chore(client/cordova/apple/ios): add privacy info to comply with Apple's API changes

[daniellacosse]

See: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api#4278393

It seems that a) this is only required for iOS as we never recieved an email about MacOS and b) that I'm able to target both the main Outline bundle and the VPNExtension with the same PrivacyInfo file.

The thing we need to do now is identify what our required reasons actually are. In the XCode UI they give a set of options to pick from for each:

[sbruens]

Looking at the docs I can't see how we use 3/4 of the APIs. Could they be coming from dependencies?

[sbruens]

I think this should be 1C8F.1 as we need it in the VpnExtension and the launcher (here), so it needs to be accessible to all members of the same App Group.

Source

[daniellacosse]

Thanks! I'll add this. All other reasons must be in our 3p dependencies.

[daniellacosse]

Looking at the docs I can't see how we use 3/4 of the APIs. Could they be coming from dependencies?

Yeah, must be. Will require a deeper dive, then.

[sbruens]

Looking at the docs I can't see how we use 3/4 of the APIs. Could they be coming from dependencies?

Yeah, must be. Will require a deeper dive, then.

So do we not need reasons for the other 3? Happy to approve if this is ready to go.

[daniellacosse]

Looking at the docs I can't see how we use 3/4 of the APIs. Could they be coming from dependencies?

Yeah, must be. Will require a deeper dive, then.

So do we not need reasons for the other 3? Happy to approve if this is ready to go.

Apologies, let me convert to draft. We need to look into our third party dependencies and figure out why they're using what they're using. AFAIK it's these:

Willing to bet most of it is Sentry: getsentry/sentry-cocoa#3192 (comment)

[fortuna]

This needs to be applied to macOS too.

[fortuna]

I think we need to update this file for macos too?

[sbruens]

I'm not sure what this file is doing here actually. It seems to have been newly created in #1958. The ios and macos Package.resolved files are already correctly updated in client/src/cordova/apple/ios.xcworkspace/xcshareddata/swiftpm/Package.resolved and client/src/cordova/apple/macos.xcworkspace/xcshareddata/swiftpm/Package.resolved respectively. Removing this file altogether.

[fortuna]

I think it works fine because we specify the full version and the revision is probably mapped 1:1 to the full version.

This picks the version if the version is not fully specified, similar to package-lock.json or go.sum

[sbruens]

Right, but my point is that this particular file isn't actually used. The Package.resolved files you are talking about are located under a different path, and are correctly updated in this PR. This particular file isn't used at all AFAICT and was likely erroneously added during the client move.

[sbruens]

I'm taking over this PR while Daniel is out. I've updated CocoaLumberjack and Sentry dependencies for ios and macos. I believe we can now remove those extra API types and only list the one we use, as we're pulling in the privacy manifests of our dependencies.

I tested this is a valid manifest via the Organizer, but without uploading the build to TestFlight we won't know 100% if Apple will accept. I propose we start here and add the keys if needed, rather than unnecessarily adding them now. I can attempt a TestFlight review once submitted, even if we don't intend to release it.

[fortuna]

Thanks for taking this over!

[fortuna]

I think we need to update this file for macos too?