credits.rtf in Resources */,
 				F685D24C292460210097C0D3 /* Predicates.strings in Resources */,
 				F6A7DE4F1E471A7F0017BE5E /* Vienna.help in Resources */,
@@ -2350,7 +2358,7 @@
 				APPLY_RULES_IN_COPY_FILES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GENERATE_ASSET_SYMBOL_FRAMEWORKS = AppKit;
-				CODE_SIGN_ENTITLEMENTS = Vienna/Vienna.entitlements;
+				CODE_SIGN_ENTITLEMENTS = Vienna/Development.entitlements;
 				CODE_SIGN_IDENTITY = "-";
 				COMBINE_HIDPI_IMAGES = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -2398,7 +2406,7 @@
 				APPLY_RULES_IN_COPY_FILES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GENERATE_ASSET_SYMBOL_FRAMEWORKS = AppKit;
-				CODE_SIGN_ENTITLEMENTS = Vienna/ViennaDeployment.entitlements;
+				CODE_SIGN_ENTITLEMENTS = Vienna/Deployment.entitlements;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEPLOYMENT_POSTPROCESSING = YES;
 				ENABLE_HARDENED_RUNTIME = YES;

Vienna/ViennaDeployment.entitlements → Vienna/Deployment.entitlements

@@ -2,10 +2,18 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
 	<key>com.apple.security.automation.apple-events</key>
 	<true/>
 	<key>com.apple.security.files.bookmarks.app-scope</key>
 	<true/>
+	<key>com.apple.security.files.downloads.read-write</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
 	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
 	<array>
 		<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>

Vienna/Vienna.entitlements → Vienna/Development.entitlements

@@ -2,12 +2,20 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
 	<key>com.apple.security.automation.apple-events</key>
 	<true/>
 	<key>com.apple.security.cs.disable-library-validation</key>
 	<true/>
 	<key>com.apple.security.files.bookmarks.app-scope</key>
 	<true/>
+	<key>com.apple.security.files.downloads.read-write</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
 	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
 	<array>
 		<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>

Vienna/Info.plist

@@ -141,7 +141,7 @@
 	<key>SUEnableAutomaticChecks</key>
 	<true/>
 	<key>SUEnableInstallerLauncherService</key>
-	<false/>
+	<true/>
 	<key>SUPublicEDKey</key>
 	<string>nPwwT+poO5Kmi1NZkE5OveKB8lvQVY20N22E8jgxLCg=</string>
 	<key>UTExportedTypeDeclarations</key>

Vienna/Resources/container-migration.plist

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>MigrateScriptsForApplication</key>
+	<string>Vienna</string>
+	<key>Move</key>
+	<array>
+		<array>
+			<string>${Caches}/${BundleId}/WebKit</string>
+			<string>${Caches}/WebKit</string>
+		</array>
+		<string>${Caches}/${BundleId}</string>
+		<array>
+			<string>${ApplicationSupport}/Vienna/Sources</string>
+			<string>${Caches}/${BundleId}/Sources</string>
+		</array>
+		<string>${ApplicationSupport}/Vienna</string>
+		<string>${Library}/HTTPStorages/${BundleId}</string>
+		<array>
+			<string>${Library}/HTTPStorages/${BundleId}.binarycookies</string>
+			<string>${Library}/Cookies/Cookies.binarycookies</string>
+		</array>
+		<array>
+			<string>${Library}/Cookies/${BundleId}.binarycookies</string>
+			<string>${Library}/Cookies/Cookies.binarycookies</string>
+		</array>
+		<string>${Library}/Saved Application State/${BundleId}.savedState</string>
+		<array>
+			<string>${Library}/WebKit/${BundleId}</string>
+			<string>${Library}/WebKit</string>
+		</array>
+		<array>
+			<string>${Library}/WebKit/Databases/___IndexedDB/${BundleId}</string>
+			<string>${Library}/WebKit/Databases/___IndexedDB</string>
+		</array>
+	</array>
+</dict>
+</plist>