gh-132006: Add support for handling XCPrivacy manifests #139163
Conversation
|
!buildbot iOS |
|
🤖 New build scheduled with the buildbot fleet by @freakboy3742 for commit 18f55ce 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F139163%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
There was a problem hiding this comment.
If I understand correctly, while copying .xcprivacy for third-party libs into the Python xcframework seems like the right thing to do (i.e. change 1 above), I don't think we should be supplying a hard-coded .xcprivacy file in the cpython repo for a third-party package (i.e. OpenSSL in step 2). While that is probably innocuous in this particular case as of current OpenSSL releases, there's no guarantee that it won't change in the future and is setting a precedent that might be problematic for another third-party package in the future. Since OpenSSL now provides .xcprivacy files in their current source releases (I looked at 3.0.17 and 3.5.3), we should be using the files as released which means that they should be included in any binary releases of the third-party packages that we use and copied from there.
When we get to the stage of building these third-party libs for iOS as part of the Python release process, it would be easy to handle this directly. I don't know how difficult it would be to include it with the beeware package that is being used at the moment but it seems to me that that would be the right place to pick it up from. There might have to be an interim solution but we should aim to not be duplicating such files in cpython: we shouldn't be making privacy assertions for other projects.
That's a fair point. It's not a major issue to add that file as part of the OpenSSL artefact generated as part of BeeWare's cpython-apple-source-deps repository; and I agree that it makes more sense to go direct to the source, rather than hard-code a version into CPython's codebase. I'm about to head to the airport to head back home; I'll work those changes through and update this PR once I'm back in the office. |
…th Python itself.
|
!buildbot iOS |
|
🤖 New build scheduled with the buildbot fleet by @freakboy3742 for commit ba3d408 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F139163%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
|
@ned-deily I've pushed an updated version of the OpenSSL library, which includes the .xcprivacy file as a resource. The build copies from that version, rather than including it as part of CPython sources. |
|
Thanks @freakboy3742 for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14. |
|
Sorry, @freakboy3742, I could not cleanly backport this to |
|
Ah - this can't be cherry picked until #139204 is merged. |
freakboy3742
added
needs backport to 3.14
|
Thanks @freakboy3742 for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14. |
…GH-139163) Adds a PrivacyInfo.xcprivacy file when packaging `_hashlib` and `_ssl` modules for iOS (based on the original OpenSSL sources); and adds handling to the build script to allow any app to add `xcprivacy` handling for a binary module. (cherry picked from commit 195d13c) Co-authored-by: Russell Keith-Magee <[email protected]>
|
GH-139410 is a backport of this pull request to the 3.14 branch. |
…9163) (#139410) Co-authored-by: Russell Keith-Magee <[email protected]>
The iOS App Store flags certain frameworks as being "privacy sensitive"; apps using those frameworks must provide an Privacy Manifest declaring why certain features are used.
This PR makes 2 changes:
.xcprivacyfile matching a binary module name is found next to the module while processing modules into frameworks, that.xcprivacyfile will be installed as part of the framework..xcprivacyfile is added to the standard library for_hashliband_ssl, as they both use OpenSSL, which is one of the "privacy sensitive" frameworks.📚 Documentation preview 📚: https://cpython-previews--139163.org.readthedocs.build/