Reinstate manifest sandboxing

[neonichu]

Manifest loading has been sandboxed on macOS for a while, but the change in #2518 broke it for 5.3.

https://bugs.swift.org/browse/SR-13346
rdar://problem/66586184

[neonichu]

@swift-ci please smoke test

[neonichu]

Looks like the 5.3 profile is actually too restrictive.

[neonichu]

We need to allow process launches, so that we can even launch the compiled manifest. We also need to allow reads, because otherwise we can't load the PD dylibs.

[neonichu]

@swift-ci please smoke test

[neonichu]

14:36:51 2020-08-05 14:36:28.668 foo-manifest[77032:57189500] Failed to obtain sandbox extension for path=/Users/buildnode/Library/Caches/foo-manifest. Errno:1
14:36:51 Fatal error: 'try!' expression unexpectedly raised an error: Error Domain=NSCocoaErrorDomain Code=260 "The file couldn’t be opened because it doesn’t exist." UserInfo={NSURL=http://swift.org, NSUnderlyingError=0x7f82ef804180 {Error Domain=NSURLErrorDomain Code=-1003 "A server with the specified hostname could not be found." UserInfo={NSUnderlyingError=0x7f82de40c8c0 {Error Domain=kCFErrorDomainCFNetwork Code=-1003 "A server with the specified hostname could not be found." UserInfo={NSErrorFailingURLStringKey=http://swift.org/, NSErrorFailingURLKey=http://swift.org/, _kCFStreamErrorCodeKey=-72000, _kCFStreamErrorDomainKey=10, NSLocalizedDescription=A server with the specified hostname could not be found.}}, NSErrorFailingURLStringKey=http://swift.org, NSErrorFailingURLKey=http://swift.org, _kCFStreamErrorDomainKey=10, _kCFStreamErrorCodeKey=-72000, NSLocalizedDescription=A server with the specified hostname could not be found.}}}: file /var/folders/_8/79jmzf2142z2xydc_01btlx00000gn/T/TemporaryFile.tFKpoE.swift, line 3
14:36:51 Test Case '-[PackageLoadingTests.PackageDescription5_2LoadingTests testManifestLoadingIsSandboxed]' failed (2.533 seconds).

Hm, looks like we were able to leave the sandbox on CI 🤔

[neonichu]

Failure happens on both macOS CI hosts, so looks like it is consistent. Locally, the test works as expected, the network call is denied. Maybe the failure happens in constructing the URL vs. the actual network call?

[tomerd]

maybe use a different action that does not require network access?

[neonichu]

I was intentionally using a network request since it seems important to test that this is still blocked.

[neonichu]

@swift-ci please smoke test

[neonichu]

Looks like using an IP address instead of a domain works.