ITMS-91065: BoringSSL/openssl_grpc in iOS grpc-core cinterop klib triggers Apple App Store rejection

[arvinthSG]

Describe the bug
When distributing an iOS app that depends on kotlinx-rpc-grpc-core (via Kotlin Multiplatform), the gRPC C Core native static library (libkgrpc.a) is statically linked into the app's framework. Apple's App Store submission rejects the build with:
ITMS-91065: Missing signature — Your app includes xyz, which includes BoringSSL / openssl_grpc, an SDK that was identified as a commonly used third-party SDK. The SDK must include a signature file. Please contact the provider of the SDK.

Versions:

• kotlinx-rpc: 0.11.0-grpc-185 (also reproduced with 0.11.0-grpc-187)
• The iosArm64Cinterop-libkgrpcMain klib (grpc-185) / grpc-core-shim Cinterop-grpcCoreInteropMain klib (grpc-187) embeds ~7MB of gRPC C Core + BoringSSL that gets linked into the final XCFramework

Apple requires the provider of BoringSSL/openssl_grpc to sign the SDK. Please sign the kotlinx-rpc-grpc-core-shim native artifact (or its successor) with an Apple Developer certificate so the openssl_grpc symbols satisfy ITMS-91065.

Reference: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks

To Reproduce
Steps to reproduce the behavior:

1. Kotlin version
2. Gradle version
3. OS (Or at least KMP platform)
4. Minimal reproducer in code
5. Error description
6. And so on

Expected behavior
Apple requires the provider of BoringSSL/openssl_grpc to sign the SDK. Please sign the kotlinx-rpc-grpc-core-shim native artifact (or its successor) with an Apple Developer certificate so the openssl_grpc symbols satisfy ITMS-91065.

Reference: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks

Additional context
Add any other context about the problem here.

[asundaram27]

@Mr3zee additional details that I missed in the issue desc
To Reproduce

1. Kotlin: 2.3.0
2. Gradle: 9.3.0
3. Platforms hit: iosArm64, iosSimulatorArm64
4. Reproducer: any KMP module that depends on kotlinx-rpc-grpc-core, packaged into an XCFramework consumed by an iOS app and submitted to App Store Connect.
5. Submission output: ITMS-91065 rejection on the openssl_grpc symbols.
6. Tested against kotlinx-rpc 0.11.0-grpc-185 (cinterop klib path: iosArm64Cinterop-libkgrpcMain) and 0.11.0-grpc-187 (path renamed to grpc-core-shim Cinterop-grpcCoreInteropMain). Same failure on both.

Proposed fix

Sign the kotlinx-rpc-grpc-core-shim native artifact (or its successor) with an Apple Developer certificate so the embedded openssl_grpc symbols satisfy ITMS-91065 when consumed downstream.

[asundaram27]

@Mr3zee
Bumping this — 10 days in. Quick status from our side:

Impact: This is blocking our iOS KMP app from using kotlinx-rpc-grpc-core. iOS is a required platform for our upcoming deploy, so we're blocked.
Is there a rough timeline or planned approach? Helps us decide whether to wait or invest in an alternative iOS gRPC path.

Thanks 🙏