CRT
25bc761a53
- New: review-rejections, portfolio-originality, release-management, store-preflight, privacy-manifest, export-compliance, aso-basics, whats-new - Updated: explicit build numbers, first availability UI fallback, phased + manual release by default, IAP versions in review submissions (API 4.4.1, reported, verify), IAP description 45, privacy manifest cross-links, tool-neutral CLI instructions - docs/agents-core.md: shared rules for every agent
41 lines
2.9 KiB
Markdown
41 lines
2.9 KiB
Markdown
---
|
|
name: export-compliance
|
|
description: Answer App Store export compliance (encryption) for a mobile game correctly - ITSAppUsesNonExemptEncryption in Info.plist, the per-build usesNonExemptEncryption answer and encryption declarations through the App Store Connect API (storebound apple encryption), French declaration, and what counts as exempt. Use when a build shows "Missing Compliance", App Store Connect asks about encryption, or before the first TestFlight / App Store upload.
|
|
---
|
|
|
|
# Export compliance (App Store)
|
|
|
|
Every build needs an answer to "does the app use non-exempt encryption". Without it the build waits in "Missing
|
|
Compliance" and cannot go to TestFlight testers or review. The answer is a legal statement under US export rules:
|
|
**never declare exempt to get past the question**. When the code does not prove the answer, ask the owner.
|
|
|
|
## Decide
|
|
Usually exempt (answer `false`), when the game only uses encryption through the OS or standard protocols:
|
|
- HTTPS / TLS through URLSession, WKWebView, the engine's HTTP client using the system TLS
|
|
- Apple frameworks (Keychain, CryptoKit used only for authentication / integrity), StoreKit, Game Center
|
|
- Ad, analytics, crash SDKs that talk HTTPS
|
|
|
|
Not exempt or needs a closer look (answer `true`, then a declaration / documents):
|
|
- Your own or a bundled crypto library used for something beyond authentication (e.g. encrypting user content,
|
|
custom VPN, end-to-end chat encryption)
|
|
- Proprietary or non-standard algorithms
|
|
Apple's "Complying with Encryption Export Regulations" page and the questions in App Store Connect are the reference.
|
|
|
|
## Set it once
|
|
1. Put the answer in the config: `apple.usesNonExemptEncryption: false` (or `true`) in `storebound.config.ts`.
|
|
storebound refuses to answer while it is unset.
|
|
2. Put the same answer in Info.plist so every new build arrives answered:
|
|
`ITSAppUsesNonExemptEncryption` = `NO` (Boolean). For `true` also `ITSEncryptionExportComplianceCode` once you
|
|
have an approved declaration's code.
|
|
3. Builds already uploaded without the key: `storebound apple encryption --dry`, then `storebound apple encryption`
|
|
(sets the answer on every unanswered build, or `--build N`).
|
|
4. `true`: create the encryption declaration in App Store Connect > App Information > App Encryption Documentation
|
|
(upload the documents it asks for, including the French declaration when distributing in France). After it is
|
|
APPROVED, `storebound apple encryption` links it to the builds. storebound never creates a declaration or claims
|
|
an exemption on its own.
|
|
5. Check: `storebound validate --apple` shows "export compliance answered".
|
|
|
|
## Gotchas
|
|
- Answering once in the UI only covers that build; the Info.plist key covers all future builds.
|
|
- Changing an SDK (e.g. adding an end-to-end encrypted chat) can change the answer: re-check on every new SDK.
|
|
- Play has no equivalent question; this is App Store only.
|