SourceTree

Mac App Store: Sandboxing Update

By on June 29, 2012

A few months ago, I discussed how new sandboxing requirements have prompted us to move away from  the Mac App Store for future releases. Since that blog post, a few things happened:

  1. The deadline was delayed to 1st June, giving everyone some extra time
  2. Apple made some changes to OS X to allow more behaviours to be supported within the sandbox
  3. Apple decided that they would still allow bugfix updates to non-sandboxed apps that were already available in the Mac App Store prior to 1st June

All these moves were welcome, and we thank Apple for making them. We have subsequently been able to publish SourceTree 1.4 to the App Store. We even had an expedited bug fix approved after the 1st June deadline, which was very useful.

Going forward with future releases, however, the changes that have been made to the sandbox still do not quite address all of the issues we have with it. While we could work around them, it would downgrade the user experience, which has always been a red line for us. We also have to consider the fact that the main alternatives to SourceTree are not distributed on the Mac App Store and are therefore not constrained by these rules.

Therefore our position has not materially changed since the original decision: SourceTree 1.5 onwards will only be distributed via sourcetreeapp.com. We advise all users on the Mac App Store to migrate to the direct download version, either now or when 1.5 is released, so you can benefit from the awesome new stuff we have in store for you.

[This update is just to clarify the questions we've had from people who have seen the recent 1.4 updates on the Mac App Store. We have already started using the new Developer ID code signatures since 1.4.4, which means the direct download version is compatible with Gatekeeper on Mountain Lion -- Apple's recommended method to distribute apps outside the Mac App Store.]

Update December 2012:

We decided to speculatively submit further 1.5 updates to the Mac App Store anyway, and so far, reviewers have allowed the updates to be approved. Given the official line from Apple that only bugfix releases will be allowed on the Mac App Store without sandboxing, we cannot guarantee that further updates will be accepted. We will continue to submit them as a convenience for our users who still wish to use the Mac App Store version, for as long as they continue to be approved, but must warn you that this situation may not continue indefinitely – we’re basically at Apple’s mercy here. We continue to recommend using the direct version from sourcetreeapp.com which receives updates much faster (review delays on MAS are running at several weeks) and is also able to support some features which MAS does not allow.

Update January 2013:

Apple has now stopped accepting updates to SourceTree in the Mac App Store, as we expected, although a little later than we thought. Therefore SourceTree 1.5.6 will be the last version available on the Mac App Store, you should switch to the direct version from http://sourcetreeapp.com if you want future updates (and why wouldn’t you? ;) ).

  • MMM

    Pixelmator is sandboxed in the Mac App Store and it _DOES_ send AppleEvents to iPhoto/Mail/Aperture, it also has full access to the hard drive and some other entitlements. Why can’t you do that?

    • Anonymous

      To do that requires using temporary exceptions that Apple have said they’ll take away later, so this is a delaying tactic only. And Pixelmator doesn’t really have a choice, they made the decision to go solely with the App Store a while back – we didn’t so we have more flexibility.
      Pixelmator is also a typical document-based app, which is a lot easier to sandbox. It doesn’t doesn’t share system tool configuration like SSH, nor does it have cases using defaultdestination paths etc – it’s a typical single-file, document-based app where using simple save dialogs all the time makes sense. That’s not the case with SourceTree.

      As I’ve said, we *could* sandbox, but we’d have to take away a bunch of useful behaviours (SSH that just works with your existing configuration, default project folders, needing to force people to rebuild their entire bookmarks list when porting over). It’s just not justified to annoy users when we have an alternative that already works.

      • MMM

        Well, we will simply use temporary exceptions, also to tell Apple why we need them. The whole Sandboxing thing is also new for Apple and they have to learn all the usage cases, e.g. of file system access. I expect that the transition will take another 2 years or so, but then it is easier for everybody.

        • Anonymous

          There are not even temporary exceptions for everything we need, though. The other 2 things listed there are not avoidable with exceptions and would require downgrades to the app *immediately*.

  • Rich

    Is this still accurate? You say “SourceTree 1.5 onwards will only be distributed via sourcetreeapp.com” but the Mac App Store seems to have version 1.5.6.

    • Anonymous

      I’ve added an update to the blog post above reflecting the current situation.

  • Anonymous

    Apple Y u no like developers?