Ruffle Bundles Cannot Load on macOS

[FrederickGeek8]

Describe the bug

For a while now, the Ruffle application on macOS is distributed (via GitHub) in a version that opts to enabled sandboxing (added in #6572). In practice, what this looks like is that when you run:

./Ruffle.app/Contents/MacOS/ruffle $(pwd)/movie.swf

you are prompted with a dialog that says (associated code)

The current movie is attempting to read files stored in {parent_path:?}.
To allow it to do so, click Yes, and then Open to grant read access to that directory.
Otherwise, click No to deny access.
upon "opening" the directory where the loaded files lay, you are able to load the .swf from your sandboxed version of Ruffle.

However, this functionality is broken for the .ruf Ruffle Bundle format.

When you try to open a .ruf bundle, with the command

./Ruffle.app/Contents/MacOS/ruffle $(pwd)/bundle/mybundle.ruf

the following happens:

1. The console shows the error "ERROR ruffle_desktop::player: Couldn't open bundle at "/blab/bla/bla/mybundle.ruf": Invalid bundle source: IO error opening file" (associated code)
2. The user is presented with the "The current movie is attempting to read files stored in..." dialog after loading has failed (associated code)
3. After selecting a directory, the console reads "ruffle_frontend_utils::backends::executor: Async error: Invalid SWF: Couldn't read SWF: Invalid data: Invalid SWF..." because it attempts to load the bundle (which failed to load due to permissions) as a normal SWF (there is even this comment in the bundle loading error handling).

Expected behavior

If we want to remain shipping a sandboxed version of the macOS app, then I would expect the behaviour to be the same as what currently happens when loading.swf files. This would involve adding a similar sort of permissions dialog step that is in navigator.rs to the Bundle loading code.

I have been familarizing myself with the codebase and I would love to help out developing a PR, but I would at least like to discuss how to approach this. If, for example, the open_file function in navigator.rs should be broken out into a more general utility function to support this change, then that seems like it would be a good design decision to discuss with others.

There is also the option to disable shipping a version of Ruffle with the macOS sandbox enabled, but I might open a separate ticket/discussion to address that and it's effect on current initiatives like on implementing an "Air Player". I'm not sure what the rationale was behind enabling that by default, but that seems like a larger discussion...

Content Location

The game that I've been working on maintaining a port of is copyrighted material, but any .ruf bundle should work. What is most important is that you use a nightly (GitHub) of Ruffle or build using a recipe similar to the GitHub actions where it installs the macOS entitlements forcing sandboxing.

Affected platform

Desktop app

Operating system

macOS Sonoma

Browser

No response

Additional information

For a little more context, I had a discussion with kjarosh in help channel the Ruffle Discord the other night when I figured out the root cause of these issues.

[FrederickGeek8]

For reproducing this issue, I've created the following bash script, which using the information in the GitHub Action to compile the .app with the sandbox enabled:
https://gist.github.com/FrederickGeek8/29b06d0b42793a9f5450ae2bf2afdda1

If you download that script to the root of the Ruffle build directory, then you can use:

chmod +x compile_ruffle_macos.sh;
./compile_ruffle_macos.sh

For an example, you can use the demo on the Ruffle website:

mkdir -p bundle_test/content;
curl -O https://ruffle.rs/demo/logo-anim.swf bundle_test/content/logo-anim.swf;

(Working): launch the .swf

./package/Ruffle\ Test.app/Contents/MacOS/ruffle $(pwd)/bundle_test/content/logo-anim.swf

To create a test bundle, you can put

[bundle]
name = "Ruffle Logo"
url = "file:///logo-anim.swf"

[player]
force_scale_mode = true

in bundle_test/ruffle-bundle.toml, then create a bundle with

cd bundle_test && zip -r bundle.ruf . && cd ..

(Not working) you can launch the bundle with:

./package/Ruffle\ Test.app/Contents/MacOS/ruffle $(pwd)/bundle_test/bundle.ruf

PS: It might be good to have @kmeisthax look at this issue since they introduced the sandboxing feature.