Correctly requesting com.apple.developer.driverkit.userclient-access

I’m asking about how to ask for an addition to a managed entitlement, where we already have a grant of that entitlement (with a different value) and we already have other managed entitlements granted.

So, there are a lot of different questions/issues here, so this is going to be a bit of a "grab bag" of general advice.

In terms of the request itself, submission goes through the standard DriverKit request form here:

https://developer.apple.com/contact/request/system-extension/

The form URL doesn't specify a particular App Identifier, but is the Identifier implied with this form submission? Or, put another way, is the entitlement we're asking for attached only to the Team ID, or also to the bundle ID of the app which is going to use the entitlement?

SO, depending on how you fill out the request, you can either:

1. Ask for a particular entitlement to be assigned to a particular bundle ID.

2. Ask for the entitlement to be assigned to your team.

Applying that to the user client case, if you had two DEXT that could either be configured as:

(1) Individual app grants:

com.myapp.1 -> user-client = com.myapp.1.dext
com.myapp.2 -> user-client = com.myapp.2.dext

(2) Team Grant:

user-client = {
	com.myapp.1.dext
	com.myapp.2.dext
}

...and both apps are signed with the same entitlement which happens to include an "extra" entitlement they don't need.

In terms of what you "should" do, my strong recommendation would be #2. It's not as "elegant" as #1 but it avoids you needing to do exactly this:

So if I made another app which talks to my dext, I'd have to ask again for userclient-access to the same dext, but from a different bundle ID?

You might have problems if your user client count starts to get "large“; however, I think most developers start consolidating multiple drivers into a single kext long before the user client count would be a problem.

The form says "Which DriverKit entitlements do you need" and "select all that apply,” but I'm unclear about whether I need to request ALL the DriverKit entitlements we need for all our apps, or only for the specific App Identifier I reached this form from.

In terms of the request selection, just ask for the user client entitlement. Since you've already been approved, I'd keep the request brief and basically say "I've already been approved for the user client entitlement; I now need a merged entitlement which includes these two values.”

In terms of formatting that request:

The resulting provisioning profile was malformed; it contained this value under com.apple.developer.driverkit.userclient-access: <string>com.turing.TuringTouch com.turing.TuringTouch.TouchDriver</string>

This happens occasionally when our system pulls the bundle ID out incorrectly and then the approver doesn't notice the issue. I'm working on getting it fixed (r.187801367), but if it happens to you, the solution is to file a Code-level support request, and I can sort it out.

Should I be formatting my request as above, as a chunk of xml, or is a plain text list of bundle IDs, one per line, acceptable?

The XML itself doesn't specifically matter, but the XML format can make the space failure less likely. However, I think the most important thing is simply keeping the request as clear and specific as possible.

Is there a way for us to get a summary of all the managed entitlements already granted to our team?

Not really, especially if they've been granted on a per-app basis. If there is something specific you're concerned about, then this is another thing I'd recommend handling through Code-level support.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware