Privacy manifest aggregation picks reasons restricted to third-party SDKs

Description

#44214 implemented a privacy manifest agregation mechanism, which would iterate through the privacy manifests from dependencies and add their required API reasons to the app privacy manifest.

However, according to the Apple documentation on privacy manifests, there are reasons that should only be used by third-party SDKs, such as 0A2A.1 and C56D.1. These reasons should not be copied into the app privacy manifest since the app is not a third-party SDK. Instead, the app developer should check which of the other reasons on the respective category applies to their usage of the third-party library.

So the aggregation mechanism should check if the reasons used in the privacy manifests from the dependencies are third-party exclusives. If they are, they should not be added to the app privacy manifest, and the developer could be prompted to pick other reasons.

Steps to reproduce

1. Add a dependency whose privacy manifest declares a reason restricted to third-party SDKs, such as react-native-blob-util. That is already set up on the reproducer repo.
2. On the ios directory, run bundle install + bundle exec pod install
3. The PrivacyInfo.xcprivacy will be changed. It will have the 0A2A.1 reason on the NSPrivacyAccessedAPICategoryFileTimestamp, which is restricted to third-party SDKs

React Native Version

0.74.4

Affected Platforms

Runtime - iOS, Build - MacOS

Output of npx react-native info

System:
  OS: macOS 14.3
  CPU: (8) x64 Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
  Memory: 918.40 MB / 8.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 18.17.0
    path: ~/.local/share/nvm/v18.17.0/bin/node
  Yarn:
    version: 3.6.4
    path: /usr/local/bin/yarn
  npm:
    version: 9.6.7
    path: ~/.local/share/nvm/v18.17.0/bin/npm
  Watchman: Not Found
Managers:
  CocoaPods: Not Found
SDKs:
  iOS SDK:
    Platforms:
      - DriverKit 23.2
      - iOS 17.2
      - macOS 14.2
      - tvOS 17.2
      - visionOS 1.0
      - watchOS 10.2
  Android SDK: Not Found
IDEs:
  Android Studio: 2022.1 AI-221.6008.13.2211.9477386
  Xcode:
    version: 15.2/15C500b
    path: /usr/bin/xcodebuild
Languages:
  Java:
    version: 11.0.18
    path: /usr/bin/javac
  Ruby:
    version: 3.1.4
    path: /Users/gabrielguilhoto/.rvm/rubies/ruby-3.1.4/bin/ruby
npmPackages:
  "@react-native-community/cli": Not Found
  react:
    installed: 18.2.0
    wanted: 18.2.0
  react-native:
    installed: 0.74.4
    wanted: 0.74.4
  react-native-macos: Not Found
npmGlobalPackages:
  "*react-native*": Not Found
Android:
  hermesEnabled: true
  newArchEnabled: false
iOS:
  hermesEnabled: true
  newArchEnabled: false

Stacktrace or Logs

[Privacy Manifest Aggregation] Appending aggregated reasons to existing PrivacyInfo.xcprivacy file.
[Privacy Manifest Aggregation] Reading .xcprivacy files to aggregate all used Required Reason APIs.

Reproducer

https://github.com/gabrielguilhoto/rn-privacy-manifest-bug

Screenshots and Videos

No response

Inizia leggendo l’implementazione dell’aggregazione del privacy manifest da #44214, quindi riproduci il problema nel repository collegato rn-privacy-manifest-bug con bundle install e bundle exec pod install. Il lavoro è completato quando i motivi limitati ai third-party SDKs, come 0A2A.1 e C56D.1, non vengono copiati nel PrivacyInfo.xcprivacy dell’app, mentre i motivi delle altre dipendenze continuano a essere aggregati correttamente.