Hardened Runtime and Sandboxing Revisited

from blog The Desolation of Blog, | ↗ original
This is a follow-up to my earlier blog post as well as a response to a a blog post by the developers of GitFinder that was highlighted by Michael Tsai. Although GitFinder is distributed outside the Mac App Store, the developers nonetheless chose to sandbox it. The GitFinder app does not have the sandbox entitlement to access a user's Contacts (com.apple.security.personal-information.addressbook), but the GitFinder app does embed an xpc service with that sandbox entitlement. The xpc service accesses some information in the user's Contacts and passes that information back to the app. GitFinder does not currently enable the hardened runtime, but next year Apple will require all apps to enable the hardened runtime in order to get notarized for distribution outside the Mac App Store. The developers of GitFinder are upset because enabling the hardened runtime requires giving the Contacts sandbox entitlement to the app as well as to the embedded xpc service. Why is that necessary?