Any support/plan of Privacy Manifest?

[Angus-chang]

Following the same topic in RxSwift offical slack. According to the definition of "third-party SDKs" that as mentioned in the WWDC23, new documents: Privacy manifest files | Apple Developer Documentation and the new announcement from Apple. It seems like RxSwift/RxCocoa/RxRelay require a privacy manifest and signature as well.

I was wondering if the Privacy Manifest update will be introduce in following updates, and, whether it is possible for us to know the schedule so that we can plan and manage our app releases more effectively.. Deeply appreciated.

Platform/Environment

• iOS
• macOS
• tvOS
• watchOS
• playgrounds

Installation method:

• CocoaPods
• Carthage
• Git submodules

Level of RxSwift knowledge:
(this is so we can understand your level of knowledge
and formulate the response in an appropriate manner)

• just starting
• I have a small code base
• I have a significant code base

[wlxo0401]

+1

[ZYHshao]

+1

[tommyming]

Agree that this needs to be added, there are still a lot of apps using RxSwift I think.

[freak4pc]

Definitely something we'll add by the deadline. There's almost a year by then. Thanks!

[danielt1263]

If one of you who has already looked into this could add it, that would be fantastic. If you have any questions about the library itself. Reach out to me on Slack.

[freak4pc]

Yeah, actually if anyone wants to open a relevant PR that would help immensely 🙏 thanks!

Here's an example, even though RxSwift doesn't track anything or does any API calls on its own, so there's really no privacy content to describe: https://github.com/BranchMetrics/ios-branch-sdk-spm/blob/main/BranchSDK/PrivacyInfo.xcprivacy

[wlxo0401]

@freak4pc

I simply looked it up, and it seems like 'mach_absolute_time' is used, did I make a mistake?

[freak4pc]

@freak4pc

I simply looked it up, and it seems like 'mach_absolute_time' is used, did I make a mistake?

Might be missing something but what's the privacy concern with mach time ?

[wlxo0401]

Apple Doc

I was just looking up the API list in the Apple document in the RxSwift project.

The way I did it is as follows.

1. Clone the RxSwift project to my computer
2. I opened the project using Xcode.
3. Through the entire search, the API was searched one by one.
   (If the above method is wrong, please let me know.)

I checked and found that 'mach_absolute_time' exists in the 'Tests' folder, isn't this a problem??

[danielt1263]

Not a problem. It just needs a reason for being there.

The RxSwift tests harness uses mach_absolute_time() in order to test performance only; it is not used in the production code and is not sent off device.

[wlxo0401]

@danielt1263

Here's an example, even though RxSwift doesn't track anything or does any API calls on its own, so there's really no privacy content to describe:

Oh, I'm afraid I didn't say it correctly. It's my mistake to say "problem."
(I am not good at English.)

I mean... @freak4pc said 'so there's really no privacy content to description', shouldn't we write down the description in PrivacyInfo if RxSwift use 'mach_absolute_time'??

[danielt1263]

Yes, the description needs to be added to the privacy info. I provided you the description above.

[tommyming]

if mach_absolute_time() is the only API that is used in the project, mentioned by @wlxo0401, I think we just need to declare the use of the API and its purpose in the privacy file, as mentioned by Apple. then it should work?

For reference, this is a PR of Kingfisher, adding privacy manifest to the project:
onevcat/Kingfisher#2156

I can try to work on this on the 1st week of 2024, if anyone is free to work it out these days, feel free to create a PR.

[wlxo0401]

@tommyming

Apple specifically mentioned RxSwift, but within the RxSwift ecosystem, there are various related libraries like RxCocoa, RxRelay, RxBlocking, RxTest, and RxSwift-Dynamic, among others.
(And we can only choose what we want.)

The question is whether you should include PrivacyInfo documentation for each of these libraries separately or if a single PrivacyInfo entry is sufficient.

(Use Chat GPT for translation)