Skip to content

Bump to 4.4.1: OpenSSL privacy manifest for iOS _ssl/_hashlib#241

Merged
FeodorFitsner merged 1 commit into
mainfrom
bump-4.4.1
Jul 26, 2026
Merged

Bump to 4.4.1: OpenSSL privacy manifest for iOS _ssl/_hashlib#241
FeodorFitsner merged 1 commit into
mainfrom
bump-4.4.1

Conversation

@FeodorFitsner

Copy link
Copy Markdown
Contributor

Re-pins the bundled python-build snapshot to 20260726 and bumps all six packages to 4.4.1.

What's in the snapshot

flet-dev/python-build#35 only — the PrivacyInfo.xcprivacy bundled into _ssl.framework and _hashlib.framework was a stub (NSPrivacyAccessedAPITypes empty, plus an NSPrivacyUsesNonStandardAPIs key that isn't in Apple's schema). It's now byte-identical to OpenSSL's official manifest, declaring the file-timestamp API access the library actually performs.

No versions moved — Python 3.12.13 / 3.13.14 / 3.14.6, Pyodide, and dart_bridge 1.6.1 are all unchanged from 20260725. The manifest is the only functional difference on any platform.

Note the changelogs avoid the "byte-identical to the previous snapshot" phrasing used in prior bumps: all 31 release assets differ in size between 20260725 and 20260726, so every platform was rebuilt. They're functionally unchanged, not byte-identical.

What this does not fix

flet-dev/flet#6724ITMS-91065: Missing signature on a first App Store submission, citing these same two frameworks. This change is not expected to resolve it and shouldn't be announced as the fix.

Apple emits no ITMS-91061 alongside that rejection, so it does find the manifest. Inspecting a built .ipa ruled out every signature-side explanation:

Hypothesis Finding
Framework ships unsigned in the IPA Signed — valid authority, correct TeamIdentifier
A vendor signature applied in python-build would survive No — codesign -f at both the embed step and exportArchive; 120 invocations covering all 118 frameworks, overwriting even Google's signature on Flutter.framework
Privacy manifest absent Present, plutil clean
Manifest not sealed by the signature Sealed — in both files and files2 of _CodeSignature/CodeResources

So the framework reaches Apple signed, with a sealed manifest, and is still reported as unsigned. This PR removes the one verifiable defect so it isn't a confound in further testing.

Verification

  • gen_version_tables --release-date 20260726 regenerated all five tables; the no-arg re-run produces no further diff (matches the CI "Version tables in sync with manifest" check).
  • Only the release date moved in the generated files — no version fields changed.
  • No stale 4.4.0 left in any pubspec, build.gradle.kts, or podspec.

Not tagged, not published.

Re-pins the bundled python-build snapshot to 20260726, which replaces the
stub PrivacyInfo.xcprivacy bundled into _ssl.framework and _hashlib.framework
with the manifest OpenSSL publishes for its Apple builds
(flet-dev/python-build#35).

No versions moved: Python 3.12.13 / 3.13.14 / 3.14.6, Pyodide, and
dart_bridge 1.6.1 are all unchanged from 20260725.

This is a correctness fix, not a fix for the ITMS-91065 rejection in
flet-dev/flet#6724 — see the serious_python_darwin 4.4.1 entry for what was
ruled out and what remains open.
@FeodorFitsner
FeodorFitsner merged commit 3ee5620 into main Jul 26, 2026
4 of 54 checks passed
@FeodorFitsner
FeodorFitsner deleted the bump-4.4.1 branch July 26, 2026 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant