Fix EventKit permissions in signed Dayline apps - #61
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
dayline-website | 658eaad | Aug 02 2026, 08:28 PM |
📝 WalkthroughWalkthroughThe app now declares the EventKit calendar entitlement. Development and release signing apply this entitlement and verify it in the final signed app bundles. ChangesCalendar entitlement signing
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review: Fix EventKit permissions in signed Dayline appsVerdict: Approve. Well-scoped fix with fail-closed validation and contract-test coverage. What's good
Notes / minor suggestions
No bugs found that should block merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
script/app_bundle_contract_test.sh (1)
50-56: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd negative checks for Sparkle nested entitlements.
The new assertions inspect only
DEV_APPandRELEASE_APP. The PR contract also requires privacy entitlements to stay off Sparkle nested code. Add checks forSparkle.framework,Versions/B/Autoupdate, andVersions/B/Updater.appin both bundles. Otherwise, a nested signing regression can pass the current assertions. Apple requires nested code to be signed and validated separately from the host app. (developer.apple.com)Suggested assertions
+assert_no_eventkit_entitlement "$DEV_APP/Contents/Frameworks/Sparkle.framework" +assert_no_eventkit_entitlement "$DEV_APP/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate" +assert_no_eventkit_entitlement "$DEV_APP/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app" +assert_no_eventkit_entitlement "$RELEASE_APP/Contents/Frameworks/Sparkle.framework" +assert_no_eventkit_entitlement "$RELEASE_APP/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate" +assert_no_eventkit_entitlement "$RELEASE_APP/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"Also applies to: 117-117, 143-143
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@script/app_bundle_contract_test.sh` around lines 50 - 56, Extend the contract checks around assert_eventkit_entitlement to verify that Sparkle.framework, Versions/B/Autoupdate, and Versions/B/Updater.app within both DEV_APP and RELEASE_APP do not contain the privacy entitlements. Keep the existing host-app assertions unchanged and apply the negative checks to each nested code object so nested signing regressions fail the contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Resources/Dayline.entitlements`:
- Around line 5-6: Add EventKit usage-description entries to the final app
bundle’s generated Info.plist, including NSCalendarsFullAccessUsageDescription
and NSRemindersFullAccessUsageDescription, so calendar and Reminders access
requests are supported. Configure the app target’s plist generation or bundle
settings rather than only updating Resources/Dayline.entitlements.
---
Nitpick comments:
In `@script/app_bundle_contract_test.sh`:
- Around line 50-56: Extend the contract checks around
assert_eventkit_entitlement to verify that Sparkle.framework,
Versions/B/Autoupdate, and Versions/B/Updater.app within both DEV_APP and
RELEASE_APP do not contain the privacy entitlements. Keep the existing host-app
assertions unchanged and apply the negative checks to each nested code object so
nested signing regressions fail the contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7e7cca9c-8bd4-4dab-9bd6-193c4e2b1bdc
📒 Files selected for processing (4)
Resources/Dayline.entitlementsscript/app_bundle_contract_test.shscript/build_and_run.shscript/package_release.sh
Review: Fix EventKit permissions in signed Dayline appsVerdict: Approve. Focused, fail-closed fix. I verified the full scripts (not just the diff); What's correct
On the CodeRabbit findings
Minor notes
No blocking bugs. |
Review: Fix EventKit permissions in signed Dayline appsVerdict: Approve. Correctly scoped fix with fail-closed verification. I checked out the branch and validated all three scripts ( What's correct
On the CodeRabbit findings
Minor notes
No blocking bugs found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer swift buildDEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer swift test(109 tests)DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer ./script/app_bundle_contract_test.shcom.apple.security.personal-information.calendars = truebash -n script/*.shgit diff --check origin/mainNo release is included in this PR.