Repository navigation
ITMS-91065: Missing signature when using plugins on the "privacy-impacting" list in add-to-app #148300
Description
Activity
What version of
url_launcher_iosdoes your pubspec.lock indicate? You need version 6.2.4 or higher.What version of
url_launcher_iosdoes your pubspec.lock indicate? You need version 6.2.4 or higher.Hi navaronbracke:
I'm using6.2.5verion, so 6.2.4 will work?Thanks
url_launcher_ios: dependency: transitive description: name: url_launcher_ios sha256: "9149d493b075ed740901f3ee844a38a00b33116c7c5c10d7fb27df8987fb51d5" url: "https://pub.dev" source: hosted version: "6.2.5"This seems to be already addressed as part of #139759 that you can check and confirm.
@darshankawar I don't really understand how to resolve it.
@namtn If you use
url_launcher 6.2.6you should be good. It depends onurl_launcher_ios 6.2.4or higher here https://github.com/flutter/packages/blob/main/packages/url_launcher/url_launcher/pubspec.yaml#L32As noted in the url_launcher changelog, that version specifically bumps the version of url_launcher_ios for this exact reason.
@namtn If you use
url_launcher 6.2.6you should be good. It depends onurl_launcher_ios 6.2.4or higher here https://github.com/flutter/packages/blob/main/packages/url_launcher/url_launcher/pubspec.yaml#L32As noted in the url_launcher changelog, that version specifically bumps the version of url_launcher_ios for this exact reason.
I tried with latest version 6.2.6, however apple still rejected.
Did you do the following as well?
- delete ios/Podfile.lock
flutter clean && flutter pub getcd ios && pod repo update && pod install
Your pods might have been outdated.
35 remaining items
I have been using
device_info_plusplugin and I am trying to add xcframeworks to my iOS app and all was working fine until recently when iOS build was rejected immediately after submission with the following message.ITMS-91065: Missing signature - Your app includes “Frameworks/device_info_plus.framework/device_info_plus”, which includes device_info_plus, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.Unfortunately you'll have to manually codesign the plugin xcframeworks, we haven't added it to the
flutter build ios-frameworkscommand yet.Wouldn't "Embed and Sign" automatically sign the framework during build? Also, my app signing is managed by XCode. How can I sign the framework manually?
Unfortunately you'll have to manually codesign the plugin xcframeworks, we haven't added it to the
flutter build ios-frameworkscommand yet.Do you have a rough timeline as to when that will show up in the next Flutter release, hotfix or full release?
@stuartmorgan at the very least, I think we should document in the Flutter docs the fact that frameworks may need to be signed, with a snippet of a script that automates this for all non-Flutter frameworks. Seeing that the deadline is fast approaching for iOS apps to submit apps with signed frameworks, a lot of devs will no doubt run into this very same issue.
Thanks in advance.
@stuartmorgan In case you need the previously posted bash script properly formatted, that devs can use for signing their iOS frameworks when updating the existing documentation:
#!/bin/bash # Path to the output directory containing the built frameworks OUTPUT_DIR="./Release" # Path to your codesigning identity CODESIGN_IDENTITY="Apple Development: My Identity (XXXXXXXXX)" # Sign each framework for framework in "$OUTPUT_DIR"/*.xcframework; do echo "Signing $framework with identity $CODESIGN_IDENTITY" framework_name=$(basename "$framework") if [ "$framework_name" != "Flutter.xcframework" ]; then echo "Signing $framework with identity $CODESIGN_IDENTITY" /usr/bin/codesign --force --sign "$CODESIGN_IDENTITY" "$framework" else echo "Skipping $framework" fi done echo "Frameworks signed successfully."
- marked webview_flutter_wkwebview missing signature - causes "Invalid binary" rejection during App Review #162406 as a duplicate of this issue
on Jan 29, 2025 - marked Missing signatures _CodeSignature folders for third party frameworks #179634 as a duplicate of this issue
on Dec 10, 2025 Hi all, to resolve this issue, I have to signed all frameworks mannually, exclude frameworks has signed by other teams (example Flutter.xcframework):
- build ios framework using command:
flutter build ios-framework - Run script to sign frameworks:
#!/bin/bash
# Path to the output directory containing the built frameworksOUTPUT_DIR="./Release"# Path to your codesigning identityCODESIGN_IDENTITY="Apple Development: NamTran (XXXXX7777)"# Sign each frameworkfor framework in "$OUTPUT_DIR"/*.xcframework; do echo "Signing $framework with identity$CODESIGN_IDENTITY" framework_name=$ (basename "$framework")if [ "$framework_name" != "Flutter.xcframework" ]; then echo "Signing $framework with identity $CODESIGN_IDENTITY" /usr/bin/codesign --force --sign "$CODESIGN_IDENTITY" "$framework" else echo "Skipping $framework" fi
done
echo "Frameworks signed successfully."
Thanks for detailed reply @namtn , we are also encountering the same and would try this. Can Flutter team add this code signing part for third parties in the documentation if not already there?
- build ios framework using command:
- added a commit that references this issue
on Mar 18, 2026 - added a commit that references this issue
on Mar 26, 2026 This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of
flutter doctor -vand a minimal reproduction of the issue.- locked as resolved and limited conversation to collaborators
on Apr 1, 2026 - added a commit that references this issue
on Apr 14, 2026 - added a commit that references this issue
on Sep 28, 2026
Use case
I uploaded my app using: url_launcher to testflight, however Apple rejected it with following reason:
ITMS-91065: Missing signature - Your app includes “Frameworks/url_launcher_ios.framework/url_launcher_ios”, which includes url_launcher_ios, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.
Proposal
Please help to resolve this issue?
Updated: Version
url_launcher: ^6.2.6and url_launcher_ios in pubspec.lock is: 6.3.0:url_launcher_ios: dependency: transitive description: name: url_launcher_ios sha256: "7068716403343f6ba4969b4173cbf3b84fc768042124bc2c011e5d782b24fe89" url: "https://pub.dev" source: hosted version: "6.3.0"