Crashlytics run script fails under Xcode User Script Sandboxing with SPM path (Operation not permitted)

[patricks]

Description

Hi,

we are seeing a reproducible Crashlytics build failure in CI when using the Firebase iOS SDK via Swift Package Manager and Xcode User Script Sandboxing enabled.

Environment

• Firebase iOS SDK: via SPM (firebase-ios-sdk checkout in DerivedData/SourcePackages)
• Xcode: 26.5.0
• Build system: xcodebuild / Fastlane archive
• CI: macOS GitHub Actions runner
• ENABLE_USER_SCRIPT_SANDBOXING = YES

Error

The Crashlytics run script fails with sandbox denial:

error: Sandbox: bash(...) deny(1) file-read-data .../DerivedData/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run

and then:

/bin/sh: .../Crashlytics/run: Operation not permitted

Current script phase

We call:

"${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run"

Problem

With script sandboxing enabled, declaring input files is required.
However, paths using shell parameter expansion (like ${BUILD_DIR%/Build/*}) are not interpreted in Input Files, so even when we add corresponding entries, sandbox still blocks Crashlytics/run.

Question

What is the officially supported and sandbox-safe way to reference Crashlytics run (and upload-symbols) for SPM-based integration on modern Xcode with User Script Sandboxing enabled?

A concrete recommended Input Files + script path example would help.

Thanks!

Reproducing the issue

No response

Firebase SDK Version

12.14

Xcode Version

26.5

Installation Method

Swift Package Manager

Firebase Product(s)

Crashlytics

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[rizafran]

Thanks for filing, @patricks. As you mentioned that you enabled the ENABLE_USER_SCRIPT_SANDBOXING, I'm wondering if you have added the paths required in the Build Phases tab based on the doc?

[patricks]

@rizafran yes I have added the paths:

[rizafran]

Thanks, @patricks. I'm unable to reproduce the issue, maybe because I'm not using CI. Could you provide the following:

• Did you make any changes before the issue occurred?
• Have you encountered the issue in your local machine?

[patricks]

Thanks for your help @rizafran. We switched from CocoaPods to Swift Package Manager, so we had do upgrade our build setup. No the problem doesn't appear on local builds.

[rizafran]

Thanks for the info, @patrick. Since the issue doesn't appear in local build, I guess it's because GitHub action is overriding the local folder mapping, in which Xcode is unable to find the SPM file paths inside its script sandbox. With this, have you tried to disable user script sandboxing in your CI setup? If the issue persists, you may provide your GitHub Actions xcodebuild command and full log before and after the sandbox error.

[google-oss-bot]

Hey @patricks. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

[google-oss-bot]

Since there haven't been any recent updates here, I am going to close this issue.

@patricks if you're still experiencing this problem and want to continue the discussion just leave a comment here and we are happy to re-open this.