Uploading Mac Catalyst build incorrectly failed for Private API use related to Security framework

Hi,

I have been trying to upload my iOS / macOS Catalyst app, the _SecCertificateCreateWithData, _SecTrustEvaluateWithError, _SecTrustSetAnchorCertificatesand are being incorrectly flagged by iTunes Connect / App Store Connect as private API usage. I used Xcode 11.3.1 GM (I also tried with 11.3 with same results) and it passes all validation and submission.


I am using this API in an embedded Framework.

The mentioned methods are from the Security.framework and they are documented API.

- https://developer.apple.com/documentation/security/1396073-seccertificatecreatewithdata?language=objc

- https://developer.apple.com/documentation/security/2980705-sectrustevaluatewitherror?language=objc

- https://developer.apple.com/documentation/security/1396098-sectrustsetanchorcertificates?language=objc


Also the same code have been uploaded and accepted the last week.

And the same code was aceepted for iOS the last friday.


I also checked in the code and we don't have any method named like that in our code (that passed last week with Mac OS and last Friday with iOS App Store). And we are not using any 3rd party API nor framework nor SDKs.


I contacted the rejection team and they told me to contact the technical support because it is a "private API usage" issue in my code!


Do you have/had similar issue with "iTunes Connect / App Store Connect" incorrectly flagged as private API were it is not? How did you resolve it? How it could pass iOS and MAC OS (Mac Catalyst) (last week) and fails today (while iOS still passes) ?


Thanks for your help

Up vote post of momoichat Down vote post of momoichat
1.4k views
Posted by
momoichat
Reply
Add a Comment

Accepted Reply

As of today the issue has been fixed/Desappeared.


I did create many Apple developpement/App review/App rejection/Feedback/Apple developement support tickets.


Last friday, a "senior advisor within the Apple Developer Program Support" from the App review team finally agreed to : "We forwarded this to our engineering team in ticket number <xxxxxxxxx> to investigate further."


I just received: "After further research, the internal teams believe this issue is resolved. "

Posted by
momoichat
Up vote reply of momoichat Down vote reply of momoichat
Post marked as solved
Add a Comment

Replies

Same problem for a macOS Catalyst app that had several builds accepted until just recently. Frameworks (via Cocoapods) were flagged for:


ITMS-90338: Non-public API usage - The app references non-public symbols...


_SecItemAdd, _SecItemCopyMatching, _SecItemDelete, _SecItemUpdate, _kSecAttrAccessible, _kSecAttrAccessibleWhenUnlocked, _kSecAttrAccount, _kSecAttrLabel, _kSecAttrService, _kSecClass, _kSecReturnData, _kSecValueData

Posted by
millerjasonw
Up vote reply of millerjasonw Down vote reply of millerjasonw
Add a Comment

I'm experiencing the same issue. I've reached out to Apple to no avail. Our entire application release has been halted as a result.

Posted by
rsoffer1
Up vote reply of rsoffer1 Down vote reply of rsoffer1
Add a Comment

The problem seems to have disappeared without any clear cause here. Only changes here were:

  • no longer deriving the catalyst bundle id for the separate mac target (separate target may eventually go away)
  • defaulting the target's Release provisioning to a Developer ID Application profile and Deverloper ID Application identity (for AppCenter distribution)
  • using Fastlane update_project_provisioning to switch the target's Release provisioning to Mac Store profile and Apple Distribution identity when archiving for Mac Store upload (previously this was the default that was failing, no reason to think any different)
Posted by
millerjasonw
Up vote reply of millerjasonw Down vote reply of millerjasonw
Add a Comment

As of today the issue has been fixed/Desappeared.


I did create many Apple developpement/App review/App rejection/Feedback/Apple developement support tickets.


Last friday, a "senior advisor within the Apple Developer Program Support" from the App review team finally agreed to : "We forwarded this to our engineering team in ticket number <xxxxxxxxx> to investigate further."


I just received: "After further research, the internal teams believe this issue is resolved. "

Posted by
momoichat
Up vote reply of momoichat Down vote reply of momoichat
Post marked as solved
Add a Comment

I'm still seeing a similar error. This is from last night:


ITMS-90338: Non-public API usage - The app references non-public symbols: _IOObjectRelease, _IORegistryEntryCreateCFProperty, _IORegistryEntryFromPath, _kIOMasterPortDefault,…


Those are all public symbols in IOKit for Mac. I haven't touched any of this code, which pass submission dozens of times before this past weekend when this error appeared. I'll file a complaint with Apple, since they don't seem to have fixed this problem for everyone.

Posted by
overdesigned
Up vote reply of overdesigned Down vote reply of overdesigned
Add a Comment

The error I was seeing has been fixed. I did contact Apple Developer Program Support and they eventually escalated the issue to an "internal team". A couple of days later, I tried uploading a Catalyst build and it works. I don't know if the internal team fix it or someone else did, but the problem has disappeared.

Posted by
overdesigned
Up vote reply of overdesigned Down vote reply of overdesigned
Add a Comment