Tag: Signing

Apple notifies developers on upcoming changes in purchase receipt signing certificate. Developers who use custom receipt validation should update their software accordingly.

If your app validates App Store receipts on device, make sure your app will support the SHA-256 version of this certificate. New apps and app updates that don’t support the SHA-256 version of this certificate will no longer be accepted by the App Store starting August 14, 2023.

Apple Developer

Apple also notifies developers that they should migrate to Xcode 14 or notarytool utility by November 1, 2023. Submissions from Xcode 13 and altool utilities will be no longer accepted then.

Important dates:

• June 20, 2023. Receipts in the sandbox environment will be signed with the SHA‑256 version of this certificate for devices running a minimum of iOS 16.6, iPadOS 16.6, tvOS 16.6, watchOS 9.6, or macOS Ventura 13.5.
• August 14, 2023. Receipts in new apps and app updates submitted to the App Store, as well as all apps in sandbox, will be signed with the SHA‑256 intermediate certificate.
• November 1, 2023. Notarization requests will be only accepted by Xcode 14 and newer or notarytool.

Apple Developer:

• Upcoming changes to the App Store receipt signing intermediate certificate
• Handling App Store receipt signing certificate change
• Apple notary service update

Apple stops signing iOS and iPadOS 16.4.1 preventing downgrades.

Reference: Apple Stops Signing iOS 16.4.1 to Prevent Downgrading

After 16.4.1 release Apple no longer allows downgrade to iOS 16.4.

Reference: Apple Stops Signing iOS 16.4 Following iOS 16.4.1 Release, Downgrading No Longer Possible

Following recent updates Apple now no longer signs iOS/iPadOS 16.3.1.

Reference: Apple Stops Signing iOS 16.3.1 to Prevent Downgrading

Apple provides information on security fixes of iOS 16.3.1. Having these issues in mind Apple now no longer supports downgrading to iOS 16.3 and previous releases.

Apple Support: About the security content of iOS 16.3.1 and iPadOS 16.3.1

References:

• Apple Stops Signing iOS 16.3 Following iOS 16.3.1 Launch, Downgrading No Longer Possible
• Apple reveals multiple new security exploits that were patched with iOS 16.3 updates

Apple now no longer allows downgrade from iOS 16.3. This comes together with the news that previous iOS releases were subject to exploit allowing to get user's location if that permission was not given to the application.

Apple did not disclose details of this exploit.

Maps

Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to bypass Privacy preferences

Description: A logic issue was addressed with improved state management.

CVE-2023-23503: an anonymous researcher

About the security content of iOS 16.3 and iPadOS 16.3

Apple Support: About the security content of iOS 16.3 and iPadOS 16.3

References:

• Apple Stops Signing iOS 16.2 Following iOS 16.3 Launch, Downgrading No Longer Possible
• Was a Popular Brazilian Food Delivery App Bypassing Apple’s Location Privacy Settings on iOS?
• Apple Maps privacy bug may have allowed apps to collect location data without permission
• Was this Brazilian major app bypassing Apple's location privacy on iOS?
• Bypassing iOS 16.2 Location Privacy

It's Christmas weekend, and to give you time to celebrate, we've made slightly smaller list of articles. But those are really good.

• Peter Tretyakov is back with Code Signing Hell with XCFramework (by the way, he hinted that ChatGPT actually helped him to improve readability of the article);
  
  
• David Smith continues his design notes diary – DND 11: Better Dynamic Type Designs and DND 12: Sparkle Magic;
  
  
• How to Create an iOS Lock Screen Widget? by Lee Kah Seng explores use of WidgetKit for Lock Screen widgets;
  
  
• Moritz Philip Recke provides a guide on DocC usage on GitHub Pages – Configuring the Hosting Base Path in Xcode to Publish DocC Documentation on GitHub Pages;
  
  
• How to perform a lightweight migration in Core Data by Natascha Fadeeva guides through simple but important process working with Core Data;
  
  
• Leonardo Maia Pugliese explains new concurrency usage in SwiftUI – Efficiently Managing Multiple Async Tasks in SwiftUI.

And that is it for today. Merry Christmas and happy holidays!

In usual manner following iOS 16.2 release Apple now stops signing iOS 16.1.2 preventing downgrade.

Reference: Apple Stops Signing iOS 16.1.2 Following iOS 16.2 Launch

It is last weekend before Christmas, so we have a bit more time to read something interesting.

• Starting with good article on Apple Pencil features in Apple Developer blog – Spotlight on: Apple Pencil hover;
  
  
• Good take by Natascha Fadeeva on code signing in iOS – Developer guide on iOS code signing & provisioning (yes, we still need to understand that properly);
  
  
• Couple more design notes by David Smith – Design Notes Diary #7, Design Notes Diary #8 and Design Notes Diary #9;
  
  
• Jesse Squires writes on issues with iOS Simulator – Workaround: simctrl status_bar broken for iOS 16 simulators;
  
  
• Quick reminder on how to make enum's easier to read by Marco Eidinger – Swift Enum With Labeled Associated Values;
  
  
• And another guide on stride function – Swift Stride Quick Guide by Keith Harrison;
  
  
• Antoine van der Lee explains OptionSet – OptionSet in Swift explained with code examples;
  
  
• Majid Jabrayilov keeps his series on SwiftUI layouts – Building custom layout in SwiftUI. LayoutValueKey.;
  
  
• Creating a HomeKit-enabled App with SwiftUI by Moritz Philip Recke guides us through smart home app development process;
  
  
• Ole Begemann creates great example app to demonstrate SwiftUI view lifecycle – Understanding SwiftUI view lifecycles;
  
  
• Dynamically Change App Icons for a Unique User Experience with SwiftUI by Leonardo Maia Pugliese explains the process of changing app icon in iOS;
  
  
• Couple of Swift articles by Sarun W. – What is the difference between #available and @available and How to make Swift Enum conforms to Identifiable protocol.

And returning with video section! Great talk on JavaScriptCore usage – Make your app securely extensive with JavaScriptCore.

And that is for today! Have a great weekend!

Since iOS 16.1.2 release Apple no longer signs previous iOS releases preventing downgrades.

Reference: Apple Stops Signing iOS 16.1 and iOS 16.1.1 Following iOS 16.1.2 Launch