Appstore rejected our App when we integrated AppAuth SDK through Swift package manager

[jagadishviswanathan]

Describe the bug
We have integrated App auth SDK 1.7.5 version through Swift package manger in one of our IOS APP.

Below is the Apple rejecting after submitting App

ITMS-91065: Missing signature - Your app includes AppAuth, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: [https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks]

To Reproduce
Steps to reproduce the behavior:

1. Integrate App Auth SDK through SPM
2. Submit app to stores for review after signing the app

Expected behavior
Apple shouldn't reject app when App auth SDK is integrated.

Additional context
We have integrated App Auth SDK 1.7.5 version through Swift package manager.

[camden-king]

Hi,

We have investigated similar issues recently (#892, #883) and after internal investigation believe that the privacy manifest is correctly setup. Some things to check:

1. Is AppAuth being used as a framework?
   • If yes, you’re responsible for adding the signature as well as providing the privacy manifest (#892).
2. Is your AppAuth version up to date?
   • #832 fixed in version > 1.7.3.
3. Does your app have a privacy manifest?
   • If not, you likely need to create one following the instructions here. It's the host app and its identity provider that do the tracking (#807).

[jagadishviswanathan]

Hi, Thank you for your quick response. We have integrated and framework, missed to add signature. Added signature and submitted to stores for review . Thanks, [A blue and grey hexagon with a letter e<br><br>Description automatically generated with low confidence] Jagadish Viswanathan | Architect Software IV 7250 South Tenaya Way, Suite 100 | Las Vegas, NV 89113 ***@***.******@***.***> 585-754-7989 (m) 844.EVERI24 – customer support NYSE: EVRI [signature_2688832046] CONFIDENTIALITY NOTICE: This email (including any attachments) may contain confidential or privileged information and is intended solely for the addressee(s). If received in error, please notify the sender and permanently delete this email. Nothing in this email is intended to be construed as an offer of contract. Everi is not responsible for damages from use or reliance on this message, including without limitation opinions expressed by author or that this message is error and virus-free.

…

________________________________ From: Camden King ***@***.***> Sent: Thursday, December 26, 2024 1:17:40 PM To: openid/AppAuth-iOS ***@***.***> Cc: Viswanathan, Jagadish ***@***.***>; Author ***@***.***> Subject: Re: [openid/AppAuth-iOS] Appstore rejected our App when we integrated AppAuth SDK through Swift package manager (Issue #897) ** This Email came from an External Source ** - Hi, We have investigated similar issues recently (#892<#892>, #883<#883>) and after internal investigation believe that the privacy manifest is correctly setup. Some things to check: 1. Is AppAuth being used as a framework? * If yes, you’re responsible for adding the signature as well as providing the privacy manifest (#892<#892>). 2. Is your AppAuth version up to date? * #832<#832> fixed in version > 1.7.3. 3. Does your app have a privacy manifest? * If not, you likely need to create one following the instructions here<https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/adding_a_privacy_manifest_to_your_app_or_third-party_sdk?language=objc>. It's the host app and its identity provider that do the tracking (#807<#807 (comment)>). — Reply to this email directly, view it on GitHub<#897 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BIHUO2MYQYABA5UTF74MR5D2HRB4JAVCNFSM6AAAAABUAA4BGGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRTGAYDGNRTGE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[brnnmrls]

Woo! Closing this but feel free to comment/reopen if the issue persists.