topic Re: Support privacy manifest in Swift Maps SDK Questions

Support privacy manifest

trieunguyenaxon — Mon, 04 Dec 2023 10:09:37 GMT

We got a report from our security tool that ArcGIS SDK needs to add private reason for those API usage:

- User Defaults

- System Boot Time API

- Disk Space AP

- File Timestamp API

Regarding Apple document, we must address and fix them before Spring 2024, if not our application will be rejected by Apple: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api

From Apple words:

Important

From Fall 2023 you’ll receive an email from Apple if you upload an app to App Store Connect that uses required reason API without describing the reason in its privacy manifest file. From Spring 2024, apps that don’t describe their use of required reason API in their privacy manifest file won’t be accepted by App Store Connect.

Your app or third-party SDK must declare one or more approved reasons that accurately reflect your use of each of these APIs and the data derived from their use. You may use these APIs and the data derived from their use for the declared reasons only. These declared reasons must be consistent with your app’s functionality as presented to users, and you may not use the APIs or derived data for tracking.

Did those issues fix or any plan to resolve them?

Thanks!

Re: Support privacy manifest

ZacharyKline — Mon, 04 Dec 2023 17:04:13 GMT

Hello! Yes, we do plan on adding a privacy manifest and it will be a part of the next release which will be released in December. Also, can you clarify what this security tool is and what you are getting is from our SDK? Are those required reason APIs coming from another SDK your app is using or is it coming from the code you are using in your application? Thank you.

Re: Support privacy manifest

trieunguyenaxon — Tue, 05 Dec 2023 10:41:30 GMT

Hi @ZacharyKline,

Thanks for your information!

We're using Data Theorem to scan security and privacy issue: https://www.securetheorem.com

Here are result I got from this tool

1. App Store Blocker: Privacy Manifest is Missing System Boot Time API Usage Reason

2. App Store Blocker: Privacy Manifest is Missing Disk Space API Usage Reason

3. App Store Blocker: Privacy Manifest is Missing File Timestamp API Usage Reason

Re: Support privacy manifest

DeanKellyNISC — Wed, 31 Jan 2024 18:03:17 GMT

Are there any plans to add a manifest to 100.x versions at any point? We have a lot of legacy code we don't currently have the resources to upgrade and are depending on the older package which Apple may decide also needs a privacy manifest declared.

Re: Support privacy manifest

ZacharyKline — Thu, 01 Feb 2024 18:36:16 GMT

Hello Dean,

Thank you for your feedback. We will take it into consideration in the future.

Re: Support privacy manifest

DiveshGoyal — Fri, 10 May 2024 21:32:21 GMT

@DeanKellyNISC We have added privacy manifests for the 100.15.5 patch release of ArcGIS Runtime SDK for iOS