Privacy manifest aggregation picks reasons restricted to third-party SDKs
还没有人认领这个 Issue。
- 主要语言
- C++
- 星标
- 127k
- 派生
- 25.3k
- 平均合并
- 1 天 23 小时
- 30 天内合并 PR
- 4
描述
Description
#44214 implemented a privacy manifest agregation mechanism, which would iterate through the privacy manifests from dependencies and add their required API reasons to the app privacy manifest.
However, according to the Apple documentation on privacy manifests, there are reasons that should only be used by third-party SDKs, such as 0A2A.1 and C56D.1. These reasons should not be copied into the app privacy manifest since the app is not a third-party SDK. Instead, the app developer should check which of the other reasons on the respective category applies to their usage of the third-party library.
So the aggregation mechanism should check if the reasons used in the privacy manifests from the dependencies are third-party exclusives. If they are, they should not be added to the app privacy manifest, and the developer could be prompted to pick other reasons.
Steps to reproduce
- Add a dependency whose privacy manifest declares a reason restricted to third-party SDKs, such as react-native-blob-util. That is already set up on the reproducer repo.
- On the
iosdirectory, runbundle install+bundle exec pod install - The
PrivacyInfo.xcprivacywill be changed. It will have the 0A2A.1 reason on theNSPrivacyAccessedAPICategoryFileTimestamp, which is restricted to third-party SDKs
React Native Version
0.74.4
Affected Platforms
Runtime - iOS, Build - MacOS
Output of npx react-native info
System:
OS: macOS 14.3
CPU: (8) x64 Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
Memory: 918.40 MB / 8.00 GB
Shell:
version: "5.9"
path: /bin/zsh
Binaries:
Node:
version: 18.17.0
path: ~/.local/share/nvm/v18.17.0/bin/node
Yarn:
version: 3.6.4
path: /usr/local/bin/yarn
npm:
version: 9.6.7
path: ~/.local/share/nvm/v18.17.0/bin/npm
Watchman: Not Found
Managers:
CocoaPods: Not Found
SDKs:
iOS SDK:
Platforms:
- DriverKit 23.2
- iOS 17.2
- macOS 14.2
- tvOS 17.2
- visionOS 1.0
- watchOS 10.2
Android SDK: Not Found
IDEs:
Android Studio: 2022.1 AI-221.6008.13.2211.9477386
Xcode:
version: 15.2/15C500b
path: /usr/bin/xcodebuild
Languages:
Java:
version: 11.0.18
path: /usr/bin/javac
Ruby:
version: 3.1.4
path: /Users/gabrielguilhoto/.rvm/rubies/ruby-3.1.4/bin/ruby
npmPackages:
"@react-native-community/cli": Not Found
react:
installed: 18.2.0
wanted: 18.2.0
react-native:
installed: 0.74.4
wanted: 0.74.4
react-native-macos: Not Found
npmGlobalPackages:
"*react-native*": Not Found
Android:
hermesEnabled: true
newArchEnabled: false
iOS:
hermesEnabled: true
newArchEnabled: false
Stacktrace or Logs
[Privacy Manifest Aggregation] Appending aggregated reasons to existing PrivacyInfo.xcprivacy file.
[Privacy Manifest Aggregation] Reading .xcprivacy files to aggregate all used Required Reason APIs.
Reproducer
https://github.com/gabrielguilhoto/rn-privacy-manifest-bug
Screenshots and Videos
No response
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
首先阅读 #44214 中的隐私清单聚合实现,然后在链接的 rn-privacy-manifest-bug 仓库中使用 bundle install 和 bundle exec pod install 重现该问题。当仅限于 third-party SDKs 的原因(例如 0A2A.1 和 C56D.1)不会被复制到应用的 PrivacyInfo.xcprivacy 中,同时其他依赖项的原因仍能正确聚合时,即表示完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- ios, react-native, ruby
- 领域
- build-system, mobile
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100