Crashlytics does not upload dSYMs when ENABLE_USER_SCRIPT_SANDBOXING is set

[mickmaccallum]

Description

Hello,

I recently debugged an issue with my dSYMs not being automatically uploaded to Crashlytics, which was not one of the cases covered by the support documentation. I found that enabling the ENABLE_USER_SCRIPT_SANDBOXING build setting causes the symbol uploads to stop working. Xcode prompts you to update this setting when upgrading a project to Xcode 15/16.

The upload-symbols script seems to fail under this setting because it operates in the background and not within the user script sandbox. Furthermore, since the script runs in the background, you must observe logs related to the failure in the Console app instead of Xcode.

I am bringing this to your attention in case more obvious errors can be surfaced within Xcode for failures like this.

Additionally, I see comments here that describe the upload happening in the background to improve build time. I would be willing to pass a flag to this script to choose to wait for the uploads within the build phase if it meant more clarity when things went wrong.

Thanks!

Reproducing the issue

1. Create a new Firebase project and matching Xcode project. Complete Crashlytics setup in the new project.
2. Enable ENABLE_USER_SCRIPT_SANDBOXING in the project settings.
3. Open Console.app, and start streaming logs. Filter for upload-symbols
4. Archive your project. Look in the build logs and see that the upload symbols build phase was successful.
5. Look back at the console logs and note that there are errors like Sandbox: upload-symbols deny(1). No new dSYM entries will be added in the Crashlytics dashboard.
6. Disable the ENABLE_USER_SCRIPT_SANDBOXING setting and repeat. Symbols will successfully upload.

Firebase SDK Version

11.9.0

Xcode Version

16.2.0

Installation Method

Swift Package Manager

Firebase Product(s)

Crashlytics

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

{
  "originHash" : "2c3cd5c4464f73a40da856ac7f3b393e789fbb91428116898d4cc76989daa037",
  "pins" : [
    {
      "identity" : "abseil-cpp-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/abseil-cpp-binary.git",
      "state" : {
        "revision" : "bbe8b69694d7873315fd3a4ad41efe043e1c07c5",
        "version" : "1.2024072200.0"
      }
    },
    {
      "identity" : "app-check",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/app-check.git",
      "state" : {
        "revision" : "21fe1af9be463a359aaf8d96789ef73fc3760d09",
        "version" : "11.0.1"
      }
    },
    {
      "identity" : "checkout-sheet-kit-swift",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/Shopify/checkout-sheet-kit-swift",
      "state" : {
        "revision" : "054485a9399d610d596e079c36dbd190891def34",
        "version" : "3.1.2"
      }
    },
    {
      "identity" : "firebase-ios-sdk",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/firebase-ios-sdk.git",
      "state" : {
        "revision" : "eb523407e4293568ed55590728205c359cbecc5b",
        "version" : "11.9.0"
      }
    },
    {
      "identity" : "googleappmeasurement",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleAppMeasurement.git",
      "state" : {
        "revision" : "d80e25104abe76d69a134d4ec18f011edd8df06c",
        "version" : "11.9.0"
      }
    },
    {
      "identity" : "googledatatransport",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleDataTransport.git",
      "state" : {
        "revision" : "617af071af9aa1d6a091d59a202910ac482128f9",
        "version" : "10.1.0"
      }
    },
    {
      "identity" : "googleutilities",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleUtilities.git",
      "state" : {
        "revision" : "53156c7ec267db846e6b64c9f4c4e31ba4cf75eb",
        "version" : "8.0.2"
      }
    },
    {
      "identity" : "grpc-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/grpc-binary.git",
      "state" : {
        "revision" : "cc0001a0cf963aa40501d9c2b181e7fc9fd8ec71",
        "version" : "1.69.0"
      }
    },
    {
      "identity" : "gtm-session-fetcher",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/gtm-session-fetcher.git",
      "state" : {
        "revision" : "a2ab612cb980066ee56d90d60d8462992c07f24b",
        "version" : "3.5.0"
      }
    },
    {
      "identity" : "interop-ios-for-google-sdks",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/interop-ios-for-google-sdks.git",
      "state" : {
        "revision" : "040d087ac2267d2ddd4cca36c757d1c6a05fdbfe",
        "version" : "101.0.0"
      }
    },
    {
      "identity" : "leveldb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/leveldb.git",
      "state" : {
        "revision" : "a0bc79961d7be727d258d33d5a6b2f1023270ba1",
        "version" : "1.22.5"
      }
    },
    {
      "identity" : "mobile-buy-sdk-ios",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/Shopify/mobile-buy-sdk-ios",
      "state" : {
        "revision" : "5c76a102ceeb9ee89fb3d9a98723309dc097754b",
        "version" : "13.1.1"
      }
    },
    {
      "identity" : "nanopb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/nanopb.git",
      "state" : {
        "revision" : "b7e1104502eca3a213b46303391ca4d3bc8ddec1",
        "version" : "2.30910.0"
      }
    },
    {
      "identity" : "promises",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/promises.git",
      "state" : {
        "revision" : "540318ecedd63d883069ae7f1ed811a2df00b6ac",
        "version" : "2.4.0"
      }
    },
    {
      "identity" : "swift-protobuf",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-protobuf.git",
      "state" : {
        "revision" : "edb6ed4919f7756157fe02f2552b7e3850a538e5",
        "version" : "1.28.1"
      }
    },
    {
      "identity" : "swiftsoup",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/scinfu/SwiftSoup.git",
      "state" : {
        "revision" : "64e4daa41b0f22affa94a6063d509c137c26909c",
        "version" : "2.8.5"
      }
    }
  ],
  "version" : 3
}

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[themiswang]

Hey @mickmaccallum,

Can you check if you have the list of input files mentioned in this doc. If you are using sandboxing for user script you have to list all the input files the script needs to access otherwise the script cannot access those files.

[mickmaccallum]

Hey @themiswang,

My input files list is as follows:

• ${DWARF_DSYM_FOLDER_PATH}/${DWARF_DSYM_FILE_NAME}
• ${DWARF_DSYM_FOLDER_PATH}/${DWARF_DSYM_FILE_NAME}/Contents/Resources/DWARF/${PRODUCT_NAME}
• ${DWARF_DSYM_FOLDER_PATH}/${DWARF_DSYM_FILE_NAME}/Contents/Info.plist
• $(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/GoogleService-Info.plist
• $(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)
• ${DWARF_DSYM_FOLDER_PATH}/${DWARF_DSYM_FILE_NAME}/Contents/Resources/DWARF/${PRODUCT_NAME}.debug.dylib

Looking at my build log, DWARF_DSYM_FOLDER_PATH and DWARF_DSYM_FILE_NAME are defined as follows:

• DWARF_DSYM_FILE_NAME=My App.app.dSYM
• DWARF_DSYM_FOLDER_PATH=/Users/mick/Library/Developer/Xcode/DerivedData/MyApp-blqlaaqpvyoutterxpkhfexkuawy/Build/Products/Debug-iphonesimulator

But looking at the --debug output from the upload-symbols script, it looks like my app's dSYMs actually are at the path:
/Users/mick/Library/Developer/Xcode/DerivedData/MyApp-blqlaaqpvyoutterxpkhfexkuawy/Build/Intermediates.noindex/ArchiveIntermediates/MyApp/BuildProductsPath/Release-iphoneos/My App.app.dSYM

So I guess the issue isn't just that the ENABLE_USER_SCRIPT_SANDBOXING setting is set and that the actual location of my dSYMs isn't in the input files list.