# Mac App Store Readiness: Residual Gaps for Sandboxed Monitors > Source-anchored research for Mac App Store Readiness: Residual Gaps for Sandboxed Monitors. Run status: COMPLETED. Parent: [Apple Platform Publishing (Mac App Store)](https://llms-explorer.com/tree/apple-platform-publishing-mac-app-store/) · 7 facets · 53 facts · page: https://llms-explorer.com/tree/mac-appstore-readiness-residual-gaps/ ## Definitions - macOS 27 release notes: Rosetta is not auto-restored after upgrade if it was installed. Apps can no longer read the TCC database directly. Cross-team app-data container access is denied without a prompt. Selected system processes (MDM, software update) enforce stricter TLS 1.2/ATS. None of these affects a normally sandboxed own-container menu-bar app. (low confidence) (verified as of 2026-09-14) — [source](https://blakecrosley.com/blog/macos-27-release-notes) - The only documented Python MAS recipe is the 2014 Python 2.7 sample. It signs inner frameworks and helper tools recursively, the outer app last, with codesign and an entitlements file setting com.apple.security.app-sandbox, and uploads a .pkg. It warns old py2app builds create invalid Python.framework bundles; py2app 0.8.1+ is needed. (high confidence) — [source](https://dafoster.net/articles/2014/06/24/submitting-a-python-app-to-the-mac-app-store/) - Python-Apple-support's macOS framework is a relocatable re-bundling of the official macOS build with IDLE, Tkinter and turtle removed and the App Store compliance patch applied; its main branch builds Python 3.15, with 3.11-3.13 on branches, for macOS 11+ on x86_64 and arm64. (low confidence) (verified as of 2026-10-02) — [source](https://github.com/beeware/Python-Apple-support) ## Structure and components - Mass-market 5D992.c executable software and stand-alone toolkits/development kits no longer need the Feb 1 report, except where they implement non-standard cryptography. Only a limited set of mass-market components, and non-standard-crypto items, still require it. (high confidence) — [source](https://www.arnoldporter.com/en/perspectives/advisories/2021/04/doc-eliminates-mass-market-encryption-reporting) - Under 15 CFR 740.17(e)(3), the report covers mass-market components meeting Cryptography Note 3 (5A992/5D992) and non-mass-market 5A002/5B002/5D002 items self-classified under ENC. Reports for items exported in a calendar year must be received by February 1 of the following year. (medium confidence) (verified as of 2024-02-01) — [source](https://www.law.cornell.edu/cfr/text/15/740.17) ## How it works - Apple has published no statement on whether 5.1.2(i) is relaxed when the user supplies their own API key and picks the provider. Developers raise the question publicly and no source answers it, so design BYOK consent as if the rule applies. (low confidence) (verified as of 2026-10-02) — [source](https://dev.to/arshtechpro/apples-guideline-512i-the-ai-data-sharing-rule-that-will-impact-every-ios-developer-1b0p) - Guideline 5.1.1(iv) says apps must not manipulate or force consent and should, where possible, offer alternatives when consent is declined; so the AI/alert feature must be off by default and declining must leave core monitoring fully working. (high confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - On-device processing (Core ML, Foundation Models) is reported not to trigger the 5.1.2(i) disclosure; only data leaving the device to a third-party AI does. A key-gated cloud provider does leave the device. (low confidence) — [source](https://stora.sh/blog/2026-05-06-apple-ai-consent-rule-5-1-2-i-implementation-guide) - RFC 8880 defines ipv4only.arpa (A: 192.0.0.170, 192.0.0.171) for NAT64 prefix discovery; a DNS64 resolver synthesizes AAAA records from the local prefix. Queries must go to the interface's own advertised resolver, not user-configured, VPN or local resolvers, because the NAT64 prefix is per-interface. (medium confidence) — [source](https://www.rfc-editor.org/rfc/rfc8880.html) - On macOS 27, Local Network access reportedly covers direct local-address connections, not only Bonjour browsing (citing Apple TN3179). The mechanism itself is described as unchanged from earlier releases. (low confidence) (verified as of 2026-10-02) — [source](https://hometechops.com/mac/macos-27-local-network-no-prompt) - macOS 27 is the last release supporting Rosetta for general Intel apps. Apple announced this on 2026-09-01, and macOS 26.4+ already warns users when they launch Intel-only apps. Apple Silicon-only builds are therefore the safe target. (high confidence) (verified as of 2026-09-01) — [source](https://developer.apple.com/news/?id=w5ngl9k2) - Slimming levers for a py2app bundle: py2app --strip (default) removes debug and local symbols and has excludes for modules and dylibs; lipo can thin a universal2 build to one architecture. Any lipo or strip step must run before codesign, because modifying a Mach-O file invalidates its signature. (low confidence) — [source](https://pypi.org/project/py2app/) - NWPathMonitor reports path status (satisfied, unsatisfied, requiresConnection), interface types, isExpensive/isConstrained, and supportsIPv4/supportsIPv6/supportsDNS; it calls pathUpdateHandler on the monitor's dispatch queue when the path changes. (medium confidence) — [source](https://useyourloaf.com/blog/network-path-monitoring/) - In one third-party sandbox (Claude Code's profile, not the Mac App Store App Sandbox), SCDynamicStoreCreate returned NULL because the Mach service com.apple.SystemConfiguration.configd was blocked; this shows SCDynamicStore depends on configd IPC but says nothing definitive about App Sandbox. (low confidence) (verified as of 2026-10-02) — [source](https://github.com/anthropics/claude-code/issues/26879) ## How-to and procedures - To reach an IPv4-literal-only target on a NAT64 network, pass the literal string to getaddrinfo with AF_UNSPEC (AI_DEFAULT); on OS X 10.11.2+/iOS 9.2+ it synthesizes an address such as 64:ff9b::192.0.2.1. Apple warns against synthesizing the Well-Known Prefix address manually. (high confidence) — [source](https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/NetworkingOverview/UnderstandingandPreparingfortheIPv6Transition/UnderstandingandPreparingfortheIPv6Transition.html) ## Problems, failure modes and limitations - Apple App Review sends Guideline 2.1 information requests (screen recording on a physical device, setup instructions and credentials for main features, external services used) when reviewers cannot reach a feature; the iOSSH case (2026-09-16) was returned for review information with no build defect cited. (low confidence) (verified as of 2026-09-16) — [source](https://github.com/m96-chan/iOSSH/issues/48) - Apple's recommended app-side checks: dig AAAA for each server; an IPv4-mapped ::ffff:x.x.x.x in AAAA is invalid; a crash or failure on the review network is treated as an app bug, not a network problem. (low confidence) — [source](https://developer.apple.com/forums/thread/49979) - An app that touches the local network without NSLocalNetworkUsageDescription in its Info.plist is denied silently: no prompt, no entry in Privacy & Security > Local Network. macOS 27 reports (OpenAI Codex Desktop issue) show the same failure. (medium confidence) (verified as of 2026-10-02) — [source](https://github.com/openai/codex/issues/35346) - There is no supported way to reset an app's Local Network decision. Short-lived processes can fail silently without a prompt. Code-signature problems can make behavior unpredictable. (medium confidence) (verified as of 2026-10-02) — [source](https://eclecticlight.co/2026/01/14/how-local-network-privacy-could-affect-you/) - A py2app app signed with a Mac Developer cert plus sandbox entitlements and profile was killed at launch ('Killed: 9', 'Restricted entitlements not validated, bailing out', error -67050). The thread (March 2022, py2app 0.27, macOS 10.13) never reached a resolution, so py2app signing for MAS is an open risk, not a solved recipe. (low confidence) — [source](https://github.com/ronaldoussoren/py2app/issues/415) - com.apple.security.inherit does not apply to XPC services: they keep a separate sandbox and container, so a service cannot read files in the host app bundle unless the app passes access (a plain bookmark worked where security-scoped bookmarks failed in the 2016 write-up). (medium confidence) (verified as of 2016-08-17) — [source](https://www.mattrajca.com/2016/08/17/accessing-resources-from-an-xpc-services-host-app-in-the-sandbox.html) ## Comparisons and alternatives - Apple lists these as common IPv4-literal failures on DNS64/NAT64: IP literals in protocols and config files, network preflighting with 0.0.0.0 or 169.254.0.0, and IPv4-only low-level APIs (gethostbyname, inet_aton, inet_addr, inet_ntoa) and storage (in_addr, sockaddr_in rather than sockaddr_storage). (high confidence) — [source](https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/NetworkingOverview/UnderstandingandPreparingfortheIPv6Transition/UnderstandingandPreparingfortheIPv6Transition.html) - Apple DTS (2018) says both SCNetworkReachability and NWPathMonitor can give false positives and false negatives and suffer TOCTTOU, so use path events as a hint and confirm with a real operation rather than gating behavior on them. (low confidence) — [source](https://developer.apple.com/forums/thread/105822) - For XPC helpers under App Sandbox, the app and helper both need app-sandbox enabled, and early guidance paired it with a shared application-groups entitlement; mach-lookup is denied by default in a sandbox, though that write-up concerned a login-item helper rather than an embedded XPC service. (low confidence) (verified as of 2015-01-17) — [source](https://christiantietze.de/posts/2015/01/xpc-helper-sandboxing-mac/) ## Facts and statements - Effective 29 March 2021, BIS eliminated the annual self-classification report for most mass-market encryption items, and the email notification for publicly available encryption source code (except non-standard cryptography). (high confidence) — [source](https://www.thompsonhine.com/insights/bis-eliminates-most-mass-market-encryption-reporting-obligations/) - DWT's 2024 reminder defines mass-market products to include consumer apps and retail software, and excludes ECCN 5A992.c/5D992.c items from the Feb 1 report. (low confidence) (verified as of 2024-02-01) — [source](https://www.dwt.com/insights/2024/02/bureau-of-industry-security-export-reports-due) - Apple's export compliance guide says apps using standard encryption algorithms or OS crypto still need an export compliance determination. Apple defines non-exempt (non-standard) encryption as proprietary or unpublished cryptography not adopted by a recognized standards body (IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, GSMA). If no documentation is required, set the Info.plist key so App Store Connect stops asking at each submission. (medium confidence) — [source](https://developer.apple.com/help/app-store-connect/manage-app-information/overview-of-export-compliance) - The Apple export-compliance overview page, as fetched, does not mention an annual self-classification report or name ITSAppUsesNonExemptEncryption. The report obligation is a BIS matter, not enforced by App Store Connect. (low confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/help/app-store-connect/manage-app-information/overview-of-export-compliance) - Guideline 5.1.2(i) (added 2025-11-13) reads: 'You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.' (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/app-store/review/guidelines/) - Practitioner reading of 5.1.2(i): the consent screen must name the provider (not 'powered by AI'), say what the AI does, list concrete data types, require an affirmative tap, appear before the first API call, and be revocable from Settings. This is community interpretation, not Apple text. (medium confidence) — [source](https://stora.sh/blog/2026-05-06-apple-ai-consent-rule-5-1-2-i-implementation-guide) - Guideline 2.3.1(a) says new features, functionality and product changes must be described with specificity in Notes for Review (generic descriptions will be rejected) and be accessible for review; hidden or dormant features are prohibited. An optional key-gated AI feature counts. (high confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - Guideline 2.1(a) requires demo account info if the app includes a login, and allows a built-in demo mode only with prior Apple approval. A BYOK feature has no Apple-provisioned account, so the notes should either supply a reviewer-only key/endpoint with quota or state the feature is optional, off by default, and not required to use the app, ideally with a screen recording. (medium confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - Notes for Review template shape: keep to a few lines; state where the feature lives (menu path), default state, what data is sent to which named provider, how consent is revoked, that core features work without it, and credentials/demo path tested on a fresh install. Direct instructions beat marketing copy. (medium confidence) — [source](https://dev.to/shipdesk/how-to-write-app-review-notes-that-stop-the-information-needed-rejection-guideline-21-2e39) - Guideline 2.4.5(vi) bars Mac App Store apps from presenting a license screen at launch or requiring license keys. Putting the BYO API key prompt behind an optional Settings pane, never at launch, keeps it away from this rule; the guideline does not mention API keys for third-party services. (medium confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - App Review Guideline 2.5.5 states apps must be fully functional on IPv6-only networks; Apple's IPv6 page says support has been required for all App Store submissions since June 1, 2016. (high confidence) — [source](https://developer.apple.com/support/ipv6) - Reachability guidance: do not use SCNetworkReachabilityCreateWithAddress with 0.0.0.0; use SCNetworkReachabilityCreateWithName with a hostname instead. (medium confidence) — [source](https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/NetworkingOverview/UnderstandingandPreparingfortheIPv6Transition/UnderstandingandPreparingfortheIPv6Transition.html) - Local NAT64 test network: connect the Mac to the Internet by a non-Wi-Fi link, Option-click Sharing, choose Internet Sharing, tick Create NAT64 Network, configure Wi-Fi Options, then enable Internet Sharing. On the client, disable other interfaces (cellular/other Wi-Fi) so only the NAT64 network is used. (high confidence) — [source](https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/NetworkingOverview/UnderstandingandPreparingfortheIPv6Transition/UnderstandingandPreparingfortheIPv6Transition.html) - Apple DTS says the App Review NAT64 network (ARNAT64) now behaves like the Mac Internet Sharing NAT64 (MacNAT64): it always synthesizes IPv6 addresses and lacks direct IPv6-to-IPv6 egress. So MacNAT64 is a close local proxy for review, though not identical. (medium confidence) (verified as of 2017-09-27) — [source](https://developer.apple.com/forums/thread/49979) - Local Network privacy covers local DNS resolution (.local), Bonjour and outbound local connections. Listening for incoming TCP and receiving incoming UDP unicast need no privilege. Launchd daemons, root processes and Terminal/SSH tools are exempt, so a sandboxed GUI menu-bar app is subject to it. (medium confidence) (verified as of 2026-01-14) — [source](https://eclecticlight.co/2026/01/14/how-local-network-privacy-could-affect-you/) - macOS 27 release notes (build 26A428, 2026-09-14) make menu item symbol images hidden by default for apps linked on macOS 26.0+. Apps linked on the macOS 27 SDK also hide non-symbol images. The AppKit property preferredImageVisibility (.automatic/.visible/.hidden) overrides this. SwiftUI uses labelStyle(.titleAndIcon). Whether NSStatusItem button images are affected is not stated. (medium confidence) (verified as of 2026-09-14) — [source](https://blakecrosley.com/blog/macos-27-release-notes) - Universal Mac App Store apps that require macOS 13 or later can now ship arm64-only. Set the build architecture to arm64, rebuild and resubmit. Intel users keep the last compatible version. (medium confidence) (verified as of 2026-09-01) — [source](https://9to5mac.com/2026/09/01/apple-tells-mac-app-store-developers-they-can-now-drop-intel-support/) - py2app 0.28.10, released 13 Feb 2026, is the latest release; it requires Python 3.10+, fixes setuptools 82 compatibility (pkg_resources removal), and does not support free-threaded Python. (medium confidence) (verified as of 2026-10-02) — [source](https://pypi.org/project/py2app/) - py2app only adds ad-hoc signatures to arm64 binaries on macOS 11+ (needed for them to run). Producing an App Store signed bundle with a sandbox entitlements file and a provisioning profile is left to the developer's own codesign script. (medium confidence) — [source](https://pypi.org/project/py2app/) - py2app has made the embedded Python.framework MAS-compliant since 0.7 by creating the 'Versions/Current' symlink Apple's validator requires. (medium confidence) — [source](https://pypi.org/project/py2app/) - py2app 0.28.2 with Python 3.9.9 failed internal library signing ('invalid or unsupported format for signature' on liblzma.5.dylib). Each bundled dylib/.so must therefore be individually validly signed; py2app's own whole-bundle codesign retry is only a workaround. (low confidence) — [source](https://github.com/ronaldoussoren/py2app/issues/455) - Briefcase adds two default entitlements to every macOS app: com.apple.security.cs.allow-unsigned-executable-memory and com.apple.security.cs.disable-library-validation, both removable. Its macOS reference page does not mention the Mac App Store, sandboxing, or nested-binary signing, so MAS support is unconfirmed from the vendor page. (low confidence) (verified as of 2025-07-10) — [source](https://briefcase.beeware.org/en/v0.3.24/reference/platforms/macOS/) - An Aug 2026 project spike (picture_helper) concluded Briefcase (Xcode format, submit via Organizer, entitlements in pyproject.toml, app-sandbox added manually) is the only maintained MAS path in the Python ecosystem. It found no publicly documented published PyQt/PySide app in the MAS built with py2app, and ruled out PyInstaller onefile. This is one project's opinion, not Apple or vendor guidance. (low confidence) (verified as of 2026-08-28) — [source](https://github.com/NikolayDA/picture_helper/issues/894) - SCDynamicStore change detection from Python: create a store with a callback, call SCDynamicStoreSetNotificationKeys for keys like State:/Network/Global/IPv4 and State:/Network/Global/IPv6, add the store's run-loop source to a CFRunLoop; under PyObjC the context argument is an arbitrary Python object. (medium confidence) — [source](https://chris.improbable.org/2009/03/13/using-systemconfiguration-events-within-python/) - XPC services are bundles in Contents/XPCServices of the app bundle, are private to the containing app, and each has its own sandbox and entitlements; by default they run in the most restricted environment, and a service must be code-signed for its entitlements to apply. (medium confidence) — [source](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html) - launchd launches XPC services on demand, restarts them after a crash, and kills idle ones with SIGKILL, so a Python helper must be designed stateless or minimal-state; a crash mid-request invalidates the app's connection until launchd restarts the service. Elevating a service to root is unsupported. (low confidence) — [source](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html) - A child tool (NSTask/posix_spawn) that inherits the parent's sandbox must use exactly two sandbox entitlements, com.apple.security.app-sandbox and com.apple.security.inherit; any other sandbox entitlement aborts the child. Xcode 9 injected get-task-allow, which broke inheritance; workarounds were Export Archive or re-signing, and the later Xcode setting CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO addresses it. (low confidence) (verified as of 2017-09-01) — [source](https://indiestack.com/2017/09/sandbox-inheritance-tax/) - Embedding the Python interpreter as a signed framework (BeeWare Python-Apple-support Python.xcframework plus python-stdlib, loaded via PythonKit or the C API) avoids removing the sandbox or disabling library validation; every .so in the stdlib must be re-signed with the team ID and hardened runtime, and PYTHONHOME/PYTHONPATH must be set before Py_Initialize(). (medium confidence) (verified as of 2022-12-03) — [source](https://dev.to/eldare/embedding-python-interpreter-inside-a-macos-app-and-publish-to-the-app-store-successfully-4bop) - Python 3.12+ ships the string 'itms-services' in Lib/urllib/parse.py, which Apple's automated scan flagged under Guideline 2.5.2 and rejected macOS and iOS apps bundling Python; CPython added a --with-app-store-compliance configure option (PR #120984, refined in #121947) and backported it to 3.12 and 3.13. (medium confidence) (verified as of 2026-10-02) — [source](https://github.com/python/cpython/issues/120522)