undefined | Better HN

0 pointsHHad37y ago0 comments

The documentation mentions that an entitlement is required. However, this only implies that an Apple account is needed and the yearly dev fee is to be paid. Entitlements work outside of the App Store too.

Personally I'm happy to see WireGuard in the App Store, but would be concerned if Apple indeed limits the API to it. Could you elaborate on if distribution outside of the App Store is impossible?

0 comments

3 comments · 1 top-level

zx2c47y ago· 2 in thread

Check it out: https://data.zx2c4.com/network-extension-is-mac-app-store-on...

HHad3OP7y ago

Indeed! Color me surprised.

I have tried to reproduce the issue and found that even though you can create provisioning profiles for direct distribution with the Network Extension entitlement, and the UI shows that all is fine, the provisioning profile does NOT contain the required entitlement.

After some digging I found a FAQ on network extensions by Apple [1]. Point #8 clearly says:

> #8 — On the Mac, can Developer ID apps host Network Extension providers?

> Currently this is not possible; only Mac App Store apps can host Network Extension providers.

Thus the missing entitlement is most likely not a bug (and the cert UI is just bad). This is not a technical limitation, just Apple with questionable politics.

[1] https://forums.developer.apple.com/thread/67613

mrpippy7y ago

I suspect the reasoning is to prevent malware/spyware from setting up an always-on VPN without the user’s permission (i.e. the recent Facebook/Onavo scandal). Without using NetworkExtension, a kext is needed (which now require fairly obnoxious user consent). And using NetworkExtensiom essentially requires Apple’s approval.

j / k navigate · click thread line to collapse