OpenSSL xcframework signature issue / InvalidBinary. URGENT ‼️

[arturdev]

OpenSSL xcframework signature issue / InvalidBinary. URGENT ‼️

[ncooke3]

Hi @arturdev, this actually looks related to the following dependency shown in the Package.resolved:

 {
      "identity" : "openssl-apple",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/passepartoutvpn/openssl-apple",
      "state" : {
        "revision" : "0edc07c7a0e4ec2ca0f448dd68314241ccc925b3",
        "version" : "3.2.107"
      }
    },

The reason being that the release for this dependency (https://github.com/passepartoutvpn/openssl-apple/releases/tag/3.2.107) has an openssl.xcframework artifact.

Firebase uses a similarly named, but different dependency from:

    {
      "identity" : "grpc-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/grpc-binary.git",
      "state" : {
        "revision" : "e9fad491d0673bdda7063a0341fb6b47a30c5359",
        "version" : "1.62.2"
      }
    },

called openssl_grpc.xcframework which does contain a code signature.

I recommend creating an issue in the https://github.com/passepartoutvpn/openssl-apple repo.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[arturdev]

@ncooke3 I don't think you're right, because Apple clearly states that they find BoringSSL...
The link you posted doesn't have any reference to BoringSSL... only firebase has a reference to it

[ncooke3]

Apple's warning says:

ITMS-91065: Missing signature - Your app includes “Frameworks/openssl.framework/openssl”, which includes BoringSSL / openssl_grpc, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.

Firebase does not provide a framework named openssl.framework. Firebase does provide a framework named openssl_grpc.framework, but the App Store Connect error does not list openssl_grpc.framework as the problematic framework.

https://github.com/passepartoutvpn/openssl-apple does however offer a openssl.framework, but this isn't a Firebase dependency (it is listed in your Package.resolved though)

[NasrullahKhan]

@arturdev did you manage to find the solution?

[arturdev]

@NasrullahKhan yes... Eventually, the issue was with https://github.com/passepartoutvpn/openssl-apple.. so I ended up using another library,, other than passepartoutvpn's one

[NasrullahKhan]

@arturdev which library you used.. because i'm also using tunnelkit for tcp/udp and wireguard protocols.

[arturdev]

@NasrullahKhan I built mine, on top of @OpenVPN's official

[NasrullahKhan]

@arturdev can you help?

[arturdev]

with what?

[NasrullahKhan]

how you built yours?

[arturdev]

On top of this: https://github.com/OpenVPN/openvpn3
The rest you should figure out yourself

[NasrullahKhan]

@arturdev Thanks.