search

google / webcrypto.dart

Cross-platform implementation of Web Cryptography APIs
https://pub.dev/packages/webcrypto
Apache License 2.0
78 stars 45 forks source link

Declare privacy manifest file for Apple #112

Closed harkairt closed 4 months ago

harkairt commented 4 months ago

boringssl implementation requires NSPrivacyAccessedAPICategoryFileTimestamp which is a require reason API

Apple announcement here: developer.apple.com/support/third-party-SDK-requirements

May 1st deadline announcement here: developer.apple.com/news/?id=3d8a9yyh (reminder announcement here: https://developer.apple.com/news/?id=pvszzano)

This was the analyzer used which have reported the following:

Analyzing webcrypto ...
Mach-O Type: mh_dylib
⚠️  Missing privacy manifest file!
API usage analysis result(s): 1
[0] NSPrivacyAccessedAPICategoryFileTimestamp:stat:/<redacted>/.pub-cache/hosted/pub.dev/webcrypto-0.5.6/third_party/boringssl/src/crypto/x509/by_dir.c
🛠️  Descriptions for the following required API reason(s) may be missing: 1
[0] NSPrivacyAccessedAPICategoryFileTimestamp
jonasfj commented 4 months ago

I'm suspicious of this claim. I'm also poorly informed about the new privacy manifest, etc.

But third_party/boringssl/src/crypto/x509/by_dir.c is only accessed during the build process. The file is NOT shipped into application, as far as I understand how iOS applications are shipped. I'll admit I have limited knowledge here and this is not my area of expertise.

Please clarify what and why you think this is necessary, be specific. Output from a generic analyzer without clear steps on how to reproduce and minimal reproduction example is not helpful.

harkairt commented 4 months ago

Fair, let me get back to this once we submit our next release for review. Context: our latest submission (prior to May 1) got a warning that soon we will need to define why our app uses NSPrivacyAccessedAPICategoryUserDefaults (which is not the one in the issue description: NSPrivacyAccessedAPICategoryFileTimestamp). So I looked around and found this analyzer (that I've linked) which nicely outputted similar result, and also some other potentially missing information. (like webrypto's) In order to be consistent I leaned to resolve all the reported warnings, and because I found similar issues for other packages (requiring privacy manifest) I went ahead and created one for webcrypto myself.

It could very well be that this is a false positive from the analyzer, as you say this is not shipped into the app. I also have limited knowledge about these, especially since this is some new requirement that app developers need to comply to.

Once the next review comes back I'll update this ticket, most probably it can be closed, as initially we did not get the warning for the NSPrivacyAccessedAPICategoryFileTimestamp API.

jonasfj commented 4 months ago

Cool, please do let us know how it plays out.

Feel free to ping me if there is anything actionable, full disclosure I don't always manage to follow chatter on issues when not explicitly mentioned.

harkairt commented 4 months ago

The review process went through without an issue! ✅