Skip to content

chore: added new privacy file and identified reason for using privacy APIs#9124

Merged
sethkfman merged 16 commits intomainfrom
chore/apple-privacy-mainfest
Apr 9, 2024
Merged

chore: added new privacy file and identified reason for using privacy APIs#9124
sethkfman merged 16 commits intomainfrom
chore/apple-privacy-mainfest

Conversation

@sethkfman
Copy link
Copy Markdown
Contributor

@sethkfman sethkfman commented Apr 3, 2024 •
edited
Loading

Description

This PR adds a new privacy file identifying why the app is using specific privacy APIs.

These mentions in the manifest:

  • NSPrivacyAccessedAPICategoryFileTimestamp - Display Activity Times
  • NSPrivacyAccessedAPICategoryDiskSpace - Download files
  • NSPrivacyAccessedAPICategorySystemBootTime - Sentry Times
  • NSPrivacyAccessedAPICategoryUserDefaults - MMKV
    Are the modules/functions that are associated with the required declarations in the manifest.

Sentry was also updated due to bug with duplicate Privacy Manifests in older versions.

Related issues

Fixes

Manual testing steps

  1. Submit new app to TestFlight
  2. See there are now errors in privacy audit

Screenshots/Recordings

Before

Screenshot 2024-04-05 at 12 39 25 PM

After

Screenshot 2024-04-04 at 12 31 53 PM

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've completed the PR template to the best of my ability
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@sethkfman sethkfman added the team-mobile-platform Mobile Platform team label Apr 3, 2024
@sethkfman sethkfman requested a review from a team as a code owner April 3, 2024 19:05
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2024

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@sethkfman sethkfman requested a review from a team April 3, 2024 19:11
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 3, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 45.98%. Comparing base (fcbff65) to head (79d1d25).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #9124   +/-   ##
=======================================
  Coverage   45.98%   45.98%           
=======================================
  Files        1273     1273           
  Lines       31342    31342           
  Branches     3213     3213           
=======================================
  Hits        14414    14414           
  Misses      16079    16079           
  Partials      849      849

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 3, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@sentry/react-native@5.19.3 Transitive: environment, filesystem, network, shell +23 82.8 MB sentry-bot

🚮 Removed packages: npm/@sentry/react-native@5.11.1

View full report↗︎

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 3, 2024 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@sentry-internal/tracing@7.100.1, npm/@sentry/cli@2.30.0, npm/@sentry/utils@7.100.1

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2024 •
edited by metamaskbot
Loading

https://bitrise.io/ Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 47ad3b9
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/b8cee05f-4846-48ee-ba52-b925c965f06f

Note

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

@metamaskbot metamaskbot added needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) and removed in-progress labels Apr 4, 2024
@sethkfman sethkfman mentioned this pull request Apr 5, 2024
Merged
13 tasks
@sethkfman
Copy link
Copy Markdown
Contributor Author

sethkfman commented Apr 5, 2024

@SocketSecurity ignore npm/@sentry-internal/tracing@7.100.1
@SocketSecurity ignore npm/@sentry/utils@7.100.1
@SocketSecurity ignore npm/@sentry/cli@2.30.0

All new packages are part of the Sentry upgrade and are expected.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 5, 2024 •
edited by metamaskbot
Loading

https://bitrise.io/ Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 9624cb9
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/f57da09c-b04b-4fc9-98e6-3ede6d83c6e8

Note

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 5, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Cal-L
Cal-L reviewed Apr 8, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@Cal-L Cal-L left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failing e2e doesn't seem related to this PR. Lgtm

Cal-L
Cal-L approved these changes Apr 8, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@Cal-L Cal-L left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 9, 2024 •
edited by metamaskbot
Loading

https://bitrise.io/ Bitrise

✅✅✅ pr_smoke_e2e_pipeline passed on Bitrise! ✅✅✅

Commit hash: 79d1d25
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/54ddcd9e-ffff-48b4-b069-80fe8b174002

Note

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

@sethkfman sethkfman merged commit cece2fa into main Apr 9, 2024
@sethkfman sethkfman deleted the chore/apple-privacy-mainfest branch April 9, 2024 18:38
@github-actions github-actions bot locked and limited conversation to collaborators Apr 9, 2024
@github-actions github-actions bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Apr 9, 2024
@metamaskbot metamaskbot added the release-7.21.0 Issue or pull request that will be included in release 7.21.0 label Apr 9, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@Cal-L Cal-L Cal-L approved these changes

Assignees

No one assigned

Labels

release-7.21.0 Issue or pull request that will be included in release 7.21.0 team-mobile-platform Mobile Platform team

Projects

PR review queue
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@sethkfman @codecov-commenter @Cal-L @metamaskbot @wachunei