[ObjC] Backport Privacy manifests 1.61.x (#35771)

Backport #35542 and #35616 for 1.61.x release

---------

Co-authored-by: Nick Cooke <nickcooke@google.com>

9 files changed, 105 insertions, 13 deletions

diff --git a/gRPC-C++.podspec b/gRPC-C++.podspec
index c1c9b9b3db..071aa948f1 100644
--- a/gRPC-C++.podspec
+++ b/gRPC-C++.podspec
@@ -80,6 +80,14 @@ Pod::Spec.new do |s|
 
   s.header_mappings_dir = 'include/grpcpp'
 
+  # Exposes the privacy manifest. Depended on by any subspecs containing
+  # non-interface files.
+  s.subspec 'Privacy' do |ss|
+    ss.resource_bundles = {
+      s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+    }
+  end
+
   s.subspec 'Interface' do |ss|
     ss.header_mappings_dir = 'include/grpcpp'
 
@@ -214,6 +222,7 @@ Pod::Spec.new do |s|
 
   s.subspec 'Implementation' do |ss|
     ss.header_mappings_dir = '.'
+    ss.dependency "#{s.name}/Privacy", version
     ss.dependency "#{s.name}/Interface", version
     ss.dependency 'gRPC-Core', version
     abseil_version = '1.20230802.0'
@@ -2729,6 +2738,7 @@ Pod::Spec.new do |s|
     ss.header_mappings_dir = '.'
     ss.dependency "#{s.name}/Cronet-Interface", version
     ss.dependency "#{s.name}/Implementation", version
+    ss.dependency "#{s.name}/Privacy", version
 
     ss.dependency 'gRPC-Core/Cronet-Implementation', version
 
diff --git a/gRPC-Core.podspec b/gRPC-Core.podspec
index ee4ccd7130..0d6f5c8741 100644
--- a/gRPC-Core.podspec
+++ b/gRPC-Core.podspec
@@ -94,6 +94,14 @@ Pod::Spec.new do |s|
   s.compiler_flags = '-DGRPC_ARES=0 -Wno-comma'
   s.libraries = 'c++'
 
+  # Exposes the privacy manifest. Depended on by any subspecs containing
+  # non-interface files.
+  s.subspec 'Privacy' do |ss|
+    ss.resource_bundles = {
+      s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+    }
+  end
+
   # Like many other C libraries, gRPC-Core has its public headers under `include/<libname>/` and its
   # sources and private headers in other directories outside `include/`. Cocoapods' linter doesn't
   # allow any header to be listed outside the `header_mappings_dir` (even though doing so works in
@@ -185,6 +193,7 @@ Pod::Spec.new do |s|
     ss.header_mappings_dir = '.'
     ss.libraries = 'z'
     ss.dependency "#{s.name}/Interface", version
+    ss.dependency "#{s.name}/Privacy", version
     ss.dependency 'BoringSSL-GRPC', '0.0.31'
     ss.dependency 'abseil/algorithm/container', abseil_version
     ss.dependency 'abseil/base/base', abseil_version
@@ -3482,6 +3491,7 @@ Pod::Spec.new do |s|
 
     ss.dependency "#{s.name}/Interface", version
     ss.dependency "#{s.name}/Implementation", version
+    ss.dependency "#{s.name}/Privacy", version
     ss.dependency "#{s.name}/Cronet-Interface", version
 
     ss.source_files = 'src/core/ext/transport/cronet/client/secure/cronet_channel_create.cc',
diff --git a/gRPC.podspec b/gRPC.podspec
index 92f0cd7c05..9a0e227983 100644
--- a/gRPC.podspec
+++ b/gRPC.podspec
@@ -32,8 +32,6 @@ Pod::Spec.new do |s|
     :tag => "v#{version}",
   }
 
-  s.resource = 'src/objective-c/PrivacyInfo.xcprivacy'
-
   name = 'GRPCClient'
   s.module_name = name
   s.header_dir = name
@@ -52,6 +50,14 @@ Pod::Spec.new do |s|
   s.tvos.deployment_target = '12.0'
   s.watchos.deployment_target = '6.0'
 
+  # Exposes the privacy manifest. Depended on by any subspecs containing
+  # non-interface files.
+  s.subspec 'Privacy' do |ss|
+    ss.resource_bundles = {
+      s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+    }
+  end
+
   s.subspec 'Interface-Legacy' do |ss|
     ss.header_mappings_dir = 'src/objective-c/GRPCClient'
 
@@ -72,7 +78,7 @@ Pod::Spec.new do |s|
                       "src/objective-c/GRPCClient/GRPCTypes.h",
                       "src/objective-c/GRPCClient/GRPCTypes.mm"
     ss.dependency "gRPC-RxLibrary/Interface", version
-
+    ss.dependency "#{s.name}/Privacy", version
     s.ios.deployment_target = '10.0'
     s.osx.deployment_target = '10.12'
     s.tvos.deployment_target = '12.0'
@@ -107,7 +113,7 @@ Pod::Spec.new do |s|
                       'src/objective-c/GRPCClient/version.h'
 
     ss.dependency "#{s.name}/Interface-Legacy", version
-
+    ss.dependency "#{s.name}/Privacy", version
     s.ios.deployment_target = '10.0'
     s.osx.deployment_target = '10.12'
     s.tvos.deployment_target = '12.0'
@@ -141,6 +147,7 @@ Pod::Spec.new do |s|
 
     ss.dependency "#{s.name}/Interface-Legacy", version
     ss.dependency "#{s.name}/Interface", version
+    ss.dependency "#{s.name}/Privacy", version
     ss.dependency 'gRPC-Core', version
     ss.dependency 'gRPC-RxLibrary', version
 
@@ -157,6 +164,7 @@ Pod::Spec.new do |s|
                       'src/objective-c/GRPCClient/GRPCCall+Cronet.mm',
                       'src/objective-c/GRPCClient/private/GRPCCore/GRPCCoreCronet/*.{h,mm}'
     ss.dependency "#{s.name}/GRPCCore", version
+    ss.dependency "#{s.name}/Privacy", version
     ss.dependency 'gRPC-Core/Cronet-Implementation', version
     ss.dependency 'CronetFramework'
 
diff --git a/src/objective-c/BoringSSL-GRPC.podspec b/src/objective-c/BoringSSL-GRPC.podspec
index 6537a0a70a..610c3367a5 100644
--- a/src/objective-c/BoringSSL-GRPC.podspec
+++ b/src/objective-c/BoringSSL-GRPC.podspec
@@ -122,6 +122,11 @@ Pod::Spec.new do |s|
   end
   s.subspec 'Implementation' do |ss|
     ss.header_mappings_dir = 'src'
+
+    ss.resource_bundles = {
+      s.module_name => 'src/PrivacyInfo.xcprivacy'
+    }
+
     ss.source_files = 'src/ssl/*.{h,c,cc}',
                       'src/ssl/**/*.{h,c,cc}',
                       'src/crypto/*.{h,c,cc}',
@@ -686,6 +691,16 @@ Pod::Spec.new do |s|
       zwQA
     EOF
 
+    # PrivacyInfo.xcprivacy is not part of BoringSSL repo, inject it during pod installation
+    base64 --decode $opts <<EOF | gunzip > src/PrivacyInfo.xcprivacy
+      H4sICAAAAAAC/1ByaXZhY3lJbmZvLnhjcHJpdmFjeQC1kl9PwjAUxZ/Hp6h9Z1di/JsxAhskJAQXGQ8+
+      Nt0VG7a1aRuw395OHUhE8UHflrNzzj2/pNHgpSrJBrURsu7TXnhOCdZcFqJe9ekyn3Rv6CDuRGfpfZI/
+      ZmOiSmEsyZaj2TQhtAswVKpEgDRPSTabLnLiOwDGc0ros7XqDmC73YascYVcVo3RQKalQm3dzJd1fSAs
+      bEH9mff2gzleLQS3cSeI1uji+SLTYsO4yzXja78ygkb2f59YaRC++BJZlsgtFimzLHcKzS7BtGYOvm1O
+      ZcVEfdI+5ByNwWKYTY/U+4+gBQh+TrZBbzNW+wFHnQmzuJLaTUSJuajQWFapCD4SJ488IDNyDxV8mrm/
+      m1z1rsPeYSnscaDl+RewhTMWq5GUtsH7Y7KLy8ntL8h2WqtE8PY0484rAb5xoDEDAAA=
+    EOF
+
     # We are renaming openssl to openssl_grpc so that there is no conflict with openssl if it exists
     find . -type f \\( -path '*.h' -or -path '*.cc' -or -path '*.c' \\) -print0 | xargs -0 -L1 sed -E -i'.grpc_back' 's;#include <openssl/;#include <openssl_grpc/;g'
 
diff --git a/src/objective-c/PrivacyInfo.xcprivacy b/src/objective-c/PrivacyInfo.xcprivacy
index 276f7610da..04aa8ca560 100644
--- a/src/objective-c/PrivacyInfo.xcprivacy
+++ b/src/objective-c/PrivacyInfo.xcprivacy
@@ -18,6 +18,14 @@
 				<string>C617.1</string>
 			</array>
 		</dict>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategorySystemBootTime</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>35F9.1</string>
+			</array>
+		</dict>
 	</array>
 </dict>
 </plist>
diff --git a/templates/gRPC-C++.podspec.template b/templates/gRPC-C++.podspec.template
index 739e2af928..e4b8bf3ecf 100644
--- a/templates/gRPC-C++.podspec.template
+++ b/templates/gRPC-C++.podspec.template
@@ -164,6 +164,14 @@
 
     s.header_mappings_dir = 'include/grpcpp'
 
+    # Exposes the privacy manifest. Depended on by any subspecs containing
+    # non-interface files.
+    s.subspec 'Privacy' do |ss|
+      ss.resource_bundles = {
+        s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+      }
+    end
+
     s.subspec 'Interface' do |ss|
       ss.header_mappings_dir = 'include/grpcpp'
 
@@ -172,6 +180,7 @@
 
     s.subspec 'Implementation' do |ss|
       ss.header_mappings_dir = '.'
+      ss.dependency "#{s.name}/Privacy", version
       ss.dependency "#{s.name}/Interface", version
       ss.dependency 'gRPC-Core', version
       abseil_version = '1.20230802.0'
@@ -203,6 +212,7 @@
       ss.header_mappings_dir = '.'
       ss.dependency "#{s.name}/Cronet-Interface", version
       ss.dependency "#{s.name}/Implementation", version
+      ss.dependency "#{s.name}/Privacy", version
 
       ss.dependency 'gRPC-Core/Cronet-Implementation', version
 
diff --git a/templates/gRPC-Core.podspec.template b/templates/gRPC-Core.podspec.template
index 626e67b4a7..a3a52d2e1b 100644
--- a/templates/gRPC-Core.podspec.template
+++ b/templates/gRPC-Core.podspec.template
@@ -170,6 +170,14 @@
     s.compiler_flags = '-DGRPC_ARES=0 -Wno-comma'
     s.libraries = 'c++'
 
+    # Exposes the privacy manifest. Depended on by any subspecs containing
+    # non-interface files.
+    s.subspec 'Privacy' do |ss|
+      ss.resource_bundles = {
+        s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+      }
+    end
+
     # Like many other C libraries, gRPC-Core has its public headers under `include/<libname>/` and its
     # sources and private headers in other directories outside `include/`. Cocoapods' linter doesn't
     # allow any header to be listed outside the `header_mappings_dir` (even though doing so works in
@@ -189,6 +197,7 @@
       ss.header_mappings_dir = '.'
       ss.libraries = 'z'
       ss.dependency "#{s.name}/Interface", version
+      ss.dependency "#{s.name}/Privacy", version
       ss.dependency 'BoringSSL-GRPC', '0.0.31'
       % for abseil_spec in grpc_abseil_specs:
       ss.dependency '${abseil_spec}', abseil_version
@@ -214,6 +223,7 @@
 
       ss.dependency "#{s.name}/Interface", version
       ss.dependency "#{s.name}/Implementation", version
+      ss.dependency "#{s.name}/Privacy", version
       ss.dependency "#{s.name}/Cronet-Interface", version
 
       ss.source_files = ${ruby_multiline_list(grpc_cronet_files, 22)}
diff --git a/templates/gRPC.podspec.template b/templates/gRPC.podspec.template
index c1f739ce85..0f098fcec3 100644
--- a/templates/gRPC.podspec.template
+++ b/templates/gRPC.podspec.template
@@ -34,8 +34,6 @@
       :tag => "v#{version}",
     }
 
-    s.resource = 'src/objective-c/PrivacyInfo.xcprivacy'
-
     name = 'GRPCClient'
     s.module_name = name
     s.header_dir = name
@@ -54,6 +52,14 @@
     s.tvos.deployment_target = '12.0'
     s.watchos.deployment_target = '6.0'
 
+    # Exposes the privacy manifest. Depended on by any subspecs containing
+    # non-interface files.
+    s.subspec 'Privacy' do |ss|
+      ss.resource_bundles = {
+        s.module_name => 'src/objective-c/PrivacyInfo.xcprivacy'
+      }
+    end
+
     s.subspec 'Interface-Legacy' do |ss|
       ss.header_mappings_dir = 'src/objective-c/GRPCClient'
 
@@ -74,7 +80,7 @@
                         "src/objective-c/GRPCClient/GRPCTypes.h",
                         "src/objective-c/GRPCClient/GRPCTypes.mm"
       ss.dependency "gRPC-RxLibrary/Interface", version
-
+      ss.dependency "#{s.name}/Privacy", version
       s.ios.deployment_target = '10.0'
       s.osx.deployment_target = '10.12'
       s.tvos.deployment_target = '12.0'
@@ -109,7 +115,7 @@
                         'src/objective-c/GRPCClient/version.h'
 
       ss.dependency "#{s.name}/Interface-Legacy", version
-
+      ss.dependency "#{s.name}/Privacy", version
       s.ios.deployment_target = '10.0'
       s.osx.deployment_target = '10.12'
       s.tvos.deployment_target = '12.0'
@@ -143,6 +149,7 @@
 
       ss.dependency "#{s.name}/Interface-Legacy", version
       ss.dependency "#{s.name}/Interface", version
+      ss.dependency "#{s.name}/Privacy", version
       ss.dependency 'gRPC-Core', version
       ss.dependency 'gRPC-RxLibrary', version
 
@@ -159,6 +166,7 @@
                         'src/objective-c/GRPCClient/GRPCCall+Cronet.mm',
                         'src/objective-c/GRPCClient/private/GRPCCore/GRPCCoreCronet/*.{h,mm}'
       ss.dependency "#{s.name}/GRPCCore", version
+      ss.dependency "#{s.name}/Privacy", version
       ss.dependency 'gRPC-Core/Cronet-Implementation', version
       ss.dependency 'CronetFramework'
 
diff --git a/templates/src/objective-c/BoringSSL-GRPC.podspec.template b/templates/src/objective-c/BoringSSL-GRPC.podspec.template
index e0b511d30e..8c5913e9a8 100644
--- a/templates/src/objective-c/BoringSSL-GRPC.podspec.template
+++ b/templates/src/objective-c/BoringSSL-GRPC.podspec.template
@@ -17,13 +17,14 @@
     # bytes from this file, then delete the intermediate file.
     #
     # TODO(mxyan): move to python3 style gzip compression when possible
-    def compress_boringssl_prefix_header():
+    def compress_and_encode_file(filepath):
+      gzip_filepath = filepath + '.gz'
       import gzip, shutil, os, base64
-      with open('src/boringssl/boringssl_prefix_symbols.h', 'rb') as f_in, gzip.GzipFile('src/boringssl/boringssl_prefix_symbols.h.gz', 'w', mtime=0.0) as f_out:
+      with open(filepath, 'rb') as f_in, gzip.GzipFile(gzip_filepath, 'w', mtime=0.0) as f_out:
         shutil.copyfileobj(f_in, f_out)
-      with open('src/boringssl/boringssl_prefix_symbols.h.gz', 'rb') as f_in:
+      with open(gzip_filepath, 'rb') as f_in:
         prefix_gz = f_in.read()
-      os.remove('src/boringssl/boringssl_prefix_symbols.h.gz')
+      os.remove(gzip_filepath)
       prefix_gz_b64 = base64.b64encode(prefix_gz)
       WRAP_LENGTH=80
       prefix_gz_b64_wrapped = [prefix_gz_b64[i:i+WRAP_LENGTH] for i in range(0, len(prefix_gz_b64), WRAP_LENGTH)]
@@ -152,6 +153,11 @@
     end
     s.subspec 'Implementation' do |ss|
       ss.header_mappings_dir = 'src'
+
+      ss.resource_bundles = {
+        s.module_name => 'src/PrivacyInfo.xcprivacy'
+      }
+
       ss.source_files = 'src/ssl/*.{h,c,cc}',
                         'src/ssl/**/*.{h,c,cc}',
                         'src/crypto/*.{h,c,cc}',
@@ -200,7 +206,14 @@
              *) opts="--ignore-garbage" ;;
       esac
       base64 --decode $opts <<EOF | gunzip > src/include/openssl/boringssl_prefix_symbols.h
-        % for line in compress_boringssl_prefix_header():
+        % for line in compress_and_encode_file('src/boringssl/boringssl_prefix_symbols.h'):
+        ${line.decode('utf-8')}
+        % endfor
+      EOF
+
+      # PrivacyInfo.xcprivacy is not part of BoringSSL repo, inject it during pod installation
+      base64 --decode $opts <<EOF | gunzip > src/PrivacyInfo.xcprivacy
+        % for line in compress_and_encode_file('src/objective-c/PrivacyInfo.xcprivacy'):
         ${line.decode('utf-8')}
         % endfor
       EOF