Downloader XPC Service needs changes to avoid Sonoma sandboxing warning prompts

[zorgiepoo]

Downloader XPC Service needs changes to avoid Sonoma sandboxing warning prompts

[zorgiepoo]

Landed in 2.6.0-beta.1. The Downloader XPC Service is now not sandboxed by default which will prevent these types of warnings that macOS Sonoma introduced (when multiple sandboxed apps access the same sandbox container). The sandboxing documentation has been updated.

[zorgiepoo]

Sample screenshot of the issue:

[zorgiepoo]

For reference these are the repro steps for the system warning to show up on macOS 14 and later:

1. rm -rf ~/Library/Containers/org.sparkle-project.Downloader so we can trigger the first-time prompt of a specific app accessing this sandbox container.
2. Launch one affected Sparkle based app that enables the downloader XPC Service with a non-custom XPC Service bundle ID. Have the app check for updates and create the above directory we removed in step 1. (E.g. try with Keka 1.3.7)
3. Launch another affected Sparkle based app that meets the criteria in step 2, but is signed with a different Team ID than in step 2. Have the app check for updates. (E.g. try with HandBrake 1.7.3)