From 8a7a4ca273b91ad8aa1f469534b365f6b1195631 Mon Sep 17 00:00:00 2001 From: Feodor Fitsner Date: Sun, 26 Jul 2026 11:38:46 -0700 Subject: [PATCH] Use OpenSSL's official privacy manifest for _ssl/_hashlib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The manifest bundled into _ssl.framework and _hashlib.framework was a stub: NSPrivacyAccessedAPITypes was an empty array, and it carried an NSPrivacyUsesNonStandardAPIs key that isn't part of Apple's schema. Both frameworks statically link OpenSSL, so the manifest should be the one OpenSSL publishes for its Apple builds — it declares the file-timestamp API access (NSPrivacyAccessedAPICategoryFileTimestamp, reason C617.1) that the library actually performs. Now byte-identical to openssl/openssl:os-dep/Apple/PrivacyInfo.xcprivacy. Context: flet-dev/flet#6724 reports ITMS-91065 ("Missing signature") for both frameworks on a first App Store submission. This does not obviously explain that rejection — Apple emitted no ITMS-91061, so it found the manifest — but an incomplete manifest for a binary Apple has fingerprinted as OpenSSL is a real defect worth eliminating before we test further. --- darwin/PrivacyInfo.xcprivacy | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/darwin/PrivacyInfo.xcprivacy b/darwin/PrivacyInfo.xcprivacy index 6d94afc..285dd5b 100644 --- a/darwin/PrivacyInfo.xcprivacy +++ b/darwin/PrivacyInfo.xcprivacy @@ -1,17 +1,23 @@ - + - NSPrivacyTracking - - NSPrivacyCollectedDataTypes - - NSPrivacyAccessedAPITypes - - NSPrivacyTrackingDomains - - NSPrivacyUsesNonStandardAPIs - + NSPrivacyAccessedAPITypes + + + NSPrivacyAccessedAPIType + NSPrivacyAccessedAPICategoryFileTimestamp + NSPrivacyAccessedAPITypeReasons + + C617.1 + + + + NSPrivacyCollectedDataTypes + + NSPrivacyTrackingDomains + + NSPrivacyTracking + - \ No newline at end of file +