Commit `0aa8cdf3bb`

0aa8cdf3bb55f31039df1ce473dc23eca22b6449

parent: 2279dfa7c4

Unsigned

cmc <hello@cleberg.net> · 2026-07-24 22:51 UTC

fix: reach CloudKit instead of gating on unreliable entitlement introspection (#29)

iCloud sync always failed with "This build does not have the CloudKit
entitlement required for iCloud sync." on normal Debug/device builds.

`cloudKitContainer()` gated construction on `isEntitlementConfigurationAvailable()`,
which inspected `Info.plist` keys and an `archived-expanded-entitlements.xcent`
file. Entitlements live in the code signature, not `Info.plist`, and the `.xcent`
file only exists in archived/distribution builds — so the check returned false for
a correctly-signed development build, the container was never created, and every
path reported `.missingEntitlement`.

Stop introspecting entitlements. Always construct `CKContainer.default()` and let
CloudKit's own `accountStatus()` drive availability. When the entitlement is
genuinely absent, CloudKit surfaces `.missingEntitlement` / `.badContainer` /
`.permissionFailure`, which `accountStatus()` now maps back to the "no entitlement"
message — preserving that signal without the false negative.

Layout: unified · split

DomainDig/CloudSyncService.swift +13 −40

     }
     func acceptShare(metadata: CKShare.Metadata) async throws {
-        guard let container = cloudKitContainer() else {
+        let container = cloudKitContainer()
-            throw CloudSyncRuntimeError.missingEntitlement
-        }
         if metadata.participantStatus == .pending {
             _ = try await container.accept(metadata)
     }
     private func accountStatus() async -> AvailabilityState {
-        guard let container = cloudKitContainer() else {
+        let container = cloudKitContainer()
-            return .missingEntitlement
-        }
         return await withCheckedContinuation { continuation in
             container.accountStatus { status, error in
                 if let error {
-                    let ckError = error as? CKError
+                    switch (error as? CKError)?.code {
-                    if ckError?.code == .notAuthenticated {
+                    case .notAuthenticated:
                         continuation.resume(returning: AvailabilityState.noAccount)
-                        return
+                    case .missingEntitlement, .badContainer, .permissionFailure:
+                        continuation.resume(returning: AvailabilityState.missingEntitlement)
+                    default:
+                        continuation.resume(returning: AvailabilityState.unknown)
                     }
-                    continuation.resume(returning: AvailabilityState.unknown)
                     return
                 }
             .lowercased() ?? ""
     }
-    private func cloudKitContainer() -> CKContainer? {
+    private func cloudKitContainer() -> CKContainer {
         if let container {
             return container
         }
-        if isEntitlementConfigurationAvailable() {
+        let container = CKContainer.default()
-            let container = CKContainer.default()
+        self.container = container
-            self.container = container
+        return container
-            return container
-        }
-        return nil
     }
     private func cloudKitDatabase(in scope: SyncDatabaseScope) -> CKDatabase? {
             }
         }
-        guard let container = cloudKitContainer() else {
+        let container = cloudKitContainer()
-            return nil
-        }
         switch scope {
         case .privateDatabase:
         }
     }
-    private func isEntitlementConfigurationAvailable() -> Bool {
-        if Bundle.main.object(forInfoDictionaryKey: "com.apple.developer.icloud-container-identifiers") != nil {
-            return true
-        }
-        if Bundle.main.object(forInfoDictionaryKey: "com.apple.developer.ubiquity-container-identifiers") != nil {
-            return true
-        }
-        if let entitlementsURL = Bundle.main.url(forResource: "archived-expanded-entitlements", withExtension: "xcent"),
-           let data = try? Data(contentsOf: entitlementsURL),
-           let contents = String(data: data, encoding: .utf8) {
-            return contents.contains("com.apple.developer.icloud-services")
-                && (contents.contains("CloudKit") || contents.contains("CloudKit-Anonymous"))
-        }
-        return false
-    }
     private var missingEntitlementMessage: String {
         "This build does not have the CloudKit entitlement required for iCloud sync."
     }

Commit 0aa8cdf3bb

Commit `0aa8cdf3bb`