AppStore rejecting apps because of "(ITMS-91061) Missing privacy manifest"

[freakboy3742]

Describe the bug

We've had a report that the iOS App Store is rejecting apps with the following error:

ITMS-91061: Missing privacy manifest - Your app includes “Frameworks/_hashlib.framework/_hashlib.cpython-39-iphoneos.dylib”, which includes BoringSSL / openssl_grpc, an SDK that was identified in the documentation as a commonly used third-party SDK. If a new app includes a commonly used third-party SDK, or an app update adds a new commonly used third-party SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements.

ITMS-91061: Missing privacy manifest - Your app includes “Frameworks/_ssl.framework/_ssl.cpython-39-iphoneos.dylib”, which includes BoringSSL / openssl_grpc, an SDK that was identified in the documentation as a commonly used third-party SDK. If a new app includes a commonly used third-party SDK, or an app update adds a new commonly used third-party SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements.

Steps to reproduce

1. Submit a new app (or app update) that uses the Apple Support Package to the iOS App Store.

Expected behavior

App should be accepted.

Screenshots

No response

Environment

• Operating System: iOS (but probably macOS as well)
• Python version: 3.9+

Logs

Additional context

• Add an Apple privacy info file for OpenSSL openssl/openssl#24260 adds a candidate PrivacyInfo file for macOS builds
• OpenSSL iOS Privacy Manifest openssl/openssl#23262 is a discussion about the requirement for iOS
• iOS: Support Apple Privacy Manifest  openssl/openssl#23494 is a report on OpenSSL's repo about this issue on iOS

The candidate PrivacyInfo file from the macOS PR might be all that is needed here. We might need to incorporate PrivacyInfo handling into the framework build script, and include the PrivacyInfo file next to the .so files that are being processed.

[freakboy3742]

I have found the solution to this problem, confirmed by submitting an update to TravelTips to the App Store.

During the build process, when lib-dynload/_hashlib.cpython-3XX-iphoneos.so and lib-dynload/_ssl.cpython-3XX-iphoneos.so are converted into Frameworks, an additional file must be placed in the generated Framework, alongside the renamed binary.

The file must be called PrivacyInfo.xcprivacy; the contents of the file must be:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>C617.1</string>
            </array>
        </dict>
    </array>
    <key>NSPrivacyCollectedDataTypes</key>
    <array/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyTracking</key>
    <false/>
    </dict>
</plist>

So - the app bundle should contain (amongst many other files):

• My App.app
  • Frameworks
    • _hashlib.framework
      • _hashlib
      • _hashlib.origin
      • Privacy.xcprivacy
      • Info.plist
    • _ssl.framework
      • _ssl
      • _ssl.origin
      • Privacy.xcprivacy
      • Info.plist
    • ... other frameworks

This specific PrivacyInfo.xcprivacy file is only needed for library that statically link OpenSSL. Most libraries will not need an PrivacyInfo.xcprivacy file; only those that link one of the "known privacy issue" third-party libraries must include the file. However, the contents of that file will be specific to the library being linked.

The XML content provided for the OpenSSL version of PrivacyInfo.xcprivacy comes from OpenSSL itself. An official macOS OpenSSL framework includes this same file; Python needs to include it explicitly because it's linking statically with OpenSSL.

#285 contains a modification that looks for a LIBNAME.xcprivacy file during the framework conversion process, and if it exists, moves that file into the framework. This allows the Python support package - or any other binary library - to provide an xcprivacy file, and have that file included.