iOS 13 simulator test bundle entitlements requirements

[keith]

When using some API such as the shared keychain API you need entitlements in your app's binary that define the shared keychain groups you could access. If you hit this code in tests, previously with iOS <13 they would be fine and wouldn't cause an error. When running on an iOS 13 simulator you get the kErrSecMissingEntitlement error but on iOS 12.2 we get a errSecItemNotFound status instead (which makes sense for our clean simulator use case).

This seems to be because the test bundle has no entitlements. When running with xcodebuild, it produces a test bundle that contains the __TEXT,__entitlements section that has the keychain groups setup correctly (I have no idea where it gets this configuration from)

I've filed FB6799645 about this but this might be an intentional change, in which case we might have to support entitlements for test bundles. The alternative is using a test host app which has the correct entitlements.

[thomasvl]

How does stock Xcode configure the entitlements on the test bundle? Do they just set the file in the settings like they do for apps? Do they also sign the bundle or just insert the entitlements segment without signing?

[keith]

They insert the entitlements segment without signing

[keith]

Here's a sample project demonstrating the issue KeychainTestBundle.zip

If you run the tests of this project on an iOS 12 simulator, they pass, and if you run them on an iOS 13 simulator they hit the assert statement about the error. I've gotten a response on my feedback but it's still unclear to me if this behavior change is intentional so I've uploaded this project there as well.

[keith]

This was just confirmed in my feedback that this is an intentional change in the iOS 13 simulator such that entitlements / a test host is required. Since a test host is a viable solution here we might just want to close this and have that be the recommendation.

[sergiocampama]

That defeats the purpose of logic tests, so we should be looking at that in the following weeks. I'll file an internal issue to track this more closely, but that work around might be good enough until we have a better solution.

[keith]

Well this is only a problem if you're hitting one of these codepaths that seems to be affected by this, which I assume means only things that rely on entitlements. I'm not sure how much you'll hit that in logic tests (probably ideally never)