Swift Build Plugin permission prompts

Using Swift
1

I've recently shipped a feature that uses a Swift Package Manager build-tool plugin. Overall, the experience is great, it works essentially trouble-free. With one exception, that is.

My build-tool plugin works within all of the "sandbox" restrictions placed around build tool plugins (i.e. no network access, no reading from the filesystem outside the project files, no writing except to the plugin work directory). I request no exceptions to these restrictions, and I don't attempt to violate any of them.

(Here is a link to the plugin in question:)

But I've found that even though the build-tool plugin works completely within these sandbox restrictions, my users still get prompted with the "approve this plugin" prompt when they build their project in Xcode for the first time. My questions:

  • Is there a way I can change my package or plugin configuration to avoid this warning? Would it help if the plugin was used in the same package where it was defined? (In this case, I control both packages.)
  • Is it actually intended that a build tool plugin that operates without exceptions to SPM's sandboxing requires special permissions at compile-time and extra steps to enable on CI systems?
  • From a larger perspective, if this is indeed expected behavior, why is this warning even necessary? The warning Xcode puts up says "Build plug-ins with malicious code can harm your Mac or compromise your privacy." But that's true of any third-party dependency or tool you pull in if its author isn't trustworthy. By comparison to the scary warning for build-tool plugins, Xcode will happily pull in a new third-party dependency and compile it into your application with no warning at all if you're not careful with dependency management, but there's no such warning for the potential malicious code when a new dependency is introduced. In fact, a dependency with malicious code is arguably worse because it runs on your customer's machines, not just the developer's like a build-tool plugin. Bottom line is there's lots of paths for untrusted code to execute on either build or customer machines if developers aren't careful, and it seems build tool plugins are the path that is singled out arbitrarily.

I fear that we're warning people about these plugins in a way that makes them seem more sketchy or risky than any other type of dependency, which I'd submit they aren't. Build tool plugins seem a great asset to Swift that we should be promoting the use of, not scaring people away from without reason.

1 Like