App crashes on older iOS devices: DYLD, Symbol not found: _kSecUseDataProtectionKeychain

[Adrian-S]

We are trying to compile for debug and we are stuck between not installing due to ApplicationVerificationFailed (invalid entitlements) and crashing the app on startup with error:

Termination Description: DYLD, Symbol not found: _kSecUseDataProtectionKeychain
| Referenced from: /var/containers/Bundle/Application/[...]
| Expected in: dyld shared cache | in /var/containers/Bundle/Application/[...]

AIR Version: 51.1.3.6
Device: iPhones with iOS 12.5.7
Compiled on: MacOS in VM

App starts on newer iPhone, at least up to the popup asking for debugger IP. We couldn't connect to debugger yet and crash may be due to something unrelated to this.

Steps to Reproduce

We've been trying to use APM to generate all XMLs. The extensions used:

com.android.installreferrer
com.distriqt.Application
com.distriqt.CameraRollExtended
com.distriqt.Contacts
com.distriqt.firebase.Crashlytics
com.distriqt.firebase.Database
com.distriqt.IDFA
com.distriqt.InAppBilling
com.distriqt.PushNotifications-FCM

InfoAdditions.xml

<plist version="1.0">
    <dict>
        <key>UIDeviceFamily</key><array><string>1</string><string>2</string></array>
        
        <key>MinimumOSVersion</key>
        <string>12.0</string>
        
        <key>UILaunchStoryboardName</key><string>LaunchScreen</string>
        <key>ITSAppUsesNonExemptEncryption</key><false/>
        <key>FirebaseScreenReportingEnabled</key><true/>
        <key>NSAppTransportSecurity</key>
        <dict>
            <key>NSAllowsArbitraryLoads</key><true/>
        </dict>
        <key>UIViewControllerBasedStatusBarAppearance</key><false/>
        <key>NSCameraUsageDescription</key><string>...</string>
        <key>CFBundleURLTypes</key>
        <array>
            <dict>
                <key>CFBundleURLName</key><string>${applicationId}</string>
                <key>CFBundleURLSchemes</key><array><string>ota</string></array>
            </dict>
        </array>
    </dict>
</plist>

Entitlements.xml

<plist version="1.0">
    <dict>
        <key>com.apple.developer.team-identifier</key>
        <string>${bundleSeedId}</string>
    </dict>
</plist>

Attempts for fix

Added extra entitlement resulted in ApplicationVerificationFailed with both values.

<key>com.apple.developer.default-data-protection</key>
<string>NSFileProtectionNone</string>
<!-- Value: NSFileProtectionComplete or NSFileProtectionNone -->

Removed entitlements keychain-access-groups resulted in ApplicationVerificationFailed aswell.

From what I gattered, _kSecUseDataProtectionKeychain was introduced in iOS 14, and I suspect it has something to do with push notifications.

The other thing suspected is that the app was moved from one developer account to another, changing the bundleSeedId. Adding both new and old bundle seeds to the keychain-access-groups also resulted in verification error.

Possible related issues: #3582 or the only one related to "Expected in: dyld shared cache".

[ajwfrost]

I think that symbol was actually introduced in iOS 13:
https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain?language=objc

So yes, it would crash on iOS 12.5.7.. the uses of that symbol would need to be hidden behind conditions that first check the OS version that it's running on.

I can't find any reference to that symbol within the AIR code... if you have the crash log / IPS file, it may help to find where the symbol was being referenced? Otherwise adding @marchbold in case there's an ANE that needs to have an increased minimum-OS-version value set on it.

thanks

[Adrian-S]

This it the full log.

OnTimeAgenda-2025-01-29-125136.ips.txt

[ajwfrost]

Interesting, looks like it's just resolving all the symbols during the start-up, which means it's not as helpful as I had hoped.

It might be possible to find whether that symbol is being used in a particular ANE file, but worth just checking you're using the latest versions of all of them first? But ultimately if that symbol is needed, it does mean you will need to end up with a minimum OS version of 13, so if you changed your MinimumOSVersion value it wouldn't crash any more (it just wouldn't install....)

thanks

[marchbold]

Hi,

Unfortunately we missed this in the latest update, but Firebase's minimum supported iOS version is now 13. So they no longer support iOS 12. I'll make sure we update our AIR packages to reflect this asap.

[marchbold]

To correct this with apm:

• generate an ios config:

apm generate config ios

• edit the file generated at config/ios/InfoAdditions.xml to have at least the following:

<plist version="1.0">
    <dict>

        <key>MinimumOSVersion</key>
        <string>13.0</string>

    </dict>
</plist>

• regenerate your app descriptor

apm generate app-descriptor

[raresn]

Kinda sad that it made 95% of our iOS test devices obsolete.... For instance our iphone 6+ does not receive updates, it is stuck on OS 12...

[marchbold]

Ah that's annoying but iOS 13+ is in use by more than 96.8% of devices, vs 98% for iOS 12, so you aren't losing many customers by updating this (~1.2%). https://iosref.com/ios-usage

And considering Xcode now encourages the lowest minimum version to be 13 I believe we'll start to see a lot of SDKs require a minimum of 13 this year.

[raresn]

You are correct - we only have 9 clients still on iOS 12.
So i believe we can handle them individually.

Thanks for the support!

[ajwfrost]

The Xcode minimum version setting is perhaps more than "encouragement" - https://developer.apple.com/support/xcode/

I just took a look on a development machine and the deployment target / minimum iOS version is being set to 15.0! Tried changing this back to 12.0 via the 'other' text entry option, and it didn't seem to take effect..

Double-checking 51.1.3.5 binaries and I get a minos version of 12.0 still.. But I just checked the output from our latest build (51.2, not yet released) and it's set to 15.0. We may need to look at this further - I suspect it's rejecting the 12.0 setting and then just taking it to 15.0 as a default (which is also the lowest number you can 'select' from the Xcode UI, drop-down option list for it).

thanks

[ajwfrost]

But I just checked the output from our latest build (51.2, not yet released) and it's set to 15.0.

Found a merge failure between the branches :-( so changing this to 12.0 in the xcconfig file, it seems to now work when building via xcodebuild. So we'll kick off another build for that! @raresn this won't help your case I guess due to the Firebase restrictions, but I'm glad you raised it so that we checked these settings!!

thanks

[raresn]

thank you as well for looking into it so fast!

[marchbold]

Yeah pretty sure we can still build libs supporting iOS 12 with the latest Xcode for my extensions, but it's definitely a manual change to the build settings. The UI only has back to 13 and yes the default is much higher.