SPM Sandbox

Can some kind person point me to information on what the restrictions are in terms of the Package Manager and Sandboxing?

I spent a fruitless day trying to write a "Package.swift" script that I could drop into multiple folders, locally on my harddrive, and not have to custom edit at all. This is a pain in the butt to do the way I want, but it basically works... except when it comes to external packages (elsewhere on my local drive). It looks like there's some sort of sandboxing that allows FileManager to read and write folder,files,symlinks within the current package folder. But try to specify a Dependency programmatically, and it's "Package.resolved file is most likely severely out-of-date" errors.

The crazy thing here is that it appears a Package.swift file can programmatically overwrite itself. So I suppose I could use that as a workaround, and just update the file with the external paths I want. It's a clunky workaround though.

I would very much appreciate any information on what operations the Sandbox allows and forbids us from doing. Anyone point me in the right direction?

This thread may contain the answers you are looking for:

1 Like

Thanks, Jeremy. Grrr... sandboxed! To my surprise, having the manifest overwrite itself is less untenable than I had thought (Xcode instantly refreshes my Package.swift, and loads the appropriate external packages). Probably won't last long, though, considering it's not much less of a security issue :frowning:

So I made a reusable, dynamic "Package.swift" manifest with some fun features (like an option to rewrite itself as either a static version, or a dynamic version).

https://github.com/charlesism/SPM-DynamicManifest

I'm guessing Apple won't allow SPM to rewrite the manifest to disk like this forever. It's basically breaking out of the sandbox.