Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add privacy manifest #2252

Merged
merged 4 commits into from
Dec 8, 2023
Merged

Add privacy manifest #2252

merged 4 commits into from
Dec 8, 2023

Conversation

calda
Copy link
Member

@calda calda commented Dec 8, 2023

This PR adds a privacy manfiest (PrivacyInfo.xcprivacy), which will be required for privacy-impacting SDKs (including Lottie) starting in spring 2024. Fixes #2213.

We can include the manifest as a resource in our dependency definitions and Xcode project schemes. I verified that Lottie.framework and Lottie.xcframework build products now include the privacy manifest file.

We will additionally need to code sign Lottie.xcframework, but that will come later in a follow-up.

<array>
<dict>
<key>NSPrivacyAccessedAPIType</key>
<string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now I think we can just manually incorporate this into our manifest

Copy link
Contributor

@thedrick thedrick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM @calda

@calda calda enabled auto-merge (squash) December 8, 2023 21:32
@calda calda merged commit e7ed4b7 into master Dec 8, 2023
16 checks passed
@calda calda deleted the cal--privacy-manifest branch December 8, 2023 22:10
@TheRogue76
Copy link

Heya! Lottie React Native maintainer here.

Had a couple of questions regarding this and i figured this might be the best place to ask:

  • Do you know when you might release a new version with this change included so i can bump the dependency back in LRN's repo? Is there anything blocking that i can help with?
  • Was there any sort of gotcha that you guys ran into while implementing this that i can benefit from knowing? LRN is more or less a separate SDK, so i figure i would need to do the same back there as well and i would really appreciate knowing if there is any specific thing that might become a headache.

Cheers and thanks for the response in advance

@calda
Copy link
Member Author

calda commented Jan 10, 2024

I currently plan on releasing 4.4.0 once a production Xcode version that includes the Apple Vision Pro SDK is released, since that will let us add support for Apple Vision Pro to lottie-spm. I imagine this will be within the next month.

No gotchas so far, although the implementation in this PR wasn't quite correct according to #2268.

@calda
Copy link
Member Author

calda commented Jan 10, 2024

Oh, Xcode 15.2 already includes the visionOS SDK. Great! I'll release 4.4.0 after sorting out visionOS support then.

@TheRogue76
Copy link

Thank you. Sounds good. Yeah, i read the other PR as well. I'll keep it in mind.
BTW, i just saw how many issues for LRN had been opened in this repo. Sorry for the headache they caused. Feel free to ping if it looks like someone is being particularly difficult.

@dcacenabes
Copy link
Contributor

dcacenabes commented Jan 12, 2024

Hey! I know this is already marked as resolved but I am not 100% confident of the solution for Cocoapods. Merged solution is using .resource, and depending on how you are integrating the library in your project you might end up overriding the privacy file from the main app or other frameworks. From their docs:

resourcesmulti-platform
A list of resources that should be copied into the target bundle.
For building the Pod as a static library, we strongly recommend library developers to adopt resource bundles as there can be name collisions using the resources attribute. Moreover, resources specified with this attribute are copied directly to the client target and therefore they are not optimised by Xcode.

Would it be possible to use resource_bundles instead?

s.resource_bundles = {
    'LottiePrivacy' => ['PrivacyInfo.xcprivacy'],
}

@maurovc
Copy link

maurovc commented Jan 12, 2024

Additionally to @dcacenabes' comment here's a great summary of the issue of using resource vs resource_bundle

@calda
Copy link
Member Author

calda commented Jan 12, 2024

@dcacenabes, any interest in submitting a PR with that update?

@dcacenabes
Copy link
Contributor

@dcacenabes, any interest in submitting a PR with that update?

100% Will ship it shortly

@dcacenabes
Copy link
Contributor

#2288 👍

@calda
Copy link
Member Author

calda commented Jan 23, 2024

We released Lottie 4.4.0, which now includes a privacy manifest. https://github.com/airbnb/lottie-ios/releases/tag/4.4.0

@TheRogue76
Copy link

TheRogue76 commented Jan 23, 2024

We released Lottie 4.4.0, which now includes a privacy manifest. https://github.com/airbnb/lottie-ios/releases/tag/4.4.0

Beautiful. I'll bump it up in our podspec. Thank you for the ping @calda !

@honkmaster
Copy link

honkmaster commented Jan 23, 2024

Could you explain why Lottie is privacy-impacting? Of course, Apple may think it is, but isn't Lottie just a UI framework?

@calda
Copy link
Member Author

calda commented Jan 23, 2024

Lottie does not impact user privacy in any way because it doesn't collect or track any data. We are providing a privacy manifest because it is required by Apple: https://developer.apple.com/support/third-party-SDK-requirements/

@honkmaster
Copy link

Lottie does not impact user privacy in any way because it doesn't collect or track any data. We are providing a privacy manifest because it is required by Apple: https://developer.apple.com/support/third-party-SDK-requirements/

Ok, so you guys are like me with SVProgressHUD. I'm still trying to understand why we're on the list. Seems like maybe it's just due to popularity and not real privacy concerns which is … interesting. Thanks @calda.

@calda
Copy link
Member Author

calda commented Jan 23, 2024

Yeah, I believe it's related to popularity. Fortunately it is really easy to provide a privacy manifest, especially if it's mostly empty! Adopting code signing was more difficult (#2259, necessary for us since we distribute precompiled binaries via lottie-spm).

cgrindel-self-hosted-renovate bot referenced this pull request in cgrindel/rules_swift_package_manager Jan 23, 2024
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | minor |
`from: "4.3.4"` -> `from: "4.4.0"` |

---

### Release Notes

<details>
<summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary>

###
[`v4.4.0`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.0)

[Compare
Source](https://togithub.com/airbnb/lottie-spm/compare/4.3.4...4.4.0)

#### New features

- Add privacy manifest
([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252))
- Codesign Lottie.xcframework
([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259))
- Add time remapping support to Core Animation rendering engine
([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286))
- Add official visionOS support to lottie-ios repo
([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287))
- lottie-spm now supports visionOS
([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12))
- Adopt policy on minimum supported Swift / Xcode version, update
minimum versions to Swift 5.7 / Xcode 14.1
([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260))

#### Bug fixes

- Update LottieView to display placeholder using `overlay` instead of
`ZStack`
([https://github.com/airbnb/lottie-ios/pull/2289](https://togithub.com/airbnb/lottie-ios/pull/2289))
- Fix issue where Core Animation rendering engine couldn't display last
frame of animation when paused
([https://github.com/airbnb/lottie-ios/pull/2254](https://togithub.com/airbnb/lottie-ios/pull/2254))
- Do not create `DotLottieImageProvider` instance if there's no image
files
([https://github.com/airbnb/lottie-ios/pull/2271](https://togithub.com/airbnb/lottie-ios/pull/2271))
- Mark DotLottieCache as Sendable
([https://github.com/airbnb/lottie-ios/pull/2245](https://togithub.com/airbnb/lottie-ios/pull/2245))
- Fix issue where AnimationKeypath in SolidLayer could be incorrect
([https://github.com/airbnb/lottie-ios/pull/2278](https://togithub.com/airbnb/lottie-ios/pull/2278))
- Fix issue where Repeater could be displayed incorrectly
([https://github.com/airbnb/lottie-ios/pull/2276](https://togithub.com/airbnb/lottie-ios/pull/2276))
- Include dSYMs in xcframework build
([https://github.com/airbnb/lottie-ios/pull/2284](https://togithub.com/airbnb/lottie-ios/pull/2284))
- Fix parsing issue, add support for DotLottieConfiguration in SwiftUI
LottieView
([https://github.com/airbnb/lottie-ios/pull/2277](https://togithub.com/airbnb/lottie-ios/pull/2277))
- Fix issue where DotLottieImageProvider didn't handle base64 images
([https://github.com/airbnb/lottie-ios/pull/2283](https://togithub.com/airbnb/lottie-ios/pull/2283))
- Fix issue where manually interpolated keyframes could animate
incorrectly
([https://github.com/airbnb/lottie-ios/pull/2285](https://togithub.com/airbnb/lottie-ios/pull/2285))

**Full Changelog**:
airbnb/lottie-ios@4.3.4...4.4.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjM2LjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>
iago849 pushed a commit to atteamapps/lottie-ios that referenced this pull request Feb 8, 2024
@Anbu-iOS
Copy link

Hi, still the issue is persist in the latest 4.4.0.
no rule to process file '../Source/Pods/lottie-ios/Sources/PrivacyInfo.xcprivacy' of type 'text.xml' for architecture 'arm64' (in target 'lottie-ios' from project 'Pods')

cgrindel-self-hosted-renovate bot referenced this pull request in cgrindel/rules_swift_package_manager Feb 22, 2024
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch |
`from: "4.4.0"` -> `from: "4.4.1"` |

---

### Release Notes

<details>
<summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary>

###
[`v4.4.1`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.1)

[Compare
Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.0...4.4.1)

##### Bug fixes in 4.4.1

- Replace os check with canImport so classes are available on visionOS
([https://github.com/airbnb/lottie-ios/pull/2294](https://togithub.com/airbnb/lottie-ios/pull/2294))
- Omit privacy manifest from source files in podspec
([https://github.com/airbnb/lottie-ios/pull/2307](https://togithub.com/airbnb/lottie-ios/pull/2307))
- Fix crash in Main Thread rendering engine path interpolation
implementation
([https://github.com/airbnb/lottie-ios/pull/2305](https://togithub.com/airbnb/lottie-ios/pull/2305))
- Fix warning from invalid character in Cocoapods resource bundle
identifier
([https://github.com/airbnb/lottie-ios/pull/2317](https://togithub.com/airbnb/lottie-ios/pull/2317))
- Fix infinite loop when setting `LottieAnimationView.viewportFrame`
([https://github.com/airbnb/lottie-ios/pull/2316](https://togithub.com/airbnb/lottie-ios/pull/2316))

##### New features in 4.4.0

- Add privacy manifest
([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252))
- Codesign Lottie.xcframework
([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259))
- Add time remapping support to Core Animation rendering engine
([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286))
- Add official visionOS support to lottie-ios repo
([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287))
- lottie-spm now supports visionOS
([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12))
- Adopt policy on minimum supported Swift / Xcode version, update
minimum versions to Swift 5.7 / Xcode 14.1
([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260))

**Full Changelog**:
airbnb/lottie-ios@4.4.0...4.4.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjM2LjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>
@tscholze
Copy link

tscholze commented Apr 2, 2024

Do I need to reference the privacy manifest somewhere else? I still get the error from the App Store Connect. :/

cgrindel-self-hosted-renovate bot referenced this pull request in cgrindel/rules_swift_package_manager Apr 8, 2024
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch |
`from: "4.4.1"` -> `from: "4.4.2"` |

---

### Release Notes

<details>
<summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary>

###
[`v4.4.2`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.2)

[Compare
Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.1...4.4.2)

##### Changes in 4.4.2

- Update minimum deployment target to iOS 13.0 / macOS 10.15
([https://github.com/airbnb/lottie-ios/pull/2322](https://togithub.com/airbnb/lottie-ios/pull/2322))
- Add privacy manifest to lottie-spm repo
([https://github.com/airbnb/lottie-spm/pull/23](https://togithub.com/airbnb/lottie-spm/pull/23))
- Add visionOS support to Cocoapods podspec
([https://github.com/airbnb/lottie-ios/pull/2348](https://togithub.com/airbnb/lottie-ios/pull/2348))
- Fix incorrect usage of `State(initialValue:)` in `LottieView`
([https://github.com/airbnb/lottie-ios/pull/2357](https://togithub.com/airbnb/lottie-ios/pull/2357))
- Use correct version number when building XCFramework bundle
([https://github.com/airbnb/lottie-ios/pull/2341](https://togithub.com/airbnb/lottie-ios/pull/2341))

##### New features in 4.4.0

- Add privacy manifest
([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252))
- Codesign Lottie.xcframework
([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259))
- Add time remapping support to Core Animation rendering engine
([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286))
- Add official visionOS support to lottie-ios repo
([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287))
- lottie-spm now supports visionOS
([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12))
- Adopt policy on minimum supported Swift / Xcode version, update
minimum versions to Swift 5.7 / Xcode 14.1
([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260))

**Full Changelog**:
airbnb/lottie-ios@4.4.1...4.4.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMDkuNCIsInVwZGF0ZWRJblZlciI6IjM2LjEwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>
cgrindel-self-hosted-renovate bot referenced this pull request in cgrindel/rules_swift_package_manager Apr 16, 2024
)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch |
`from: "4.4.2"` -> `from: "4.4.3"` |

---

### Release Notes

<details>
<summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary>

###
[`v4.4.3`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.3)

[Compare
Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.2...4.4.3)

##### Bug fixes in 4.4.3

- Fix issue where animation size could be incorrect after loading async
animation
([https://github.com/airbnb/lottie-ios/pull/2379](https://togithub.com/airbnb/lottie-ios/pull/2379))
- Update NSPrivacyAccessedAPITypeReasons in privacy manifest
([https://github.com/airbnb/lottie-ios/pull/2380](https://togithub.com/airbnb/lottie-ios/pull/2380))
- Include animation duration when computing cost/complexity of Core
Animation time remapping
([https://github.com/airbnb/lottie-ios/pull/2381](https://togithub.com/airbnb/lottie-ios/pull/2381))

##### New features in 4.4.0

- Add privacy manifest
([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252))
- Codesign Lottie.xcframework
([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259))
- Add time remapping support to Core Animation rendering engine
([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286))
- Add official visionOS support to lottie-ios repo
([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287))
- lottie-spm now supports visionOS
([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12))
- Adopt policy on minimum supported Swift / Xcode version, update
minimum versions to Swift 5.7 / Xcode 14.1
([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260))

**Full Changelog**:
airbnb/lottie-ios@4.4.2...4.4.3

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMDkuNCIsInVwZGF0ZWRJblZlciI6IjM2LjEwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>
hongtenKo pushed a commit to alfred-systems/lottie-ios that referenced this pull request Apr 18, 2024
@rawan92my
Copy link

Hello! I'm facing an issue with using latest Lottie version and I have to include Privacy file, since my app min deployment target is iOS 12 :( any help in that ?

MoroziOS pushed a commit to MoroziOS/tmg-lottie-ios that referenced this pull request May 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Introduce privacy manifest
9 participants