sandboxed | Python script to jail execution

If you are implementing this as a separate binary, your binary will be doing next things:

1. Use RPC to load the WASM file from the blockchain. See RPC reference
2. Use runtime-standalone to run this WASM with specific inputs. An example of using runtime standalone is here, but you will need to customize this with few things.
3. The result should be sent as a transaction signed by this binary again via RPC.

If you want these WASM files to have access to state, you will need to load state inside this binary. There are two options:

1. Modify a nearcore node to also do the above items
2. Run nearcore in parallel, and open the database on read when you are initializing Trie (e.g. here load from disk instead).

If you want to add more host functions (like accessing internet), you will need to fork runtime-standalone to expose those functions.

That code will not work for recurring payments. Subscriptions are a separate integration, see the Subscriptions overview: https://developer.paypal.com/docs/subscriptions/ , and in addition to API calls you can manually create and manage billing Products and Plans in the receiving account at:

• Sandbox: https://www.sandbox.paypal.com/billing/plans
• Live: https://www.paypal.com/billing/plans .

If you want a choice on a PayPal page to make a donation recurring or not, the only option is to create a non-JS Donate button at https://www.paypal.com/buttons . In Step 2 you can uncheck the option to save the button at PayPal, and when you generate the code you can remove the code protection. A custom value can be passed using the custom parameter, https://developer.paypal.com/docs/paypal-payments-standard/integration-guide/Appx-websitestandard-htmlvariables/#payment-transaction-variables , this will be visible in the receiver account's transaction details.

I was able to figure this out thanks to the LinuxSupportForXcode extension.

I'm going to make the assumption that you followed the tutorial on creating an Xcode Extension Editor, and made the main project a macOS App. You should have a target structure similar to:

• MyApp (macOS App target)
• MyAppExtension (Xcode Source Editor Extension target)

To use XPC with a Source Editor Extension:

1. File > New > Target... > XPC Service.

   For example purposes, we'll assume it's called MyAppXPCService and its bundle identifier is com.example.MyAppXPCService.

2. Move the XPC service dependency from the App to the Extension:

   If you don't do this step, you may run into issues where your XPCService isn't being executed by the extension. E.g. you invoke a command that should launch the XPCService, but in the Xcode Debug Navigator, your XPCService never comes up.

   1. Go to your app's target.
   2. Remove MyAppXPCService.xpc from the Frameworks and Libraries.
   3. Go to your extension's target.
   4. Add MyAppXPCService.xpc to Frameworks and Libraries by dragging it in from the products folder in the Project Navigator. Leave it on the default "Embed Without Signing".

3. In the XPC Service, convert it to Swift, mainly following the instructions here:

   Note: If you'd prefer to not convert to Swift, and use a mixed target instead, simply create a Swift file and when prompted, choose to create the bridging header, then include #import "MyAppXPCServiceProtocol.h" in the bridging header.

   1. Create main.swift, MyService.swift, MyServiceDelegate.swift, MyServiceProtocol.swift normally.

   2. Set the following build settings:

      • Install Objective-C Compatibility Header: NO
      • Objective-C Generated Interface Header Name: `` (blank)

   3. Choose your desired Swift Language Version in Build Settings.

   4. In Build Settings, add (don't replace): @loader_path/../../../../Frameworks to Runtime Search Paths.

      If you accidentally replace, and use an embedded framework, XPC will crash on launch.

4. In your extension target:

   1. import MyAppXPCService so that it can see the protocol.

   2. Create the connection, using your XPC target's bundle identifier for serviceName:

I ended up compiling a list from EveryMac.com of all the models with MagSafe:

There are a few ways to go about this: if you're doing exec from the same process as Flask, the simplest thing to do is call it with a dictionary of "globals" and pass your own print function. You can also replace sys.out to reroute it to your own sink.

Alternatively, you can write a separate script which reads the input code from stdin, then execs it, and call that script as a subprocess to read from its output directly. That way also allows you to impose stricter limits on the user's code than the Flask code.

Whichever way you choose, be sure to also handle the case when the user's code raises an exception or falls into an infinite loop (or just takes way too long to run). The handling of those cases will depend on which approach you take.

The problem was some remnants of old a bundle identifier. I had migrated to a sandboxed distribution of the app, and at some point in the process, I had built the sandboxed version with the same bundle identifier. macOS had registered the bundle identifier to belong to a sandboxed app and, probably due to security reasons, no longer wanted to allow it to run non-sandboxed.

I created a fresh Info.plist, and changed the bundle identifier and the errors were gone.

OK so I believe Music is a folder that can't be removed even if a music library is moved via the Music app. I guess if a music library is moved or changed, the default Music folder will still remain and usable by the app.

Therefore,

It is hard to say, the commit which introduce that change do not tell why it was done.

The default option, which enable the best available sandboxing is probably the safest approach during development. However the Tensorflow case is different: most of the users do not change anything in a code base, they just want to build already tested codebase for their PC. In that case sandboxing can be disadvantageous, because it affects build performance, and there are some historical issues on some uncommon system configurations

I have partially solved my question and it is good enough for what I need. Here is what I did.