Firebase XCFrameworks are not codesigned

[jmagman]

Description

Third-party SDK XCFrameworks now need to be codesigned, not just the framework binaries within them. This will be enforced by Xcode at some point in Spring 2024.

codesign --sign "Apple Developer cert etc" ... path/to/FirebaseAuth.xcframework

Now with signatures for SDKs, when you adopt a new version of a third-party SDK in your app, Xcode will validate that it was signed by the same developer, improving the integrity of your software supply chain.

https://developer.apple.com/support/third-party-SDK-requirements/

Note xcframework is a directory (bundle), not a binary. Though looks like Firebase binaries aren't codesigned either.

Docs

https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks
https://developer.apple.com/videos/play/wwdc2023/10060/

cc @paulb777
(We're working on this for Flutter flutter/flutter#140934)

Reproducing the issue

Download XCFrameworks from https://firebase.google.com/docs/ios/setup#frameworks. Drag into Xcode 15+, see Kind: Unsigned in the inspector.

$ codesign -d -vv Firebase/FirebaseAuth/FirebaseAuth.xcframework
Firebase/FirebaseAuth/FirebaseAuth.xcframework: code object is not signed at all

Firebase SDK Version

10.19

Xcode Version

15

Installation Method

Zip

Firebase Product(s)

All

Targeted Platforms

iOS

Relevant Log Output

No response

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[paulb777]

@jmagman Thanks for the report. @ncooke3 is in progress on meeting the new Apple signing requirements along with the privacy manifests #11490

[jmagman]

👍 I saw the privacy manifest work but I didn't see anything about the signature requirement. Thanks!

[hendri-voodoo]

hello, any ETA when this codesigning will be included?

[ncooke3]

Hi @hendri-voodoo, I do not have an eta to share, but the signing infra is taking longer to set up and may come after the release containing privacy manifests. We will keep this bug updated when we have an eta to share. #11490 (comment)

[hendri-voodoo]

@ncooke3 noted. When is your next release cycle?

[pavm035]

Hi Any updates on signing?