AppStore Connect fails validating app built with Xcode 15.3 when consuming binary Swift Package via SPM

We develop an SDK that is distributed as a statically linked, closed source Swift Package. Our customers have reported an issue when attempting to ship an application to the App Store using Xcode 15.3 that is preventing them from uploading the application:

Asset validation failed
Invalid Bundle. The bundle <AppName>.app/Frameworks/<Framework>.framework does not support the minimum OS Version specified in the Info.plist. (ID: 9cec9306-80a4-4503-a9bf-bd6e367f9679)

Our SDK has a minimum deployment target of iOS 13.0 and the customer has a deployment target of 15.2.

During local testing, I find that if my application and framework BOTH share the same deployment target of 13.0, then the App Store validation passes. If the application minimum version is greater than the framework minimum version, then the check fails.

Researching on the internet, other people have suggested making the minimum deployment version of these Swift Packages to be GREATER than the app version. For instance, a handful of the Google SDKs shipped as binary packages on SPM are setting their minimum deployment version to 100.0 to work around this issue.

I have tried this locally and found that if my app minimum deployment target is 15.2 and I set the MinimumOSVersion in the framework’s Info.plist file to 100, it passes the AppStore validation.

It would appear that the check is inverted on App Store validation process. It is expected that an application can be submitted to the AppStore using a framework that works with older deployment targets.

This issue appears to be related to the fact that Xcode 15.3 now embeds a .framework for statically linked framework dependencies. This is presumably done so that third party SDK's PrivacyInfo.xcprivacy can be included in the app package that it distributed to the app store. The binary portion of the statically linked library turns out to be much smaller (approx 35k) than the binary portion distributed in the .xcframework and appears to just be a small placeholder that does nothing since the actual code from the library is statically linked into the resulting application.

The problem with the workaround that the other framework vendors have taken is that eventually (hopefully)  will fix this check and then these frameworks will appear to target a no existing iOS version.

The other workaround that I spoke to our customer about was also extremely hackish and not really recommended was to resolve the Swift Package, then manually modify the contained Info.plist file to set the MinimumOSVersion in there to match what they are targeting for their application. This, however, then breaks the code signing of the SDK. So they then need to delete the _CodeResources folder from the resolved .xcframework.

None of these work arounds are really sustainable and violate all the things right in the world. I have created feedback FB13704428 for this issue, but am hoping to raise further awareness as this is causing customers to not be able to ship applications using our, and many other, third party SDKs.

Additional reading:

I just checked the status of FB13704428 and the resolution was marked as: Investigation complete - Unable to diagnose with current information. This is a bit unbelievable as this is widely reported over the internet and I can reproduce the issue at will. I have customer's reporting this issue to me as well. And the workaround to making this work is to manually go in and edit the Info.plist file and put in a bogus value that is way greater than the MinimumOSVersion of the containing application???

I would appreciate if other people that are seeing this issue could both comment here, and open your own feedback and include FB13704428 and this forum post.  needs to get this fixed.

We filed a ticket to Apple, and they say that it is their issue and they working on it. The suggested workaround was to set minimumOSVersion in frameworks to higher or equal to application version.

We created a script which will modify the Info.plist files in our shipped static frameworks and providing it to our customers, so they can run and set the version matching to their application target.

This appears to have been fixed with Xcode 15.4.

AppStore Connect fails validating app built with Xcode 15.3 when consuming binary Swift Package via SPM
 
 
Q