Hello community, In our application, we've implemented Apple ID for user authentication. Unfortunately, we forgot to register the associated domains and communication email addresses. This oversight has led to complications in email delivery via the private relay service. We've taken steps to fix the issue by reconfiguring the domains and communication email addresses. Post-adjustment, new user registrations are functioning properly. However, for users who registered before this fix, the problem persists. We followed the instructions provided on https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/communicating_using_the_private_email_relay_service, and we also have SPF configured, which has passed validation in our administration. Has anyone encountered a similar issue, and if so, how did you resolve it? Any insights or guidance would be greatly appreciated.

As the new requirement for Privacy manifests is coming this Spring 2024 (https://developer.apple.com/news/?id=r1henawx), Apple released a list of SDK's that need to comply with this requirement and provide a privacy manifest file: https://developer.apple.com/support/third-party-SDK-requirements/ I have some questions: Do i need to declare a privacy manifest file for the SDKs if i'm updating an old app that already includes one of these SDKs? Apple states "when you submit an app update that adds one of the listed SDKs as part of the update" which in my understanding applies only when an app adds an SDK for the first time in an app update. What happens with SDK's that are not in this list? Should every single SDK an app uses to include the privacy manifest file?

I am creating a Privacy manifest file and have a question about adding to NSPrivacyTrackingDomains. For example, if I am using Firebase for two purposes, analytics and crashes, if I specify the Firebase domain as NSPrivacyTrackingDomains and the user rejects the tracking, will the crash information etc. also stop being sent?

In the ESF framework, if I set up a process through audit token mute. Will the creation and corresponding child processes of this process also be mute mute. mute process A. process A creates a child process B. Whether the child process B is mute？

I'm looking over data use categories for the privacy manifest here https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_data_use_in_privacy_manifests My app retrieves information such as OS Version, OS Name, locale info for the reason analytics. It also retrieves cellular infomation and device information for the reason app functionality. For this, I think it falls under "Other Data types" and the value "NSPrivacyCollectedDataTypeOtherDataTypes" in the privacy manifest. Do we need to specify further what that "other" data type is? How do I add "OS Information" or "Device Information" as part of the entry for "NSPrivacyCollectedDataTypeOtherDataTypes" in the manifest? Thanks

I refer to Google's ESF project code to handle NOTIFY events, but after my notifyQueue is set to QOS_CLASS_BACKGROUND, the process memory gets larger when a lot of events occur. Is there any way to fix this without affecting performance The code is as follows： notifyQueue = dispatch_queue_create("notify",dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,QOS_CLASS_BACKGROUND, 0)); if (msg->action_type == ES_ACTION_TYPE_NOTIFY) { es_message_t *copied_msg = [self copy_message:msg]; if (!copied_msg) { return; } dispatch_async(self->_notifyQueue, ^{ @autoreleasepool { [self handle:copied_msg]; [self free_message:copied_msg]; } }); }

I'm developing a mental wellness app, and I need to get user's screentime and app usage data and send it to my flask backend for analytics. Is it possible on iphone right now? I've looked into ScreenTime and DeviceActivity frameworks, but they're really poor in terms of examples and documentation, so I'm not sure if this is actually possible or not.

I wanted to delete the old data of the device by how do i do /var/Keychains/keychain-2.db DELETE FROM genp WHERE agrp<>'apple' which I tried many times but always got errors. I don't know what to do. Can you help me?

We are trying to get access to Endpoint security entitlement for our enterprise app that uses Endpoint Security Extension but after almost 5 month and over 3 requests there is no response from Apple. We kindly asked Apple for entitlement because we have to distribute our application to our customer ASAP. I need some information around this issue. What the reason ? How can I contact support for my requests? Thanks in advance

I'm trying to implement passkeys in my multiplatform (iOS/macOS) app, and it works on iOS, but on macOS I get the following errors: ASAuthorizationController credential request failed with error: Error Domain=com.apple.AuthenticationServices.AuthorizationError Code=1004 "(null)" Passkey authorization failed. Error: The operation couldn’t be completed. Application with identifier <identifier omitted> is not associated with domain <domain omitted> The associated domain is correctly configured, since it works on iOS. Adding ?mode=developer also doesn't resolve the problem.

Hi I've been running after a problem on my iOS app, I'm creating hundreds of keypairs with SecKeyCreateRandomKey for several different usernames, in this case, different identifiers kSecAttrApplicationTag. After I create the key pairs I extract the public keys using SecItemCopyMatching, again, hundreds of them. Problem is, without a logic explanation, some of those keys cannot be extracted. After running after the issue for hours, I noticed that EVERY time I try to extract a public key and the identifier have exactly 87 chars, the public key cannot be found. Doesn't matter the content or names used on the identifier, every time the length hits 87, SecItemCopyMatching returns -25300 is this some kind of limitation that is not explained on the documentation? thanks digging deeply I noticed several identifier sizes fail to extract the key: [982:69528] key with 7 chars is invalid [982:69528] key with 23 chars is invalid [982:69528] key with 39 chars is invalid [982:69528] key with 55 chars is invalid [982:69528] key with 71 chars is invalid [982:69528] key with 87 chars is invalid [982:69528] key with 103 chars is invalid [982:69528] key with 119 chars is invalid [982:69528] key with 135 chars is invalid [982:69528] key with 151 chars is invalid [982:69528] key with 167 chars is invalid [982:69528] key with 183 chars is invalid [982:69528] key with 199 chars is invalid [982:69528] key with 215 chars is invalid [982:69528] key with 231 chars is invalid [982:69528] key with 247 chars is invalid [982:69528] key with 263 chars is invalid [982:69528] key with 279 chars is invalid [982:69528] key with 295 chars is invalid

When trying to open an app that uses Local Authentication (FaceID) the auth process does not start right away, 3-4 times trying to auth is needed in order to get authenticated with the method the user has selected (FaceID), this is happening with many apps and seems that there's no a workaround. [Edited by Moderator]

ES_EVENT_TYPE_NOTIFY_CREATE doesnt get triggerd if i copy a file to iPhone connected to mac device. Also, ES_EVENT_TYPE_NOTIFY_MOUNT doesnt get triggered when an iphone is connected to a macos device

Is there a way to find out when the set of keychains changes? ie, when a keychain is added or removed? I searched here and grepped through the headers in Security.framework but nothing leaped out at me -- which could just mean I missed something, as happens frequently. (This is on macOS.)

Hey Apple team (and eskimo 🙏), Our FinTech app uses iCloud Keychain shared web credentials to store a secure encryption password in iCloud Keychain. Some of our new users seem to run into an issue where the app fails to successfully create a shared web credential. All users are required to have the following two settings enabled: Settings --&gt; Passwords --&gt; Password Options --&gt; Autofill from iCloud Passwords &amp; Keychain Settings --&gt; Apple D - -&gt; iCloud - -&gt; Passwords and Keychain --&gt; 'Sync this iPhone' The issue appears to resolve itself when the user restarts their iPhone. We've had this bug 3 times now and would like to understand the root cause. We have a couple hypotheses: iOS is failing to verify that the domain for the shared web credential is valid via &lt;domain&gt;/.well-known/apple-app-site-association (and then restarting triggers reverification) Users were on a version of iOS where it was bugged (and then restarting finally completed an update to a new version). We've verified that the bug happened on 17.0.2 with one user (until they updated and it fixed itself)

Having tried to gain access to the total daily screen time API using the text/code from the below thread, we were unable to get any data access. Has anyone else had the same issue and any resolutions? Not looking for application limits, just statistics to inform user through our 3rd party application. Thanks for any guidance around areas we can attempt https://developer.apple.com/documentation/deviceactivity/deviceactivitydata/activitysegment

According to https://developer.apple.com/documentation/security/app_sandbox/discovering_and_diagnosing_app_sandbox_violations it is possible to view detailed violation reports for non-system services. Is it possible to do something similar for system services? I have encountered an issue where several (all?) of my Macbooks get into a sandbox violation situation (I assume). Below is in excerpt from logs focusing just on the sandbox violation. The errors are surrounded by XPC failures and errors. error 23:23:21.382263+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence error 23:23:24.385962+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence error 23:23:27.389910+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence error 23:23:36.408940+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence error 23:23:45.419593+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence error 23:23:54.432109+0100 kernel Sandbox: Family(1316) deny(1) mach-lookup com.apple.contactsd.persistence The above is just an except, and it seems that Family, imagent and searchpartyuseragent are trying to access com.apple.contactsd.persistance once per second or so and failing (there are also some attempts to reach com.apple.timed.xpc, but an insignificant amount in comparison to com.apple.contactsd.persistance). This in turn causes Diagnostics Reporter to start, and then end hastily almost every ten seconds. fault 23:23:05.903908+0100 Diagnostics Reporter Invalid launch. fault 23:23:16.038017+0100 Diagnostics Reporter Invalid launch. fault 23:23:26.136348+0100 Diagnostics Reporter Invalid launch. fault 23:23:36.274543+0100 Diagnostics Reporter Invalid launch. fault 23:23:46.414546+0100 Diagnostics Reporter Invalid launch. I have no idea how I did this, but I seemed to have messed up sandbox access rights to contacts for some system services?

The "documentation" is poorly worded.

hi,there are some questions about Privacy manifest 1.why do we just see the information about app's manifest in PrivacyReport after app has been archived,that does not contain our SDK's manifest info.but our frameworks that app contains have manifest. 2.does every SDK need to add manifest if this SDK collects user data or uses API? 3.there is list of third-part-sdk https://developer.apple.com/support/third-party-SDK-requirements/ ,if we use an SDK not listed and the sdk has collected use data or used api that need to display reason,should we add manifest file?

I'm trying to log Endpoint Security events to os_log. I'd be grateful if someone could confirm that using the --oslog option with eslogger actually writes event data to the system log. If I monitor with sudo eslogger exec fork exit I see events at the command line, yet if I add the --oslog option, I don't see those events when monitoring the log with sudo log stream --predicate 'subsystem == "com.apple.eslogger"'. Nor do I see them if I filter in the Console app on just the subsystem "com.apple.eslogger". Have I missed out something with my work? Any help appreciated. Thanks.