[url_launcher] ITMS-91065: Missing signature in add-to-app

[namtn]

Use case

I uploaded my app using: url_launcher to testflight, however Apple rejected it with following reason:

ITMS-91065: Missing signature - Your app includes “Frameworks/url_launcher_ios.framework/url_launcher_ios”, which includes url_launcher_ios, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.

Proposal

Please help to resolve this issue?

Updated: Version url_launcher: ^6.2.6 and url_launcher_ios in pubspec.lock is: 6.3.0:
url_launcher_ios: dependency: transitive description: name: url_launcher_ios sha256: "7068716403343f6ba4969b4173cbf3b84fc768042124bc2c011e5d782b24fe89" url: "https://pub.dev" source: hosted version: "6.3.0"

[navaronbracke]

What version of url_launcher_ios does your pubspec.lock indicate? You need version 6.2.4 or higher.

https://pub.dev/packages/url_launcher_ios/changelog#624

[namtn]

What version of url_launcher_ios does your pubspec.lock indicate? You need version 6.2.4 or higher.

https://pub.dev/packages/url_launcher_ios/changelog#624

Hi navaronbracke:
I'm using 6.2.5 verion, so 6.2.4 will work?

Thanks

url_launcher_ios: dependency: transitive description: name: url_launcher_ios sha256: "9149d493b075ed740901f3ee844a38a00b33116c7c5c10d7fb27df8987fb51d5" url: "https://pub.dev" source: hosted version: "6.2.5"

[darshankawar]

@namtn
This seems to be already addressed as part of #139759 that you can check and confirm.

[namtn]

@namtn

This seems to be already addressed as part of #139759 that you can check and confirm.

@darshankawar I don't really understand how to resolve it.

[navaronbracke]

@namtn If you use url_launcher 6.2.6 you should be good. It depends on url_launcher_ios 6.2.4 or higher here https://github.com/flutter/packages/blob/main/packages/url_launcher/url_launcher/pubspec.yaml#L32

As noted in the url_launcher changelog, that version specifically bumps the version of url_launcher_ios for this exact reason.

[namtn]

@namtn If you use url_launcher 6.2.6 you should be good. It depends on url_launcher_ios 6.2.4 or higher here https://github.com/flutter/packages/blob/main/packages/url_launcher/url_launcher/pubspec.yaml#L32

As noted in the url_launcher changelog, that version specifically bumps the version of url_launcher_ios for this exact reason.

I tried with latest version 6.2.6, however apple still rejected.

[navaronbracke]

Did you do the following as well?

• delete ios/Podfile.lock
• flutter clean && flutter pub get
• cd ios && pod repo update && pod install

Your pods might have been outdated.

[namtn]

Did you do the following as well?

• delete ios/Podfile.lock

• flutter clean && flutter pub get

• cd ios && pod repo update && pod install

Your pods might have been outdated.
@navaronbracke
I,ve done few times before I create this issue.

[namtn]

@navaronbracke I also remove Pods folder and Podfile.lock

[MarkLevtin]

I have the same problem with a Flutter module project. In the module project, there is no "ios" folder at all, there is ".ios" folder that is created on-the-fly during project build. BTW, Apple complains on the lack of signature. Is the new version of the framework is signed correctly?

[namtn]

I have the same problem with a Flutter module project. In the module project, there is no "ios" folder at all, there is ".ios" folder that is created on-the-fly during project build. BTW, Apple complains on the lack of signature. Is the new version of the framework is signed correctly?

Me too, I created flutter module and build ios-framework then embed in swift project.

[darshankawar]

I have the same problem with a Flutter module project. In the module project, there is no "ios" folder at all, there is ".ios" folder that is created on-the-fly during project build. BTW, Apple complains on the lack of signature. Is the new version of the framework is signed correctly?

@MarkLevtin Maybe you can check #147140 for further reference.

[darshankawar]

For @namtn's issue, keeping the issue open for team's input / attention on reported behavior.

[namtn]

I think flutter team should signed for url_launcher_ios.xcframework as Flutter.xcframework

[stuartmorgan]

It sounds like we'll probably need to update the add-to-app documentation to provide guidance here; presumably the application project is going to need to sign plugin builds that are on Apple's enforcement list.

I think flutter team should signed for url_launcher_ios.xcframework as Flutter.xcframework

This is not possible; Flutter.xcframework is built by the Flutter team and distributed in pre-compiled form. Plugins, such as url_launcher_ios, are built from source on your machine.

[namtn]

It sounds like we'll probably need to update the add-to-app documentation to provide guidance here; presumably the application project is going to need to sign plugin builds that are on Apple's enforcement list.

@stuartmorgan could you tell me how to resolved issue?

[MarkLevtin]

I have the same problem with a Flutter module project. In the module project, there is no "ios" folder at all, there is ".ios" folder that is created on-the-fly during project build. BTW, Apple complains on the lack of signature. Is the new version of the framework is signed correctly?

@MarkLevtin Maybe you can check #147140 for further reference.

@darshankawar @stuartmorgan Interestingly enough, I have a few packages (frameworks) included in my Flutter module that require a privacy manifest according to Apple: device_info_plus, package_info_plus, share_plus, connectivity_plus and url_launcher_ios. Initially, I had a problem with all of them but after updating pub dependencies to the latest version of all packages, the problem disappeared for device_info_plus, package_info_plus and share_plus. Unfortunately, connectivity_plus and url_launcher_ios are still problematic. Is there anything different in terms of a privacy manifest between all these packages?

[vashworth]

Me too, I created flutter module and build ios-framework then embed in swift project.

When you embed the frameworks, do you have "Embed & Sign" selected?

Example:

[MarkLevtin]

Me too, I created flutter module and build ios-framework then embed in swift project.

When you embed the frameworks, do you have "Embed & Sign" is selected?

Example:

@vashworth yep, "Embed & Sign" is selected.

[jmagman]

@MarkLevtin are you actually hitting the "Missing signature" App Store error, since your question was about privacy manifests?

@namtn can you confirm you have "Embed & Sign" selected, as @vashworth suggests?

[MarkLevtin]

@MarkLevtin are you actually hitting the "Missing signature" App Store error, since your question was about privacy manifests?

@jmagman I am hitting "Missing signature" error. Originally, I was hitting "Missing signature" for 5 Flutter frameworks: device_info_plus, package_info_plus, share_plus, connectivity_plus and url_launcher_ios. All of these frameworks are considered by Apple as "privacy-impacting third-party SDK". After I updated all frameworks to the latest versions, the error has been resolved for 3 of them: device_info_plus, package_info_plus, share_plus but still exists for connectivity_plus and url_launcher_ios. The main difference between updated and older versions of all of these frameworks is introduction of a privacy manifest. Moreover, the "Missing signature" errors started to appear after May 1, meaning, after Apple introduced mandatory privacy manifest requirement. That's why I think that "Missing signature" is somehow related to the privacy but it is just my wild guess.

@namtn can you confirm you have "Embed & Sign" selected, as @vashworth suggests?

In my case, it is selected.

[namtn]

@MarkLevtin are you actually hitting the "Missing signature" App Store error, since your question was about privacy manifests?

@namtn can you confirm you have "Embed & Sign" selected, as @vashworth suggests?

@jmagman , @vashworth :

Confirmed, please check my accta

cted image.

[namtn]

Hi all, to resolve this issue, I have to signed all frameworks mannually, exclude frameworks has signed by other teams (example Flutter.xcframework):

1. build ios framework using command: flutter build ios-framework
2. Run script to sign frameworks:

#!/bin/bash

# Path to the output directory containing the built frameworks
OUTPUT_DIR="./Release"

# Path to your codesigning identity
CODESIGN_IDENTITY="Apple Development: NamTran (XXXXX7777)"

# Sign each framework
for framework in "$OUTPUT_DIR"/*.xcframework; do
echo "Signing $framework with identity $CODESIGN_IDENTITY"
framework_name=$(basename "$framework")

if [ "$framework_name" != "Flutter.xcframework" ]; then
echo "Signing $framework with identity $CODESIGN_IDENTITY"
/usr/bin/codesign --force --sign "$CODESIGN_IDENTITY" "$framework"
else
echo "Skipping $framework"
fi

done

echo "Frameworks signed successfully."

[cbracken]

As implementation notes to the person who picks this up: @vashworth and @jmagman suggest that perhaps what we should be doing is doing codesigning during the build ios-framework command.

[jmagman]

It sounds like we would need to codesign the xcframework here:

flutter/packages/flutter_tools/lib/src/commands/build_ios_framework.dart

Line 141 in b2eda06

static Future<void> produceXCFramework(