search

evgenyneu / keychain-swift

Helper functions for saving text in Keychain securely for iOS, OS X, tvOS and watchOS.
MIT License
2.85k stars 345 forks source link

Apple Privacy Manifest and Signing. #182

Open JLLA113 opened 9 months ago

JLLA113 commented 9 months ago

Hi,

Here with a possible issue or doubt.

Related to the Privacy Manifest I see that version 21.0.0 supports Privacy Manifest, but also Apple says that is mandatory to sign the sdk by the developer.

"Signatures are also required when the SDK is used as a binary dependency. This functionality is a step forward for all apps, and we encourage all SDKs to adopt it to better support the apps that depend on them."

Is it planned to integrate that?

Reference: https://developer.apple.com/news/?id=r1henawx

Thanks

evgenyneu commented 9 months ago

If signing is required then yes. Anyone knows how to sign a library?

ChrisMarshallNY commented 9 months ago

I don't think that you should sign, unless you are delivering a binary (usually in releases). The binary can be signed in the usual way. I believe that most open-source projects do this anyway.

Otherwise, the Git tags and commit hashes can provide a pretty good signing. I think that it may be possible to do more intense tags, but I've never bothered.