App Store Connect rejected the iOS upload with 'Invalid Export
Compliance Code' because ITSAppUsesNonExemptEncryption was <true/>
without an accompanying ITSEncryptionExportComplianceCode. Apply a
TestFlight-only workaround now and document the full production path
that needs to land before any public App Store / Mac App Store release.
Info.plist (ios + macos)
- ITSAppUsesNonExemptEncryption set to <false/> on both platforms to
unblock TestFlight internal-test uploads. This is NOT correct for
public release: Chanora ships non-system crypto (chacha20poly1305 in
chanora_storage, custom Ed25519/P-256/EAX in tsclientlib, bundled
TLS in rustls), so the value MUST be flipped back to <true/> with a
valid ITSEncryptionExportComplianceCode before any public submission.
docs/release/export-compliance.md (new)
- Closed-source mass-market path under EAR §740.17(b)(1) with Note 3
to Category 5, Part 2 of the CCL (reclassifies the app from
ECCN 5D002.c.1 to ECCN 5D992.c).
- BIS annual self-classification report as CSV per Supplement No. 8
to Part 742, with authorization type MMKT; recipients crypt@bis.doc
.gov + enc@nsa.gov; deadline Feb 1 for prior calendar year; no fee,
no pre-approval, file within 30 days of first export.
- Apple App Store Connect questionnaire answers for Chanora, with the
supporting-documentation upload (sent BIS CSV + cover sheet).
- Step-by-step revert plan once Apple issues the UUID, including the
optional CHANORA_IOS_EXPORT_COMPLIANCE_CODE build-variable pattern
(procivis/one-wallet style) to keep the UUID out of git.
- Annual maintenance plus the fallback to CCATS / SNAP-R if Chanora
ever adds non-standard crypto or E2EE DMs.
- References to Apple docs, eCFR §740.17, Supplement No. 8, and real-
world closed-source iOS Info.plist examples (Keybase, Status.im,
Cryptomator) confirming the UUID format and key placement.
Verification
- plutil -lint apps/chanora_flutter/ios/Runner/Info.plist: OK
- plutil -lint apps/chanora_flutter/macos/Runner/Info.plist: OK
Follow-up
- README.md / LICENSE-{APACHE,MIT} / DEC-020 still declare Chanora as
Apache-2.0/MIT dual-licensed. The closed-source export-compliance
doc assumes proprietary distribution; the license decision needs
reconciliation before submission so the BIS CSV and Apple
questionnaire answers match the actual distribution model.
Edison Jwa
f4ffde2752