This is a for a client's existing app. They have a valid need for communicating between the generator and the app (the app actually renders the image, which is a compicated, proprietary format/process that they want to stay inside the licensed app itself), so the idea is that the generator needs to pass in the file path, the app generates the image, saves it to the tmp folder, and returns the file path to the generated image. How about some other form of IPC? Maybe distributed notifications?

So changing to .appex could help in this regard?

Nvm. It's a pain. Can't waste any more time on trying to get my test project setup like his. I'll just put the log output in here and maybe you can tell me what you think is going on... error 13:21:09.978499-0500 quicklookd Unexpected mach port in launchd plist: <private> default 13:21:09.979770-0500 quicklookd Received configuration update from daemon (initial) default 13:21:10.005522-0500 distnoted register name: com.apple.quicklook.GlobalChange object: kCFNotificationAnyObject token: 100000000 pid: 1090 error 13:21:10.127794-0500 kernel Sandbox: ExternalQuickLoo(1091) deny(1) mach-lookup com.apple.tccd.system default 13:21:10.127902-0500 ExternalQuickLookSatellite-arm64 send_message_with_reply_sync(): user tccd unavailable, sending 0x15c2379c0 to system tccd error 13:21:10.128081-0500 ExternalQuickLookSatellite-arm64 send_message_with_reply_sync(): XPC_ERROR_CONNECTION_INVALID for message 0x15c2379c0 error 13:21:10.128101-0500 ExternalQuickLookSatellite-arm64 TCCAccessRequest_block_invoke: Connection invalid default 13:21:10.128154-0500 ExternalQuickLookSatellite-arm64 Current system appearance, (HLTB: 1), (SLS: 0) default 13:21:10.131021-0500 ExternalQuickLookSatellite-arm64 Post-registration system appearance: (HLTB: 1) default 13:21:10.131175-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: generator = /Applications/REDACTED/REDACTED.app/Contents/Library/QuickLook/REDACTED_QLPlugin.qlgenerator default 13:21:10.131244-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: generator.version = 2.0.2 default 13:21:10.131295-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: contents = /Applications/REDACTED/REDACTED.app/Contents default 13:21:10.131346-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: java = /Applications/REDACTED/REDACTED.app/Contents/Plugins/Java.runtime/Contents/Home/bin/java default 13:21:10.131391-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: superjava = /Applications/REDACTED/REDACTED.app/Contents/Java default 13:21:10.131434-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: jar = /Applications/REDACTED/REDACTED.app/Contents/Java/REDACTED.jar default 13:21:10.131501-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: task = <NSConcreteTask: 0x15c210ec0> default 13:21:10.131608-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: pipe = <NSConcretePipe: 0x15c2126c0> default 13:21:10.134001-0500 kernel Sandbox: 1 duplicate report for ExternalQuickLoo deny(1) mach-lookup com.apple.tccd.system error 13:21:10.323977-0500 sandboxd Sandbox: java(1092) deny(1) mach-lookup com.apple.oahd error 13:21:10.506820-0500 sandboxd Sandbox: java(1092) deny(1) sysctl-write kern.system_version_compat error 13:21:13.648119-0500 sandboxd Sandbox: java(1092) deny(1) file-read-data /Users/REDACTED/.cduf2/stereoisomers.pcl error 13:21:17.781223-0500 sandboxd Sandbox: java(1092) deny(1) network-outbound /private/var/run/mDNSResponder error 13:21:18.022869-0500 sandboxd Sandbox: java(1092) deny(1) file-read-data /private/etc/hosts default 13:21:18.183160-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: take complete default 13:21:18.183500-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: file = <NSConcreteFileHandle: 0x15c212740> default 13:21:18.183660-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: data = {length = 41, bytes = 0x4552524f 523a2055 6e61626c 6520746f ... 20286e75 6c6c290a } default 13:21:18.183751-0500 ExternalQuickLookSatellite-arm64 convertFile2pdf: response = ERROR: Unable to validate license (null) error 13:21:18.216624-0500 com.apple.quicklook.ThumbnailsAgent CGBitmapContextCreateImage: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable. error 13:21:18.220755-0500 Finder Will not generate thumbnail from image because it has an incorrect size: (0.000000, 0.000000) default 13:21:23.213077-0500 distnoted register name: com.apple.xctest.FakeForceTouchDevice object: com.apple.quicklook.externalSatellite.arm64 token: 100000000f pid: 1091 To my eye, everything looks fine until the NSTask is launched, at which point sandboxd starts spitting out errors (even though he's not sandboxed anymore) and nothing after that point looks like it's working right. Any idea why sandboxd would be complaining about violations in a non-sandboxed app? (excuse the formatting)

There's another detail I'm just hearing about.... They're bundling the java runtime inside the app bundle and invoking it from an NSTask from a quicklook plugin also inside the app bundle. Apparently that interaction is the heart of the problem they're having (on Big Sur only). Setting up my test project to mimic this.

I'm following along here with my own little test app and, after forcing a re-sign, I'm getting an empty response from codesign -d --entitlements :- PATHTOAPP. Is that sufficient to know that it's out of the sandbox or is there more to it?

Thanks, Quinn. "The entitlements are part of the code signature. If you re-sign the app, you can change them at will." How is this done on an already-compiled (re-signed) app though? There is no entitlements file in the app bundle to delete/edit.