From 8e1419c94a87f7aebb051175c77fd6d312f16a5f Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Tue, 24 Mar 2026 13:30:20 +0800 Subject: [PATCH] chore(release): add app encryption compliance docs --- ...6-03-24-app-encryption-compliance-draft.md | 90 +++++++++++++++ ...26-03-24-appstore-encryption-form-draft.md | 105 ++++++++++++++++++ ios/Runner/Info.plist | 2 + macos/Runner/Info.plist | 2 + 4 files changed, 199 insertions(+) create mode 100644 docs/releases/2026-03-24-app-encryption-compliance-draft.md create mode 100644 docs/releases/appstore/2026-03-24-appstore-encryption-form-draft.md diff --git a/docs/releases/2026-03-24-app-encryption-compliance-draft.md b/docs/releases/2026-03-24-app-encryption-compliance-draft.md new file mode 100644 index 00000000..7f35fed7 --- /dev/null +++ b/docs/releases/2026-03-24-app-encryption-compliance-draft.md @@ -0,0 +1,90 @@ +# XWorkmate App Encryption Compliance Draft + +Date: 2026-03-24 +App: XWorkmate +Platforms: iOS, macOS +Related setting: `ITSAppUsesNonExemptEncryption = YES` + +## Purpose + +This note is a practical drafting aid for App Store Connect export compliance and related distribution declarations. It summarizes the app's current encryption-related behavior based on the codebase. It is not legal advice and should be reviewed by the publisher before submission. + +## Recommended App Store Connect Position + +- The app should be treated as using encryption beyond a pure "Apple OS only" transport case. +- The safer declaration path is: + - App uses standard encryption algorithms. + - `ITSAppUsesNonExemptEncryption` remains `YES`. +- If the app is distributed in France, the publisher should assume the France-specific encryption documentation path applies unless counsel or a qualified compliance reviewer confirms otherwise. + +## Implementation Basis + +The current codebase uses encryption and cryptographic functions in these areas: + +- Device identity generation and signing: + - [`lib/runtime/device_identity_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/device_identity_store.dart) + - Uses `Ed25519` key generation and signing. + - Uses `SHA-256` to derive a stable device identifier from the public key. +- Secure transport: + - Gateway and relay flows use `https` / `wss` / TLS-enabled endpoints where configured. + - Representative files: + - [`lib/runtime/gateway_runtime.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/gateway_runtime.dart) + - [`lib/runtime/runtime_bootstrap.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/runtime_bootstrap.dart) + - [`lib/web/web_relay_gateway_client.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/web/web_relay_gateway_client.dart) +- Secure storage: + - Secrets such as tokens and passwords are persisted via platform secure storage abstractions rather than plain preferences. + - Representative files: + - [`lib/runtime/secure_config_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/secure_config_store.dart) + - [`lib/runtime/secret_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/secret_store.dart) + +## Chinese Draft + +### 用途说明 + +XWorkmate 是一个 AI 工作台客户端，用于连接用户配置的网关、模型接口和本地/远程协作能力。应用会在用户发起连接、认证或协作请求时使用加密相关能力。 + +### 加密功能说明 + +本应用使用行业标准加密算法和相关安全机制，主要包括： + +- 使用标准安全传输协议与用户配置的服务端通信，例如 HTTPS 和 WSS/TLS。 +- 使用 Ed25519 生成设备身份密钥对，并对认证载荷进行签名，用于设备身份识别与认证流程。 +- 使用 SHA-256 从公开密钥派生稳定设备标识。 +- 使用平台安全存储能力保存令牌、密码和其他敏感凭据。 + +### 不包含的情况 + +本应用当前未实现自研或专有加密算法。当前使用的是标准算法和标准安全传输机制。 + +### 提交时可用简述 + +本应用使用标准加密算法和安全传输协议，包括 HTTPS/WSS(TLS)、Ed25519 数字签名以及 SHA-256 摘要，用于设备身份认证、与用户配置服务的安全通信以及敏感凭据保护。本应用不包含专有或自定义加密算法。 + +## English Draft + +### Product description + +XWorkmate is an AI workspace client that connects to user-configured gateways, model endpoints, and local or remote collaboration services. The app uses cryptographic functionality when the user initiates connection, authentication, or collaboration workflows. + +### Encryption description + +The app uses standard cryptographic algorithms and security mechanisms, including: + +- Standard secure transport protocols for communication with user-configured services, such as HTTPS and WSS/TLS. +- Ed25519 key generation and digital signatures for device identity and authentication payload signing. +- SHA-256 hashing to derive a stable device identifier from the public key. +- Platform secure storage mechanisms to protect tokens, passwords, and other sensitive credentials. + +### Exclusions + +The app does not implement proprietary or custom encryption algorithms. The current implementation relies on standard cryptographic algorithms and standard secure transport mechanisms. + +### Short submission-ready wording + +This app uses standard cryptographic algorithms and secure transport protocols, including HTTPS/WSS (TLS), Ed25519 digital signatures, and SHA-256 hashing, for device identity, authentication, secure communication with user-configured services, and protection of sensitive credentials. The app does not use proprietary or custom encryption algorithms. + +## Files Updated + +- [`ios/Runner/Info.plist`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/ios/Runner/Info.plist) +- [`macos/Runner/Info.plist`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/macos/Runner/Info.plist) + diff --git a/docs/releases/appstore/2026-03-24-appstore-encryption-form-draft.md b/docs/releases/appstore/2026-03-24-appstore-encryption-form-draft.md new file mode 100644 index 00000000..71d79ae2 --- /dev/null +++ b/docs/releases/appstore/2026-03-24-appstore-encryption-form-draft.md @@ -0,0 +1,105 @@ +# App Store Encryption Form Draft + +Date: 2026-03-24 +App: XWorkmate +Use case: App Store Connect "App Encryption Documentation" form drafting aid + +This document is a practical filling guide for the App Store Connect encryption form. It is based on the current codebase behavior and is intended as submission support text, not legal advice. + +## Recommended Selection Summary + +- Encryption algorithm type: + - Select: `代替在 Apple 操作系统中使用或访问加密，或与这些操作同时使用的标准加密算法` + - English meaning: standard cryptographic algorithms used in addition to or alongside Apple operating system encryption +- `ITSAppUsesNonExemptEncryption`: + - Set to: `YES` +- France distribution: + - If France is included in sales regions, select: `是 / Yes` + +## Page 1 + +### Field: App 用途 + +#### Chinese + +XWorkmate 是一款 AI 工作台应用，用于连接用户配置的网关、模型接口和本地或远程协作服务。应用支持任务对话、文件附件、设备身份认证、安全连接和敏感凭据保护，帮助用户在桌面和移动端完成 AI 协作与工作流处理。 + +#### English + +XWorkmate is an AI workspace application that connects to user-configured gateways, model endpoints, and local or remote collaboration services. The app supports task conversations, file attachments, device identity authentication, secure connections, and protection of sensitive credentials for AI collaboration and workflow execution across desktop and mobile devices. + +### Field: App 用途精简版 + +#### Chinese + +XWorkmate 是一款 AI 工作台应用，用于连接用户配置的网关、模型接口及本地或远程协作服务，提供任务对话、文件附件、安全连接、设备认证和凭据保护能力。 + +#### English + +XWorkmate is an AI workspace application that connects to user-configured gateways, model endpoints, and local or remote collaboration services, providing task conversations, file attachments, secure connectivity, device authentication, and credential protection. + +## Page 2 + +### Field: 加密功能说明 + +#### Chinese + +本应用使用标准加密算法和安全机制，包括 HTTPS/WSS(TLS) 安全传输、Ed25519 设备身份密钥生成与数字签名，以及 SHA-256 摘要计算。上述能力用于设备身份认证、与用户配置服务的安全通信和敏感凭据保护。 + +#### English + +This app uses standard cryptographic algorithms and security mechanisms, including HTTPS/WSS (TLS) secure transport, Ed25519 device identity key generation and digital signatures, and SHA-256 hashing. These capabilities are used for device identity authentication, secure communication with user-configured services, and protection of sensitive credentials. + +### Field: 是否使用专有或自定义加密算法 + +#### Chinese + +否。本应用不实现专有或自定义加密算法，仅使用标准加密算法和标准安全传输机制。 + +#### English + +No. This app does not implement proprietary or custom encryption algorithms. It uses only standard cryptographic algorithms and standard secure transport mechanisms. + +### Field: 是否只依赖 Apple 操作系统自带加密 + +#### Chinese + +否。除 Apple 操作系统提供的安全传输能力外，本应用还使用标准密码学能力，例如 Ed25519 数字签名和 SHA-256 摘要。 + +#### English + +No. In addition to Apple operating system transport security, the app also uses standard cryptographic functionality such as Ed25519 digital signatures and SHA-256 hashing. + +## Page 3 + +### Field: 提交说明 / 附加说明 + +#### Chinese + +本应用的加密用途主要限于设备身份认证、与用户配置服务的安全传输、认证载荷签名以及敏感凭据保护。本应用不提供面向用户的通用加密工具功能，也不包含专有或自定义加密算法。 + +#### English + +The app's use of encryption is limited to device identity authentication, secure transport to user-configured services, authentication payload signing, and protection of sensitive credentials. The app does not provide general-purpose encryption functionality to end users and does not include proprietary or custom cryptographic algorithms. + +### Field: 简短提交版 + +#### Chinese + +本应用使用标准加密算法和安全传输协议，包括 HTTPS/WSS(TLS)、Ed25519 数字签名和 SHA-256 摘要，用于设备身份认证、安全通信和敏感凭据保护，不包含专有或自定义加密算法。 + +#### English + +This app uses standard cryptographic algorithms and secure transport protocols, including HTTPS/WSS (TLS), Ed25519 digital signatures, and SHA-256 hashing, for device identity authentication, secure communication, and protection of sensitive credentials, and does not include proprietary or custom encryption algorithms. + +## Notes + +- If App Store Connect asks whether the app will be distributed in France and France is part of the release territory, select `是 / Yes`. +- If Apple asks for supporting documentation, start from this wording but adapt it to the exact submission screen and any legal or compliance advice you receive. +- Current implementation references: + - [`lib/runtime/device_identity_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/device_identity_store.dart) + - [`lib/runtime/gateway_runtime.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/gateway_runtime.dart) + - [`lib/runtime/runtime_bootstrap.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/runtime_bootstrap.dart) + - [`lib/runtime/secure_config_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/secure_config_store.dart) + - [`lib/runtime/secret_store.dart`](/Users/shenlan/workspaces/cloud-neutral-toolkit/XWorkmate.svc.plus/lib/runtime/secret_store.dart) + diff --git a/ios/Runner/Info.plist b/ios/Runner/Info.plist index 7ce03f89..730f7f12 100644 --- a/ios/Runner/Info.plist +++ b/ios/Runner/Info.plist @@ -24,6 +24,8 @@ ???? CFBundleVersion $(FLUTTER_BUILD_NUMBER) + ITSAppUsesNonExemptEncryption + LSRequiresIPhoneOS NSLocalNetworkUsageDescription diff --git a/macos/Runner/Info.plist b/macos/Runner/Info.plist index 38a35d5e..adf0718a 100644 --- a/macos/Runner/Info.plist +++ b/macos/Runner/Info.plist @@ -20,6 +20,8 @@ $(FLUTTER_BUILD_NAME) CFBundleVersion $(FLUTTER_BUILD_NUMBER) + ITSAppUsesNonExemptEncryption + LSMinimumSystemVersion $(MACOSX_DEPLOYMENT_TARGET) LSApplicationCategoryType