Hello. I am developing our company's SDK for iOS as a third-party library. This SDK consists of a static library and header files wrapped within a framework (and wrapping the target-specific frameworks in xcframework). I understand that codesign is required even for static frameworks, is it correct? Should I update the distributed files when the certificate expires? Does this depend on whether it is static or dynamic? When is the signature verified?

Hello. We provide our software in the form of static libraries (.a) wrapped in xcframework. Therefore, the final app will not include the embed framework. In such a case, should the manifest content required for the library be written as part of the application's xcprivacy file? Or can I provide xcprivacy as part of the xcframework?

Hi Apple team. Our library calls stat/fstat to get the file size, not the timestamp. In this case there is no applicable reason for NSPrivacyAccessedAPITypeReasons. Will the app still be rejected if I don't set something for NSPrivacyAccessedAPIType? Or should I write a reason for lying? The documentation seems to be contradictory.

I found strange behavior on Xcode 14. Suppose you have a iOS project with two targets: app and a static library. Static library is in target dependencies of app, so when an app is built, static library is also automatically built and linked. At this time, if the library's "skip install" is set to NO, the archived data will not be recognized as an iOS app and will be classified as Other Item in Organizer.(therefore, uploading is not possible) I don't think this behavior existed in previous Xcode versions, is this a bug?