Find Required Reason API usage in Flutter Engine and create Privacy Manifest

[vashworth]

Introduced in Xcode 15, Apple is now flagging specific APIs as needed a “Required Reason” to use. All usages of “Required Reason” APIs MUST be outlined in a Privacy manifest. A Privacy manifest is a document outlining how your app/SDK collects and uses a user’s data.

This is also time sensitive (https://developer.apple.com/news/?id=z6fu1dcu).

Starting in fall 2023, when you upload a new app or app update to App Store Connect that uses an API (including from third-party SDKs) that requires a reason, you’ll receive a notice if you haven’t provided an approved reason in your app’s privacy manifest. And starting in spring 2024, in order to upload your new app or app update to App Store Connect, you’ll be required to include an approved reason in the app’s privacy manifest which accurately reflects how your app uses the API.

https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api?language=objc
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_data_use_in_privacy_manifests?language=objc
https://developer.apple.com/videos/play/wwdc2023/10060/

We'll probably want to also add testing to scan for Required Reason APIs, so they get caught when added.

[stuartmorgan]

For the flutter portion of the engine:

• NSURLContentModificationDateKey: One use, getting the app's modification time, so C617.1.
• fstat: Several non-timestamp-related usages.
• stat: Utility for monitoring file changes, which I believe is being wired up for FileSystemEntity.watch (although I need to verify that). We can't provide an answer here since we don't know what files an app developer may watch. How we handle this depends on Find Required Reason API usage in 1P Flutter Plugins and create Privacy Manifest if applicable #131495 (comment) (this will be true for the Dart SDK for dart:io as well).
• systemUptime: Used for event generation and management. Falls under 35F9.1.
• NSUserDefaults: Reading AppleInterfaceStyle, which isn't within the allowed reasons. There's a TODO for switch macOS dark mode KVO to effectiveAppearance/NSAppearance #32015, so we'll need to do that relatively soon. That's macOS.

I still need to evaluate all the third-party code we link statically.

[flutter-triage-bot]

The triaged-engine label is irrelevant if there is no team-engine label or fyi-engine label.

[stuartmorgan]

I'm still finishing the audit, but the new 0A2A.1 handles the large open question here about how to handle Dart's File timestamp APIs.

[stuartmorgan]

I've completed the audit of the engine and all of the third-party code it uses. For iOS release builds, we are covered by:

• File timestamps:
  • C617.1 for app state restoration in FlutterAppDelegate.mm.
  • 0A2A.1 for implementation of the relevant File wrappers.
• System boot time:
  • 35F9.1 for various event timing and elapsed time calculations.

[jmagman]

Thank you so much @stuartmorgan! I'll start on the PrivacyInfo.xcprivacy to be included in the Flutter.framework.

[jmagman]

Well flutter/engine#48951 didn't totally work:

I misread the NSPrivacyCollectedDataTypes section, I thought it wasn't needed. Will add an empty one.

[jmagman]

I misread the NSPrivacyCollectedDataTypes section, I thought it wasn't needed. Will add an empty one.

Never mind I did include NSPrivacyCollectedDataTypes, the error is complaining about NSPrivacyCollectedDataType.

https://github.com/flutter/engine/blob/a565cea256c7bafeaa0c26c2f1b0d66a52692d02/shell/platform/darwin/ios/framework/PrivacyInfo.xcprivacy#L9-L12

It probably wants an empty array, not an array with an empty dictionary.

	<key>NSPrivacyCollectedDataTypes</key>
-	<array>
-		<dict/>
- 	</array>
+ 	<array/>

And the error goes away, but the Privacy Report PDF is totally blank so...

[jmagman]

the Privacy Report PDF is totally blank so...

Blank in both Xcode 15.1 beta 3 and Xcode 15.2 beta. I'm going to close this since we aren't getting errors and the blank report seems like an Xcode bug. I'll play around with it more and file more issues if there's anything we can do about that. As far as I know the xcprivacy file is correct based on Stuart's audit.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

[jmagman]

This is available in 3.18.0-13.0.pre