CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity
storebound/skills/export-compliance/SKILL.md

2.9 KiB
Raw Blame History

name description
export-compliance Answer App Store export compliance (encryption) for a mobile app or game correctly - ITSAppUsesNonExemptEncryption in Info.plist, the per-build usesNonExemptEncryption answer and encryption declarations through the App Store Connect API (storebound apple encryption), French declaration, and what counts as exempt. Use when a build shows "Missing Compliance", App Store Connect asks about encryption, or before the first TestFlight / App Store upload.

Export compliance (App Store)

Every build needs an answer to "does the app use non-exempt encryption". Without it the build waits in "Missing Compliance" and cannot go to TestFlight testers or review. The answer is a legal statement under US export rules: never declare exempt to get past the question. When the code does not prove the answer, ask the owner.

Decide

Usually exempt (answer false), when the app only uses encryption through the OS or standard protocols:

  • HTTPS / TLS through URLSession, WKWebView, the engine's HTTP client using the system TLS
  • Apple frameworks (Keychain, CryptoKit used only for authentication / integrity), StoreKit, Game Center
  • Ad, analytics, crash SDKs that talk HTTPS

Not exempt or needs a closer look (answer true, then a declaration / documents):

  • Your own or a bundled crypto library used for something beyond authentication (e.g. encrypting user content, custom VPN, end-to-end chat encryption)
  • Proprietary or non-standard algorithms Apple's "Complying with Encryption Export Regulations" page and the questions in App Store Connect are the reference.

Set it once

  1. Put the answer in the config: apple.usesNonExemptEncryption: false (or true) in storebound.config.ts. storebound refuses to answer while it is unset.
  2. Put the same answer in Info.plist so every new build arrives answered: ITSAppUsesNonExemptEncryption = NO (Boolean). For true also ITSEncryptionExportComplianceCode once you have an approved declaration's code.
  3. Builds already uploaded without the key: storebound apple encryption --dry, then storebound apple encryption (sets the answer on every unanswered build, or --build N).
  4. true: create the encryption declaration in App Store Connect > App Information > App Encryption Documentation (upload the documents it asks for, including the French declaration when distributing in France). After it is APPROVED, storebound apple encryption links it to the builds. storebound never creates a declaration or claims an exemption on its own.
  5. Check: storebound validate --apple shows "export compliance answered".

Gotchas

  • Answering once in the UI only covers that build; the Info.plist key covers all future builds.
  • Changing an SDK (e.g. adding an end-to-end encrypted chat) can change the answer: re-check on every new SDK.
  • Play has no equivalent question; this is App Store only.