From 615d6647310b72423cb9a70348504840465edfff Mon Sep 17 00:00:00 2001
From: Micha <espey@smart-q.de>
Date: Tue, 30 Dec 2025 20:04:26 +0100
Subject: [PATCH] fix: configure sandbox for Sparkle installer with proper
 entitlements

- Add downloads folder read-write access for installer
- Enable SUEnableInstallerLauncherService for sandboxed update installation
- Keep XPC service entitlements for installer communication
---
 iKeyMon-Info.plist   | 2 +-
 iKeyMon.entitlements | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/iKeyMon-Info.plist b/iKeyMon-Info.plist
index eae7147..d6ad33b 100644
--- a/iKeyMon-Info.plist
+++ b/iKeyMon-Info.plist
@@ -7,6 +7,6 @@
 	<key>SUPublicEDKey</key>
 	<string>EgJgrOGQ79L5me616jA7kDCEOgx+Rg11uYLYLLIyzTI=</string>
 	<key>SUEnableInstallerLauncherService</key>
-	<false/>
+	<true/>
 </dict>
 </plist>
diff --git a/iKeyMon.entitlements b/iKeyMon.entitlements
index 22a865a..65c6533 100644
--- a/iKeyMon.entitlements
+++ b/iKeyMon.entitlements
@@ -6,6 +6,8 @@
 	<true/>
 	<key>com.apple.security.network.client</key>
 	<true/>
+	<key>com.apple.security.files.downloads.read-write</key>
+	<true/>
 	<key>com.apple.security.xpc.aConnectionServices</key>
 	<array>
 		<string>com.sparkle-project.InstallerConnection</string>