PrivacyInfo.xcprivacy not included in framework via Carthage

[laviallb360]

Short description of the issue:

PrivacyInfo.xcprivacy files are not added to Xcode project, therefore their are not included in frameworks when importing RXSwift via Carthage.

Expected outcome:

When adding RxSwift as a dependency via Carthage, I except to include a framework with PrivacyInfo.xcprivacy to validate Apple review and avoid the ITMS-91061 review error.

What actually happens:

Privacy info files are not included, the Apple review raises an error ITMS-91061

RxSwift/RxCocoa/RxBlocking/RxTest version/commit

6.8.0

Platform/Environment

• iOS
• macOS
• tvOS
• watchOS
• playgrounds

How easy is to reproduce? (chances of successful reproduce after running the self contained code)

• easy, 100% repro
• sometimes, 10%-100%
• hard, 2% - 10%
• extremely hard, %0 - 2%

Xcode version:

  16.0.0

Installation method:

• CocoaPods
• Carthage
• Git submodules

I have multiple versions of Xcode installed:
(so we can know if this is a potential cause of your issue)

• yes (which ones)
• no

Level of RxSwift knowledge:
(this is so we can understand your level of knowledge
and formulate the response in an appropriate manner)

• just starting
• I have a small code base
• I have a significant code base

[danielt1263]

FYI, there is no need for a privacy file for RxSwift because it doesn't use any privacy related methods.

Please post the text of the Apple review error.

[laviallb360]

This is the Apple review:

TMS-91061: Missing privacy manifest - Your app includes “Frameworks/RxSwift.framework/RxSwift”, which includes OneSignalOutcomes, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements.

After reading #2625, I guess this is a duplicate, I don't get why Apple is reviewing RxSwift like this though, and it is going to be a problem.

[danielt1263]

I have no idea what "OneSignalOutcomes" is and it's not referenced anywhere in the RxSwift codebase. After Googling, I see that it is part of some other library, the "OneSignal-iOS-SDK". Are you including that library in your code? If not, do you know what OneSignalOutcomes is?

[laviallb360]

Like you, I guess OneSignalOutcomes comes from OneSignal iOS SDK.

We have nothing related to OneSignalOutcomes or OneSignal in our codebase. And, by the way, OneSignalOutcomes is the same SDK mentioned by Apple in #2625.

I do not understand why OneSignal is linked to RxSwift, but both OneSignal and RxSwift are listed in the Apple documentation about privacy. Maybe asking Apple about that identification is the solution?