search

thomasgalliker / Plugin.FirebasePushNotifications

Receive and handle firebase push notifications in .NET MAUI apps
MIT License
65 stars 5 forks source link

[Bug] Missing privacy manifest for iOS #58

Closed sgreifeneder closed 2 weeks ago

sgreifeneder commented 2 months ago

Description

Got the following message when submitting an app for review in App Store Connect:

ITMS-91061: Missing privacy manifest - Your app includes “Frameworks/FBLPromises.framework/FBLPromises”, which includes FBLPromises, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting November 12, 2024, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements.

For the following SDKs:

Steps to Reproduce

  1. Include Plugin.FirebasePushNotifications in a MAUI app
  2. Build and publish iOS app
  3. Send app to review

Expected Behavior

Actual Behavior

Basic Information

thomasgalliker commented 2 months ago

I think that‘s something you have to add to the app that is using this library. If I‘m wrong, let me know how I have to adjust this library.

sgreifeneder commented 2 months ago

We already have a privacy manifest for our app (I think you can't submit anymore without it). But in this case, the SDK/library provider has to include a privacy manifest as well.

Apple is also explicitly mentioning that:

Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest.

See also https://developer.apple.com/documentation/bundleresources/privacy_manifest_files https://developer.apple.com/support/third-party-SDK-requirements

thomasgalliker commented 2 months ago

Strangly, I cannot see this ITMS-91061 warnings in our solution. Do you get it when you upload the ipa file with Transporter.app? How can I reproduce this issue? - As far as I read on github, we need to place a privacy file in this library. I didn't know that.

sgreifeneder commented 2 months ago

I'm uploading the ipa file from a GitHub Action: apple-actions/upload-testflight-build But in the logs I can see that there are no errors (I also don't get any notification from Apple about it).

Only when I submit the build for review, I get a mail with the above mentioned warnings.

sgreifeneder commented 2 months ago

Hi @thomasgalliker, any update here?

thomasgalliker commented 2 months ago

No update yet in this direction. There is currently a lot of other priority work going on.

sgreifeneder commented 2 months ago

I don't know what your priority work is, but according to the Apple message, no one would be able to submit new apps or app updates using your Firebase PN SDK starting Nov 12th (which is in 2 months):

Starting November 12, 2024, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file.

As of now, Apple is still accepting the app, but I think this should be high prio.

thomasgalliker commented 2 months ago

Work performed for paying customers = priority work. You can fork this repo, add all privacy info needed to comply with Apple, create a merge request and I‘ll review it with high priority.

thomasgalliker commented 2 months ago

Newer versions of firebase-ios-sdk contain the necessary privacy manifest files (PrivacyInfo.xcprivacy). Therefore we need to resolve #19 first and get this issue resolved for free.

sgreifeneder commented 2 months ago

Ok, can you already estimate when the work on this can be started or how long it would take?

thomasgalliker commented 1 month ago

@sgreifeneder Do you like to test the latest version 3.0.x? It contains the firebase ios sdk 10.27.

sgreifeneder commented 1 month ago

Hi @thomasgalliker, thanks for the update, will try next week.

sgreifeneder commented 1 month ago

iOS push notifications worked for me, both foreground (prio high) and background. To verify the privacy manifest, I actually need to submit the app for review - unfortunately you don't get the issue when you just upload a binary to testflight. But as of now, 3.0.x is just a pre version. When are you planning to release a production 3.0.x?

thomasgalliker commented 1 month ago

True. 3.0.x is actually ready to be release for production. I could not find any problems with the latest 3.0.x pre-release. I'll create a stable 3.0.x release (maybe today). If the new iOS firebase bindings don't solve your problem, we're going to create another branch. I'll keep you updated.

sgreifeneder commented 1 month ago

Thanks. Is there a reason you went for firebase ios sdk version v10.27.0 and not a higher one? Latest one would be v11.3.0, and latest v10 version is v10.29.0

thomasgalliker commented 1 month ago

I basically just replaced Xamarin.Firebase.iOS.CloudMessaging with AdamE.Firebase.iOS.CloudMessaging in the iOS part of the library. Good question why AdamE.Firebase.iOS.CloudMessaging is not using the 11.x bindings. I can imagine its a tough work to keep these bindings updated. I‘m already happy to have v10.x tbh.

sgreifeneder commented 1 month ago

Agree, could be some work to migrate to a new major version, and he is also just a solo dev :) But he already released a v10.29.0.1 4 days ago, maybe you want to consider this version for production.

AlleSchonWeg commented 1 month ago

I published last week our iOS app to the App Store without problems. The app is still a Xamarin Forms app with the old CrossGeeks library. I have no privacy manifest in this app.

thomasgalliker commented 1 month ago

Ok, but I guess you took this nuget with the updated version 10.x bindings for your Xamarin app?

thomasgalliker commented 1 month ago

PR #74 is planned to contain the replacement of the Firebase iOS binding for MAUI. It will take some more days until I can release it.

AlleSchonWeg commented 1 month ago

Ok, but I guess you took this nuget with the updated version 10.x bindings for your Xamarin app?

No. The original nuget: https://www.nuget.org/packages/Plugin.FirebasePushNotification/3.4.35

sgreifeneder commented 2 weeks ago

@thomasgalliker since Nov 12th is approaching: do you already know, when a stable 3.x version will be released?

thomasgalliker commented 2 weeks ago

This change is released in version 3.0.17. Thanks everyone for the patience.

sgreifeneder commented 1 week ago

FYI I've updated to v3.0.17 and tested PNs on iOS and Android. All working as expected. I also uploaded my app to Testflight and released the app to the app stores, without any issue or warning about missing privacy manifests. Thanks!

thomasgalliker commented 1 week ago

Cool, thank you very much for your feedback!