forcedotcom / forcedotcom/SalesforceMobileSDK-iOS-SPM

SmartStore 13.2.1 XCFramework appears unsigned while repackaging FMDB

Open
#24 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
4
Forks
6
PR merge metrics
No merged PRs in 30d

Description

## Summary

The official Salesforce Mobile SDK iOS SPM distribution for version 13.2.1
provides SmartStore as a prebuilt binary XCFramework.

The distributed SmartStore XCFramework appears to be unsigned, while the
binary contains repackaged FMDB classes such as `FMDatabase`,
`FMDatabasePool`, `FMDatabaseQueue`, and `FMResultSet`.

Apple explicitly lists FMDB as an SDK requiring a privacy manifest and, when
used as a binary dependency, an SDK signature. Apple's documentation also
states that this requirement applies to SDKs that repackage a listed SDK.

Reference:
https://developer.apple.com/support/third-party-SDK-requirements/

## Environment

- Salesforce Mobile SDK for iOS: 13.2.1
- Distribution:
https://github.com/forcedotcom/SalesforceMobileSDK-iOS-SPM
- Artifact: `SmartStore.xcframework.zip`
- Integration: Swift Package Manager
- Xcode: 26.6
- Swift: 6.3.3
- SQLCipher: 4.10.0

## Verification

The official 13.2.1 SmartStore archive was inspected without modifying or
re-signing it.

Signature verification of the device framework fails:

```shell
codesign --verify --strict --verbose=4 \
SmartStore.xcframework/ios-arm64/SmartStore.framework

Contributor guide

Open the contributing guide

Research direction

Inspect SmartStore.xcframework.zip from the Salesforce Mobile SDK iOS SPM distribution and start by running the reported codesign --verify --strict --verbose=4 check against SmartStore.xcframework/ios-arm64/SmartStore.framework. Compare the artifact's treatment of repackaged FMDB with Apple's third-party SDK requirements; done means the distributed SmartStore binary passes the required verification and includes the applicable compliance metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
mobile, release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.