react / react/react-native

Privacy manifest aggregation picks reasons restricted to third-party SDKs

Abierto
#45,852 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Issue: Author Provided Repro
Lenguaje dominante
C++
Estrellas
127k
Forks
25.3k
Merge medio
1 d 23 h
PR fusionados (30 d)
4

Descripción

Description

#44214 implemented a privacy manifest agregation mechanism, which would iterate through the privacy manifests from dependencies and add their required API reasons to the app privacy manifest.

However, according to the Apple documentation on privacy manifests, there are reasons that should only be used by third-party SDKs, such as 0A2A.1 and C56D.1. These reasons should not be copied into the app privacy manifest since the app is not a third-party SDK. Instead, the app developer should check which of the other reasons on the respective category applies to their usage of the third-party library.

So the aggregation mechanism should check if the reasons used in the privacy manifests from the dependencies are third-party exclusives. If they are, they should not be added to the app privacy manifest, and the developer could be prompted to pick other reasons.

Steps to reproduce
  1. Add a dependency whose privacy manifest declares a reason restricted to third-party SDKs, such as react-native-blob-util. That is already set up on the reproducer repo.
  2. On the ios directory, run bundle install + bundle exec pod install
  3. The PrivacyInfo.xcprivacy will be changed. It will have the 0A2A.1 reason on the NSPrivacyAccessedAPICategoryFileTimestamp, which is restricted to third-party SDKs
React Native Version

0.74.4

Affected Platforms

Runtime - iOS, Build - MacOS

Output of npx react-native info
System:
  OS: macOS 14.3
  CPU: (8) x64 Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
  Memory: 918.40 MB / 8.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 18.17.0
    path: ~/.local/share/nvm/v18.17.0/bin/node
  Yarn:
    version: 3.6.4
    path: /usr/local/bin/yarn
  npm:
    version: 9.6.7
    path: ~/.local/share/nvm/v18.17.0/bin/npm
  Watchman: Not Found
Managers:
  CocoaPods: Not Found
SDKs:
  iOS SDK:
    Platforms:
      - DriverKit 23.2
      - iOS 17.2
      - macOS 14.2
      - tvOS 17.2
      - visionOS 1.0
      - watchOS 10.2
  Android SDK: Not Found
IDEs:
  Android Studio: 2022.1 AI-221.6008.13.2211.9477386
  Xcode:
    version: 15.2/15C500b
    path: /usr/bin/xcodebuild
Languages:
  Java:
    version: 11.0.18
    path: /usr/bin/javac
  Ruby:
    version: 3.1.4
    path: /Users/gabrielguilhoto/.rvm/rubies/ruby-3.1.4/bin/ruby
npmPackages:
  "@react-native-community/cli": Not Found
  react:
    installed: 18.2.0
    wanted: 18.2.0
  react-native:
    installed: 0.74.4
    wanted: 0.74.4
  react-native-macos: Not Found
npmGlobalPackages:
  "*react-native*": Not Found
Android:
  hermesEnabled: true
  newArchEnabled: false
iOS:
  hermesEnabled: true
  newArchEnabled: false
Stacktrace or Logs
[Privacy Manifest Aggregation] Appending aggregated reasons to existing PrivacyInfo.xcprivacy file.
[Privacy Manifest Aggregation] Reading .xcprivacy files to aggregate all used Required Reason APIs.
Reproducer

https://github.com/gabrielguilhoto/rn-privacy-manifest-bug

Screenshots and Videos

No response

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Línea de trabajo

Empieza leyendo la implementación de agregación del privacy manifest de #44214 y, después, reproduce el problema en el repositorio enlazado rn-privacy-manifest-bug con bundle install y bundle exec pod install. Se considerará completado cuando los motivos restringidos a third-party SDKs, como 0A2A.1 y C56D.1, no se copien en el PrivacyInfo.xcprivacy de la aplicación, mientras que los motivos del resto de dependencias se sigan agregando correctamente.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
ios, react-native, ruby
Área
build-system, mobile
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
45/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.