ITMS-91053: Missing API declaration on iOS app submission to App Store

[durandt]

Description

Hi,

Sending my MAUI 8.0.7 iOS app to App Store for review on March 18th triggered the following warnings (received by e-mail) from App Store:

ITMS-91053: Missing API declaration - Your app’s code in the “MyApp” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryDiskSpace. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

ITMS-91053: Missing API declaration - Your app’s code in the “MyApp” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategorySystemBootTime. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

ITMS-91053: Missing API declaration - Your app’s code in the “MyApp” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryFileTimestamp. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

ITMS-91053: Missing API declaration - Your app’s code in the “MyApp” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

I am unsure if these (new) warnings could have been triggered but MAUI 7 -> 8 upgrade (och XCode 14->15)
I had published the previous update (MAUI 7, XCode 14.x) on March 5th without getting this warnings.
So of course MAUI 8/XCode 15 seem suspicious from my point of view BUT many questions and threads bringing up the issue (on StackOverflow or other mobile frameworks) are very recent (see related links below).

I am not much interested in HOW this can be fixed (I know it's about documenting in Info.plist), but rather WHY(so that I can truthfully document the reasons in Info.plist):

• Does this issue trigger only if the right assemblies are linked, or are theses values actually fetched by MAUI?
• How are this values used by MAUI? (see link to Apples documentation below for list of codes explaining different reasons)
• Is it something new with MAUI 8? (Probably not)
• A bit out-of-context question: Did Apple only recently start to send this warning? (some mention that it could have started this fall already). Can we find a date for when this started to happen? Google searches do not yield too many responses so it seems to be rather new.

Another point with this issue is to document it so that other MAUI developers may find the answer here upon getting the warnings.

Related:
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api
https://stackoverflow.com/questions/78163859/itms-91053-missing-api-declaration-privacy
flutter/flutter#145269
juce-framework/JUCE#1365
https://mastodon.social/@chockenberry/112095424613859371

Steps to Reproduce

It seems to me that this issue is hard to reproduce in an easy manner.
The warnings did not appear when sending the app update using Transporter, nor during the "Build analysis" step before you can send the build to App Store review.
The warning appeared when sending the app update for review. That makes making small changes and testing rather cumbersome.

My app is a .NET MAUI 8 app (MAUI 8.0.7, .NET SDK 8.0.2) built with XCode 15.2 and is using the following third-parties:

• MAUI
• MAUI CommunityToolkit
• AppCenter

Microsoft.Maui.Controls 8.0.7
Microsoft.Maui.Controls.Compatibility 8.0.7
Microsoft.Maui.Controls.Maps 8.0.7
CommunityToolkit.Maui 7.0.1
CommunityToolkit.Mvvm 8.2.2
Microsoft.AppCenter.Analytics 5.0.3
Microsoft.AppCenter.Crashes 5.0.3
Microsoft.Extensions.Configuration.Binder 8.0.0
Microsoft.Extensions.Configuration.Json 8.0.0
Microsoft.Extensions.Logging.Debug 8.0.0

Link to public reproduction project repository

No response

Version with bug

8.0.7 SR2

Is this a regression from previous behavior?

No, this is something new

Last version that worked well

7.0.92

Affected platforms

iOS

Affected platform versions

XCode 15.2

Did you find any workaround?

Updating your apps Info.plist as mentioned in the different documentations and issues linked above.

Relevant log output

No response

[durandt]

Relevant strings to search for in code bases for the warnings:

Warning	SearchString	Result
NSPrivacyAccessedAPICategoryDiskSpace	NSFileSystemFreeSize NSFileSystemSize	none
NSPrivacyAccessedAPICategorySystemBootTime	systemUptime	none
NSPrivacyAccessedAPICategoryFileTimestamp	NSFileCreationDate NSFileModificationDate	none
NSPrivacyAccessedAPICategoryUserDefaults	NSUserDefaults	MAUI (for user preferences i guess), xamarin-macios

Searched using GitHub search the following repos:
dotnet/maui
CommunityToolkit/Maui
microsoft/appcenter-sdk-dotnet
xamarin/xamarin-macios

More strings to search for that could trigger warnings

[PureWeen]

@rolfbjarne thoughts?

[rolfbjarne]

These are new warnings, you didn't get them before because Apple didn't report them.

We're working on support for Privacy Manifests: xamarin/xamarin-macios#20059, so closing as a duplicate of that issue.