Privacy warnings whilst using Realm swift from Apple

[naveengaur800]

How frequently does the bug occur?

Always

Description

When using the Realm-Swift version 10.48.1 and submitting the build to Apple, it creates warning for missing declaration in the privacy manifest file.

1. ITMS-91053: Missing API declaration - Your app’s code in the file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryDiskSpace

2. ITMS-91053: Missing API declaration - Your app’s code in the file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryFileTimestamp

It turns out Real Database is using statvfs and fstat which Apple might be picking up and sending us these warning. Are we able to add a privacy manifest for the RealmDatabase as well so that these warnings stop coming through? Thanks!

Stacktrace & log output

No response

Can you reproduce the bug?

Always

Reproduction Steps

1. Integrate Realm-Swift SDK to an app
2. Submit build to apple for review

Version

10.48.1

What Atlas Services are you using?

Local Database only

Are you using encryption?

No

Platform OS and version(s)

iOS

Build environment

Xcode version: ...
Dependency manager and version: ...

[sync-by-unito]

➤ PM Bot commented:

Jira ticket: RCOCOA-2328

[tgoyne]

How are you installing Realm?

[naveengaur800]

@tgoyne Installed directly via SPM with the instructions from the docs. I submitted a new app to isolate the issue and I get those two warnings after submission from Apple. I'm using the 10.48.1 version number

[naveengaur800]

I also noticed the privacy manifest inside the RealmSwift package is actually empty. Is that expected? I can see the privacy manifest populated in the Realm target though

[tgoyne]

Yes, the RealmSwift package is just a thin wrapper around the obj-c and c++ frameworks and doesn't directly touch the filesystem at all.

We might need to move the privacy manifest from the obj-c framework to the c++ framework for SPM since the c++ layer is actually exposed as a separate target. It sure would be nice if Apple actually provided validation tools for this (or did a less half-assed job of documenting it).

[naveengaur800]

@tgoyne Yeah tbh Apple should've provided some tool for this. The only way for us to be sure our changes are working is to submit the builds to them which is a pain. I've been using this tool for some help.
https://github.com/Wooder/ios_17_required_reason_api_scanner

Yeah let's try moving the privacy manifests as I think at the moment either Apple is not picking them up or there are usages at other places which don't have the privacy manifests declared

[kapitoshka438]

Sending a build to TestFlight beta review is enough to check if the privacy is correct. They will send a warning to your email if there are issues.

[naveengaur800]

@kapitoshka438 Yeah that's what I have been doing which resulted in these two warnings being generated when using realm

[sync-by-unito]

➤ Steven Poirot commented:

Hi, I'm new to using 3rd party SDKs and Realm, but I do want to use Realm in an app I am planning. I see that RealmSwift is listed as one of the SDKs that must have a signed privacy manifest (https://developer.apple.com/support/third-party-SDK-requirements/). Will Mongo or the community develop a manifest that we can all use? How will this play out? Thanks!

[nirinchev]

Yes, the plan is for us to publish a version with a corrected privacy manifest.

[enchantment-software]

Excellent, thanks!

[salvatoreboemia]

Yes, the plan is for us to publish a version with a corrected privacy manifest.

Do you have an ETA for this release? Because we still receive email from Apple due tue NS Disk access.

Thanks a lot

[mccaffers]

Commenting just to add my interest.

App Store Updates do get accepted at the mo, but only till 1st May

https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api

Thanks for your work!

[nirinchev]

The plan is to do this before May 1st.

[kapitoshka438]

If there is a hurry you can just add your own Privacy manifest and describe missing apis there.

[tgoyne]

Is anyone getting warnings not using SPM? I am currently assuming that only the SPM package requires changes.

[salvatoreboemia]

If there is a hurry you can just add your own Privacy manifest and describe missing apis there.

Yes, but is not the right way let me say. Basically, Apple gives us a global task for everyone. The best solution of course is that all SDK have their privacy manifest. Also because I not have an idea how the SDK uses the Disk API for example.

I think the current issue is because inside this folder:

the privacy manifest is empty

I hope you could fix it asap.

thanks

[naveengaur800]

@salvatoreboemia The reason for the empty privacy manifest was discussed earlier in this thread here
#8535 (comment)

Yes, the RealmSwift package is just a thin wrapper around the obj-c and c++ frameworks and doesn't directly touch the filesystem at all.

We might need to move the privacy manifest from the obj-c framework to the c++ framework for SPM since the c++ layer is actually exposed as a separate target. It sure would be nice if Apple actually provided validation tools for this (or did a less half-assed job of documenting it).

[nirinchev]

I've locked the conversation for now. As already mentioned, we do plan to release a version of the Realm Swift SDK with the necessary privacy manifest changes ahead of the May 1st deadline by Apple. We've already implemented the fix and it's just pending a release.

[nirinchev]

Folks, we've released 10.49.2 of the Realm Swift SDK which should be addressing the privacy manifest issues. Can you test it out and confirm you no longer get warnings from Apple about it?

[kapitoshka438]

@nirinchev do you plan to provide long-term support for the old db format and release 10.48.2 with the privacy fixes? We are not sure about when we are going to upgrade our apps to 10.49

[nirinchev]

This is already being discussed in #8558. We'll consider backporting the privacy manifest for 10.48, but we need to first confirm that what we have works at all. We believe it should, but we had a user open #8555 claiming it doesn't without coming back with more info. That's why we're looking for help from the community to try and gather more details.

[salvatoreboemia]

Folks, we've released 10.49.2 of the Realm Swift SDK which should be addressing the privacy manifest issues. Can you test it out and confirm you no longer get warnings from Apple about it?

Nope. Also in 10.49.2 still have same issue.

[SESA762550]

@nirinchev I am trying to install versions 10.48.2 through Cocoapods but getting below error
[!] CocoaPods could not find compatible versions for pod "RealmSwift":
In Podfile:
RealmSwift (= 10.48.2)

None of your spec sources contain a spec satisfying the dependency: RealmSwift (= 10.48.2).

You have either:

• mistyped the name or version.
• not added the source repo that hosts the Podspec to your Podfile.

Please help me out here as i am really struggling to update the Realm with the latest Privacy Manifest Changes. I can't use version 10.49 as i have a production app which is using older Realm DB version (Realm version - 3.21)

[nirinchev]

10.48.2 was only released for people who are on SPM. Our understanding is that 10.48.1 should work for developers who are using Cocoapods and pull in the correct privacy manifests. If that's not the case, please file a new issue outlining the behavior you're seeing.