Goal
I'm building an iOS app using flutter for frontend, and C/C++ as backend. They must interoperate through FFI, which is a language binding scheme through C dynamic libraries. I intend to submit it to iOS App Store.
Problems
The Dart FFI sample on accessing C-struct works on macOS through dynamic liking and binding. Now dynamic linking is technically possible on iOS according to Xcode 9 - No option to create dylib project iOS, however, it's unclear to me how to ship the app to AppStore, because dynamic linking is not allowed according to Apple Guidelines Section 2.5.2.
2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they
download, install, or execute code which introduces or changes
features or functionality of the app, including other apps.
Educational apps designed to teach, develop, or allow students to test
executable code may, in limited circumstances, download code provided
that such code is not used for other purposes. Such apps must make the
source code provided by the Application completely viewable and
editable by the user.
Quite a few SO questions confirm this problem, such as:
can I use dynamic library(shared object) in my iphone app?
Will Appstore reviewers allow us to use dynamic library in iOS8?
Then official flutter documentation says
Dynamically linked libraries are automatically loaded by the dynamic
linker when the app starts. Their constituent symbols can be resolved
using DynamicLibrary.process. You can also get a handle to the library
with DynamicLibrary.open to restrict the scope of symbol resolution,
but it’s unclear how Apple’s review process handles this.
Questions
As of the date when I post this (2020), does this say that I could never ship an app using this architecture to App Store?
Is it possible that I static link my C/C++ code into a single binary of a flutter app? Take Unity as an example, their iOS plugin system recompiles the plugin into native app. If flutter has a similar mechanism, how?
The answers saying you can't use dynamic libraries on iOS date to before iOS 8, when support for user-provided dynamic libraries was added.
Nothing in 2.5.2 days you can't use dynamic libraires as long as they are shipped as part of your app. So:
As of the date when I post this (2020), does this say that I could never ship an app using this architecture to App Store?
No it doesn't, as long as "this architecture" refers to using a dynamic library that you link to at build time and bundle into your application.
Adding inputs from Reddit's FlutterDev channel
#escamoteur
As I understand it you are not allowed to load any library from
outside your installation folder. Especially not downloading something
at a later point of time. Could you make this a Stackoverflow question
and tag it with Flutter?
#airflow_matt
Since iOS 8 there can be shared libraries in the bundle, when properly
codesigned I don't see why dlopen wouldn't work. Or you can link the
library with main executable itself (just like flutter does) and
dlopen self (DynamicLibrary.process()). I think it's worth a shot.
Related
we have a ios app that provides the platform for many similar games. When you install this app. This app already contains binaries of x number of games.
Now we are having size issue. So just wanted to know is it possible to create a ios app that can get installed and after that as per user selection can download the games binaries separately and then run. Like a app that can download games as plugins or extensions.
I work on game side part so i dont know anything about ios apps. but so far my understanding is -> when you create the ios executable then while compiling you should have all the code present (app + all the games it will run).
It is not possible to download a native executable and run it -- that is not a capability provided by app extensions.
One loophole you might consider: it is perfectly permissible to download and run javascript, or anything else that runs in a UIWebView or WKWebView, which are both sandboxed from your iOS App's process, and have access to OpenGLES 2.0 in the form of WebGL. There are also apps which have been accepted in the App Store which can run code in interpreted languages like Python.
I just got done reading the press hysteria around AFNetworking exposing apps to a man in the middle attack. I was surprised that sourcedna.com claims
SourceDNA analyzes the code in thousands of iOS & Android apps.
sourcedna.com even has a search engine to report whether a vendor's apps use the AFNetworking SDK.
Considering they don't have access to paid apps, how do they claim to do this? Do SDKs like AFNetworking log SDK use in some form? If so, to who?
I am curious about this too. Here is what I gather:
SourceDNA only checks whether the library is linked into the app binary. They do not check how or whether the library is actually used by the app.
Objective-C is a dynamic language and keeps a lot of metadata in the binary. You can trivially run tools like class-dump or otool -ov on any unencrypted binary and it will list the names and inheritance of all classes, and the names and signatures of all methods and instance variables in each class, among other things.
Libraries like AFNetworking have many distinctive class names that they can check for in the list of classes in the app. Each version will have some added or removed methods and/or instance variables, so by checking the class dump from the app against the class declarations from each version of the library, they can figure out the version of the library used.
However, apps downloaded from the App Store are encrypted; and the App Store is the only way that SourceDNA could have gotten these apps. It is possible to decrypt / crack encrypted apps (that is how people pirate paid apps -- they buy them, crack them, and post the unencrypted binaries on pirate websites), but the common way to do this I believe involves buying and running the app on a jailbroken device.
I assume that the SourceDNA people must have automated this process somehow, so that they can automatically report on thousands of apps.
As I replied to #janselrx, I believe it's as I suspected and they can only analyze free apps. From their website:
SourceDNA analyzes the code in thousands of iOS & Android apps. This report lets you explore recent data about the mobile SDKs and tools found in the top 500 free apps.
I find myself in a situation which may be unique. Please be patient, because this is going to be complex.
I am charged with creating for iOS 1) an SDK, which has taken the form of a framework , 2) a demo application, and 3) a reference application.
The SDK uses OpenCV, and so the OpenCV framework is automatically embedded inside it.
The project for the demo application at compile time automatically builds the SDK and includes a copy within itself. The demo application also links directly to the copy of OpenCV within the SDK.
The reference application is an example application meant to show people how to use the SDK framework.
So far all of this somehow works. <TAKE A BREATH>
The latest version of the demo application, however, has a problem. I need to get a copy of it into TestFlight. Despite it working fine on actual iPhones AND Xcode archiving it with no problems, nothing I have done has gotten it all the way through the App Store/TestFlight submission process. The furthest I've managed is to coerce it is that it got through validation, but when I tried submitting the app, after uploading Xcode complained:
ERROR ITMS-90034: "Missing or invalid signature. The bundle
'org.opencv' at bundle path
'Payload/FakeName.app/Frameworks/FakeNameIOSSDK.framework/opencv2.framework'
is not signed using an Apple submission certificate."
I have indeed verified that OpenCV (at least version 2.4.9 downloaded from the Website OpenCV.org) is not signed. I made an attempt to sign OpenCV with codesign, but I couldn't make that work.
The question is: What do I need to change to make the App Store happy enough that I can get my app into TestFlight? Is there some way to hide the lack of code-signing of OpenCV? Is there a way to get OpenCV properly code-signed such that the App Store is happy with it? (I have a strange vision of compiling the source of OpenCV directly into my SDK, but the size and complexity of OpenCV is such that I'd rather not try such a thing except as a measure of last resort.)
Alternatively, I find myself wondering about whether it is workable to not embed OpenCV in my SDK, but embed it within the app instead. This is what I did with the last release of the demo app in TestFlight. However, when I created the reference app, the system failed to work, leading to the current oddity of a framework within a framework.
Thanks in advance for any help anyone can provide.
I read many articles about dynamic library usage including this page "Can you build dynamic library...".
As apple document said, "Frameworks for iOS. iOS developers can now create dynamic frameworks. Frameworks are a collection of code and resources to encapsulate functionality that is valuable across multiple projects. Frameworks work perfectly with extensions, sharing logic that can be used by both the main application and the bundled extensions.", see full page from here.
Taking the security issue as consideration, I got the reject reason of dynamic library before iOS8, see details from "DarkDust's answer". But, how does it "just work" in iOS8? #appstore_reviewers?
Anyway, currently I'm writing a sample demo app and try to upload it to Appstore for review, the main feature is downloading a framework from internet to client and dlopen it. Hope that really "just works"!
Besides, the deployment target is iOS7.0, not sure it could works well in it.
I didn't get a so clear understand on differences between "dynamic library" and "framework", I think they are the same and in this thread I mean "Cocoa-touch framework" which could create in Xcode 6.
Some background: I'm trying to build an iOS app which does't contain extension feature, my cocoa-touch framework is for easy expand without uploading a new version as it comes from internet....
UPDATE
I published a demo project GMDemo here, will try to upload to Appstore.
UPDATE2
I failed to dlopen my dynamic framework with invalid code signing error after many tries in iOS device. Sorry, no good news here. (Almost forgot to update this question, sorry! BTW)
App Store Review Guidelines explicitly prohibit that in 2.4.5 Apps that download code in any way or form will be rejected https://developer.apple.com/app-store/review/guidelines/
UPDATE3 just use the same code signing!!!
I have test it in ad-hoc environment！
when my dynamic library use the code signing with the same code signing,It works,
otherwise,crush!!
I have a native (Obj-C, standard Xcode project) application and I'd like to integrate a partners iOS application (or specifically, it's functionality) into it as just another view in my application. The problem is that their application is a Flex/Air app. I really don't understand the Adobe compilation process on how it gets from a bunch of flex code down to an IPA. I don't see intermediate projects, shared objects, etc on the disk to produce that IPA. It looks like it doesn't rely on the Apple tool chain... as I understand it, you can produce the IPA on Windows as well.
Is there any way to build that Flex app in such a way that I can import it into Xcode so I can link against it and use it as a library from within my application?
While I specifically used iOS as an example since that is the most important platform, we'll want to apply this solution to our respective Android and Blackberry 6 apps as well.
No, you cannot embed an application within another application. This is true for all applications. Only thing you could do is get the swf of your partner's code and embed that into an Air application, but since you're not using Actionscript/Flex, it won't be possible.
Only other way would be to have an app link to the other application.