Cannot build due to com.apple.developer.web-browser entitlement

[fuomag9]

Checklist

• Using latest version on the App Store
• Read the docs
• Searched for existing GitHub issues

Configuration

None relevant

Describe the bug

I cannot build due to

Provisioning profile "iOS Team Provisioning Profile: com.examplferfver4gfrgte.app" doesn't include the com.apple.developer.web-browser entitlement.

I should be able to disable the need to use the browser entitlement

[smorkin]

Is this entitlement needed? According to Apple docs, https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_web-browser, this is for apps which can act as the default web browser on iOS, so e.g. Mozilla mobile uses it (see this bug, mozilla-mobile/focus-ios#1781, where they deal with the same issue).

[carloscabanero]

This entitlement is needed for Blink Code. You can remove it and compile without it. Just take into account that you will have to use a tunnel if you use Blink Code with remote servers.

[recipedude]

Rather than remove the entitlement, how does one resolve the build error reported (getting same error here) by enabling the entitlement?

[recipedude]

Following up on this, I created a non-Xcode managed profile. In the Edit your App ID Configuration section I ticked off every Capability I possibly could. I then created a provisioning profile using those the "everything" Identifier, downloaded and selected that provisioning profile in Xcode.

And still get the error:
Provisioning profile "BlinkMy IOS with Everything" doesn't include the com.apple.developer.system-extension.install and com.apple.developer.web-browser entitlements.

How the heck does one get those required entitlements added?

[carloscabanero]

We had to get a special permission from Apple to actually enable those entitlements and get them to work.

[recipedude]

Ah, lovely - well I did submit a bug report to Apple about an hour ago on this due to the failure of the “Xcode provisioning to provision” :). Have a feeling the response won’t be a fast as yours though! 👍

[tedserreyn]

Ok so how does one actually remove the WEB provisioning to compile this?

[romapires]

Search for com.apple.developer.web-browser in the xcode.
It's a Boolen key in Blink/Blink.entitlements set to YES (or true in plain text).

The key must be removed, it's not enough to invert it.

[carloscabanero]

Does anybody know if we can wrap this under a flag? So it doesn’t have to be removed every time?

[romapires]

I compiled Blink yesterday with a personal team. Great app btw!

I found out many Capabilities don't work with a personal team, namely the services with these keys in the Entitlements file:

• aps-environment
• com.apple.developer.associated-domains
• com.apple.developer.icloud-container-identifiers
• com.apple.developer.icloud-services
• com.apple.developer.ubiquity-container-identifiers
• com.apple.developer.ubiquity-kvstore-identifier
• com.apple.developer.user-fonts
• com.apple.developer.web-browser

The fix I see, and can contribute with by tomorrow, is:

1. Add a PERSONAL_TEAM = FALSE to template_setup.xcconfig
2. Add a Build Script named something like "Personal Team Entitlements fix" that
   1. Checks the env for PERSONAL_TEAM = TRUE
   2. Checks if PlistBuddy exists (its from command line tools but… you never know)
   3. Uses PlistBuddy to delete the offending keys from Blink.entitlements

Going forward, the usages of the these Capabilities could be wrapped with #if CAN_USE_capabilityName … #endif defined by negating PERSONAL_TEAM.

Does that look ok to you?

[carloscabanero]

That sounds good from my side. I like that the default for the script is to do nothing (even not running) and then we can define flags going forward, or even separate on different files if necessary.

Thanks a lot!