Malformed Framework response from App Store Connect

[federicoramos77]

Description

I got this email from App Store Connect after submitting a macOS app with Firebase 10.23.0 and Xcode 14.3. M1 MacBook with Sonoma 14.3.1
My project only has Firebase as dependency.

I tried:
Removing all dependencies, clearing build folder and derived data. Xcode submission went through but then you receive an email from Connect.

Reproducing the issue

No response

Firebase SDK Version

10.23.0

Xcode Version

14.3

Installation Method

Swift Package Manager

Firebase Product(s)

All

Targeted Platforms

macOS

Relevant Log Output

No response

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

{
  "originHash" : "c63c63846d9c539229e96de38d6af51417e28c0ee9a0bc48bd0f0f19d923c329",
  "pins" : [
    {
      "identity" : "abseil-cpp-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/abseil-cpp-binary.git",
      "state" : {
        "revision" : "7ce7be095bc3ed3c98b009532fe2d7698c132614",
        "version" : "1.2024011601.0"
      }
    },
    {
      "identity" : "app-check",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/app-check.git",
      "state" : {
        "revision" : "3e464dad87dad2d29bb29a97836789bf0f8f67d2",
        "version" : "10.18.1"
      }
    },
    {
      "identity" : "firebase-ios-sdk",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/firebase-ios-sdk",
      "state" : {
        "revision" : "fcf5ced6dae2d43fced2581e673cc3b59bdb8ffa",
        "version" : "10.23.0"
      }
    },
    {
      "identity" : "googleappmeasurement",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleAppMeasurement.git",
      "state" : {
        "revision" : "6ec4ca62b00a665fa09b594fab897753a8c635fa",
        "version" : "10.23.0"
      }
    },
    {
      "identity" : "googledatatransport",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleDataTransport.git",
      "state" : {
        "revision" : "a637d318ae7ae246b02d7305121275bc75ed5565",
        "version" : "9.4.0"
      }
    },
    {
      "identity" : "googleutilities",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleUtilities.git",
      "state" : {
        "revision" : "26c898aed8bed13b8a63057ee26500abbbcb8d55",
        "version" : "7.13.1"
      }
    },
    {
      "identity" : "grpc-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/grpc-binary.git",
      "state" : {
        "revision" : "67043f6389d0e28b38fa02d1c6952afeb04d807f",
        "version" : "1.62.1"
      }
    },
    {
      "identity" : "gtm-session-fetcher",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/gtm-session-fetcher.git",
      "state" : {
        "revision" : "76135c9f4e1ac85459d5fec61b6f76ac47ab3a4c",
        "version" : "3.3.1"
      }
    },
    {
      "identity" : "interop-ios-for-google-sdks",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/interop-ios-for-google-sdks.git",
      "state" : {
        "revision" : "2d12673670417654f08f5f90fdd62926dc3a2648",
        "version" : "100.0.0"
      }
    },
    {
      "identity" : "leveldb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/leveldb.git",
      "state" : {
        "revision" : "43aaef65e0c665daadf848761d560e446d350d3d",
        "version" : "1.22.4"
      }
    },
    {
      "identity" : "nanopb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/nanopb.git",
      "state" : {
        "revision" : "b7e1104502eca3a213b46303391ca4d3bc8ddec1",
        "version" : "2.30910.0"
      }
    },
    {
      "identity" : "promises",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/promises.git",
      "state" : {
        "revision" : "540318ecedd63d883069ae7f1ed811a2df00b6ac",
        "version" : "2.4.0"
      }
    },
    {
      "identity" : "swift-protobuf",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-protobuf.git",
      "state" : {
        "revision" : "65e8f29b2d63c4e38e736b25c27b83e012159be8",
        "version" : "1.25.2"
      }
    }
  ],
  "version" : 3
}

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[paulb777]

Please include the Package.resolved in the issue report.

[federicoramos77]

Done. Sorry.

[paulb777]

Thanks! We've reproduced. It looks like Apple silently added new requirements today or within the last few days since we last tested.

We'll investigate.

[paulb777]

If you're using Firestore, but not Analytics, the source SwiftPM build should be a workaround. See https://github.com/firebase/firebase-ios-sdk?tab=readme-ov-file#visionos

[yakovmanshin]

Same issue here:

• Xcode 15.3 on macOS 14.4 RC (Xcode Cloud) → ASC errors ITMS-90291 and ITMS-90292
• Xcode 15.2 on macOS 14.3.1 (Xcode Cloud) → all good

[jtaby]

Just wanted to confirm that this issue occurs on 10.23.0 (I was waiting for this update to fix our issue). Seems like @paulb777 you've gotten the repro you need?

[ncooke3]

Yes, I was able to repro and am working on a fix.

[paulb777]

Yes we fixed one macOS framework structure issue in 10.23.0 and then this new one was introduced today coincident with the 10.23.0 release.

[jtaby]

Thanks all. Appreciate the response. Should we expect a hotfix this week or should we expect this to be part of the normal release cycle? just need to manage expectations with the team.

[emperinter]

Tested the latest Firebase 10.23.0 , feedback reported the following error, still not working. So the latest version still conflicts with Xcode 15.3? A similar error is mentioned in #12505 (comment)

[paulb777]

@emperinter The issue in #12505 was addressed. Apple introduced new checks today that we're now working on.

[emperinter]

🤣 One problem solved, and found a new problem, it is not clear when it can be fixed? The last half month can not be used really quite affect the business monitoring, related work can not be carried out, the team is considering downgrading the relevant program version to solve this problem or migrate to other platforms.

[paulb777]

One option could be to stay on Xcode 15.2 while the Xcode 15.3/App Store issues get sorted.

[Lguanghui]

Same issue. Waiting for a new fixed version.

[jtaby]

One option could be to stay on Xcode 15.2 while the Xcode 15.3/App Store issues get sorted.

Thanks for this tip, I can confirm it works in the meantime

[jesus-mg-ios]

Same here, please fix it. Any ETA @ncooke3 ?

[CristianMoisei]

You can download Xcode 15.2 from here and use Firebase 10.21. I was able to get my binaries approved for Catalyst this way.

[jesus-mg-ios]

I know but I have more dependencies that work with Xcode 15.3 and its features are only available on new versions so ... nothing to do with it.

[ncooke3]

Hi everyone, we are still working on this. The macOS and macCatalyst framework structure is changing quite a bit, so this is taking some time to work through. The fix is scheduled to be released in 10.24.0 during the week of April 9. For now, the workaround is to use Xcode 15.2.

Additionally:

If you're using Firestore, but not Analytics, the source SwiftPM build should be a workaround. See https://github.com/firebase/firebase-ios-sdk?tab=readme-ov-file#visionos

[pmacro]

You can workaround using something like this, but easier to downgrade of course:

# resolve packages as a separate step
xcodebuild -resolvePackageDependencies -workspace My.xcworkspace -scheme MyScheme -derivedDataPath build -destination generic/platform\=macOS,variant\=Mac\ Catalyst

cd build/SourcePackages/artifacts

# Fixes the "Current" symlink. This makes the archive succeed.
find -P . -regex ".*\.framework/\Versions/\Current" -execdir rm -rf {} \; -execdir ln -s A {} \;
# Find the top-level symlinks and fix those too. The archive succeeds without this, but is rejected by Apple.
# I haven't scripted this yet, but `ln -s ` all top-level entries to the matching Versions/Current/blah entry.

# Create the archive as normal, but avoid touching the packages.
xcodebuild -skipPackageUpdates -workspace My.xcworkspace -scheme MyScheme -derivedDataPath build -destination generic/platform\=macOS,variant\=Mac\ Catalyst archive

It's surprising this hasn't been an issue before now because this has been Apple's guidance for > 10 years

[jtaby]

Yeah I think Apple just started enforcing it

[wojciech-kulik]

@ncooke3 do we have any specific release date? I see in the milestone that everything is already done, isn't it?

[YoavGro]

This is still reproducing in 10.23.1

[wojciech-kulik]

@YoavGro the fix is planned in 10.24.0

[ncooke3]

@wojciech-kulik, 10.24.0 is being released today. It is already released for SPM and the Firebase.zip (https://github.com/firebase/firebase-ios-sdk/releases/download/10.24.0/Firebase.zip).

CocoaPods and Carthage publishing are still in progress.

[ncooke3]

I'm going to close this issue as the 10.24.0 release should fix this.

[wojciech-kulik]

I can confirm that it works as expected now :). Yesterday I released the app with the latest Firebase package from SPM. 🎊 Thanks for resolving this issue @ncooke3 🍻