Not working on Big Sur

[kidonng]

The preview window is all blank. Apps from anywhere are allowed and com.apple.quarantine is removed.

[ralphrmartin]

CrashReporter indicates the underlying cause is that highlight cannot use the lua dynamic library as it is not codesigned.

Dyld Error Message:
Library not loaded: /usr/local/opt/lua/lib/liblua.5.3.dylib
Referenced from: /usr/local/bin/highlight
Reason: no suitable image found. Did find:
file system sandbox blocked open() of '/usr/local/opt/lua/lib/liblua.5.3.dylib'
file system sandbox blocked open() of '/usr/local/lib/liblua.5.3.dylib'
file system sandbox blocked open() of '/usr/local/Cellar/lua/5.3.5_1/lib/liblua.5.3.5.dylib'

[grischard]

There's nothing in the full crash log (below) about a code signature being missing or wrong. @ralphrmartin maybe you know more?

I've tried manually signing the lua library, and adding highlight to System Preferences > Security & Privacy > Privacy > Files and Folders and System Preferences > Security & Privacy > Privacy > Full Disk Access. No success.

Process:               highlight [12343]
Path:                  /usr/local/Cellar/highlight/3.59/bin/highlight
Identifier:            highlight
Version:               0
Code Type:             X86-64 (Native)
Parent Process:        zsh [12338]
Responsible:           quicklookd [7658]
User ID:               502

Date/Time:             2020-11-15 21:00:05.068 +0100
OS Version:            macOS 11.0.1 (20B29)
Report Version:        12
Anonymous UUID:        10AF77C7-90FF-05A1-E223-24F865762E71

Sleep/Wake UUID:       24E7E3DB-343A-4322-A838-427B4C7BD906

Time Awake Since Boot: 210000 seconds
Time Since Wake:       13000 seconds

System Integrity Protection: enabled

Crashed Thread:        0

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    DYLD, [0x6] Filesystem Sandbox

Application Specific Information:
dyld: launch, loading dependent libraries

Dyld Error Message:
  Library not loaded: /usr/local/opt/lua/lib/liblua.5.3.dylib
  Referenced from: /usr/local/bin/highlight
  Reason: no suitable image found.  Did find:
	file system sandbox blocked open() of '/usr/local/opt/lua/lib/liblua.5.3.dylib'
	file system sandbox blocked open() of '/usr/local/lib/liblua.5.3.dylib'
	file system sandbox blocked open() of '/usr/local/Cellar/lua/5.3.5_1/lib/liblua.5.3.5.dylib'

Binary Images:
       0x101a4f000 -        0x101b0efff +highlight (0) <8A359DEB-14EE-3D18-B9AD-03287280B917> /usr/local/bin/highlight
       0x10b621000 -        0x10b6bcfff  dyld (832.7.1) <2705F0D8-C104-3DE9-BEB5-B1EF6E28656D> /usr/lib/dyld
    0x7fff2a505000 -     0x7fff2a506fff  libSystem.B.dylib (1292.50.1) <14E3BB7B-B95F-3700-8D12-B9B2012C0AF8> /usr/lib/libSystem.B.dylib

Model: MacBookPro14,1, BootROM 429.50.1.0.0, 2 processors, Dual-Core Intel Core i5, 2.3 GHz, 16 GB, SMC 2.43f10
Graphics: kHW_IntelIrisGraphics640Item, Intel Iris Plus Graphics 640, spdisplays_builtin
Memory Module: BANK 0/DIMM0, 8 GB, LPDDR3, 2133 MHz, 0x802C, 0x4D5435324C31473332443450472D30393320
Memory Module: BANK 1/DIMM0, 8 GB, LPDDR3, 2133 MHz, 0x802C, 0x4D5435324C31473332443450472D30393320
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x170), Broadcom BCM43xx 1.0 (7.77.111.1 AirPortDriverBrcmNIC-1669)
Bluetooth: Version 8.0.1f5, 3 services, 27 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
USB Device: USB 3.0 Bus
Thunderbolt Bus: MacBook Pro, Apple Inc., 41.4

[ralphrmartin]

Sorry, no perhaps I was jumping to a conclusion. While liblua is not codesigned, that may not be the problem.

Maybe one way to overcome this is to bundle a private copy of highlight and the lua library with QLColorCode?

I'm certainly no expert.

[ferologics]

+1

[kidonng]

FYI, a similar plugin also has this issue: samuelmeuli/glance#46 (sadly the project is archived)

[Tatsh]

I attempted to bypass the colorize.sh file by having colorizeURL() call highlight directly. This still gave the same kind of error:

Sandbox: highlight(68145) deny(1) file-read-data /opt/local/lib/liblua.dylib
Violation:       deny(1) file-read-data /opt/local/lib/liblua.dylib
Process:         highlight [68145]
Path:            /opt/local/bin/highlight
Load Address:    0x100296000
Identifier:      highlight
Version:         ??? (???)
Code Type:       x86_64 (Native)
Parent Process:  ExternalQuickLookSatellite-x86_ [68143]
Responsible:     /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd.app/Contents/MacOS/quicklookd

The only difference is the Parent Process line.

I tested with a binary that has no libraries other than ones signed by Apple and it shows output. So theoretically, a static build of highlight would work.

I think if I can build highlight linked with liblua.a rather than the dylib, this will work.

Other observations

It would be theoretically possible to use a user-provided Pygmentize as long as /usr/bin/python3 is passed as the launchPath. This relies on a lot of unknowns on a given system and is too difficult to support IMHO.

    task.environment = @{@"PYTHONPATH": @"/opt/local/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages", @"TMPDIR": @"/tmp"};
    task.launchPath = @"/usr/bin/python3";
    task.arguments = @[@"-B", @"/opt/local/bin/pygmentize", @"-f", @"html", targetEsc];

My only issue is that for whatever reason, /usr/bin/python3 cannot write to $TMPDIR:

python3: error: couldn't create cache file '/var/folders/qv/gnhwyzzx2wqfxq9mm_c4pb3r0000gn/T/xcrun_db-Xek3XirT' (errno=Operation not permitted)

I have added /usr/bin/python3 to Security & Privacy under the Privacy tab, under Development Tools and Full Disk Access. I've also done this with highlight and had no luck.

[Tatsh]

I think I've discovered that because of sandbox restrictions, a Quick Look plugin must have all properly signed binaries (even if only ad-hoc) and files it wishes to use within its bundle. In this project that's a highlight binary plus the Lua library it needs and the configuration files it uses.

I did build Highlight (outside of bundle) with a static Lua but then I only ran into a different sandbox error because Highlight needs to read its configuration.

[SergioSuarezGil]

+1 with js files

[Tatsh]

I'll be working on a patch to include Highlight and Lua in the built bundle.

[sbarex]

For my experience I suggest you statically link the lua library in highlight.
I'm not a c programmer but the operation is easy by editing the highlight makefile.
If you need some information, I can tell you how I did for my application.

I'll be working on a patch to include Highlight and Lua in the built bundle.

[Tatsh]

For my experience I suggest you statically link the lua library in highlight.
I'm not a c programmer but the operation is easy by editing the highlight makefile.
If you need some information, I can tell you how I did for my application.

I've already done this on my own. Whether it's linked statically or not is not going to make a difference here. The macOS sandbox since Big Sur just has more stringent requirements for plugins. It's going to be a lot easier to keep all binaries signed and contained within the bundle. It also makes this package easier to install since having highlight in PATH (or setting hlPath) is not necessary.

[sbarex]

I prefer statically so as not to have problems with paths and avoid the OS trying to pass the library installed in the system perhaps by homebrew (unsigned) instead of the one inserted in the application.

[fuzunspm]

qlmanage -p ~/Desktop/server.js

this works on DEBUG mode but on finder it shows white blank page. On console i managed to get this warning message below

/Users/username/Desktop/server.js
2020-11-25 11:19:47.470 qlmanage[16207:105092] could not create directory "/Users/username/Library/Caches/com.apple.quicklook.qlmanage/WebKit/ServiceWorkers" for future sandbox extension, error Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “ServiceWorkers” in the folder “WebKit”." UserInfo={NSFilePath=/Users/username/Library/Caches/com.apple.quicklook.qlmanage/WebKit/ServiceWorkers, NSUnderlyingError=0x7fc0a06aa030 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}

2020-11-25 11:19:47.584 qlmanage[16207:105092] *** CFMessagePort: bootstrap_register(): failed 1100 (0x44c) 'Permission denied', port = 0x14a03, name = 'com.apple.coredrag'
See /usr/include/servers/bootstrap_defs.h for the error codes.
2020-11-25 11:19:47.618 qlmanage[16207:105092] *** CFMessagePort: bootstrap_register(): failed 1100 (0x44c) 'Permission denied', port = 0xbe4b, name = 'com.apple.tsm.portname'

[Tatsh]

Yes it works on debug because sandbox restrictions are not so strict there (possibly because of you setting Terminal/etc to lessen restrictions in System Preferences - Security & Privacy).