Privacy manifest aggregation picks reasons restricted to third-party SDKs
Nadie ha tomado este issue todavía.
- Lenguaje dominante
- C++
- Estrellas
- 127k
- Forks
- 25.3k
- Merge medio
- 1 d 23 h
- PR fusionados (30 d)
- 4
Descripción
Description
#44214 implemented a privacy manifest agregation mechanism, which would iterate through the privacy manifests from dependencies and add their required API reasons to the app privacy manifest.
However, according to the Apple documentation on privacy manifests, there are reasons that should only be used by third-party SDKs, such as 0A2A.1 and C56D.1. These reasons should not be copied into the app privacy manifest since the app is not a third-party SDK. Instead, the app developer should check which of the other reasons on the respective category applies to their usage of the third-party library.
So the aggregation mechanism should check if the reasons used in the privacy manifests from the dependencies are third-party exclusives. If they are, they should not be added to the app privacy manifest, and the developer could be prompted to pick other reasons.
Steps to reproduce
- Add a dependency whose privacy manifest declares a reason restricted to third-party SDKs, such as react-native-blob-util. That is already set up on the reproducer repo.
- On the
iosdirectory, runbundle install+bundle exec pod install - The
PrivacyInfo.xcprivacywill be changed. It will have the 0A2A.1 reason on theNSPrivacyAccessedAPICategoryFileTimestamp, which is restricted to third-party SDKs
React Native Version
0.74.4
Affected Platforms
Runtime - iOS, Build - MacOS
Output of npx react-native info
System:
OS: macOS 14.3
CPU: (8) x64 Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
Memory: 918.40 MB / 8.00 GB
Shell:
version: "5.9"
path: /bin/zsh
Binaries:
Node:
version: 18.17.0
path: ~/.local/share/nvm/v18.17.0/bin/node
Yarn:
version: 3.6.4
path: /usr/local/bin/yarn
npm:
version: 9.6.7
path: ~/.local/share/nvm/v18.17.0/bin/npm
Watchman: Not Found
Managers:
CocoaPods: Not Found
SDKs:
iOS SDK:
Platforms:
- DriverKit 23.2
- iOS 17.2
- macOS 14.2
- tvOS 17.2
- visionOS 1.0
- watchOS 10.2
Android SDK: Not Found
IDEs:
Android Studio: 2022.1 AI-221.6008.13.2211.9477386
Xcode:
version: 15.2/15C500b
path: /usr/bin/xcodebuild
Languages:
Java:
version: 11.0.18
path: /usr/bin/javac
Ruby:
version: 3.1.4
path: /Users/gabrielguilhoto/.rvm/rubies/ruby-3.1.4/bin/ruby
npmPackages:
"@react-native-community/cli": Not Found
react:
installed: 18.2.0
wanted: 18.2.0
react-native:
installed: 0.74.4
wanted: 0.74.4
react-native-macos: Not Found
npmGlobalPackages:
"*react-native*": Not Found
Android:
hermesEnabled: true
newArchEnabled: false
iOS:
hermesEnabled: true
newArchEnabled: false
Stacktrace or Logs
[Privacy Manifest Aggregation] Appending aggregated reasons to existing PrivacyInfo.xcprivacy file.
[Privacy Manifest Aggregation] Reading .xcprivacy files to aggregate all used Required Reason APIs.
Reproducer
https://github.com/gabrielguilhoto/rn-privacy-manifest-bug
Screenshots and Videos
No response
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Línea de trabajo
Empieza leyendo la implementación de agregación del privacy manifest de #44214 y, después, reproduce el problema en el repositorio enlazado rn-privacy-manifest-bug con bundle install y bundle exec pod install. Se considerará completado cuando los motivos restringidos a third-party SDKs, como 0A2A.1 y C56D.1, no se copien en el PrivacyInfo.xcprivacy de la aplicación, mientras que los motivos del resto de dependencias se sigan agregando correctamente.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- ios, react-native, ruby
- Área
- build-system, mobile
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 45/100