Upcoming App Store Changes

[Jarutais]

Apple is now showing a warning on App Store Connect about receipt validation changes on Jan 24.
As far as I know, Swifty Store Kit uses the verifyReceipt endpoint so it will not break, but this endpoint has now been deprecated and probably will go out in a few years. How can we move away from that?

[mazhigbee-pb]

I also had this question when logging into the app store this morning. Is anybody able to confirm this and verify the SHA-1 changes will not be an issue?

[GreydeskChirag]

The SHA-1 intermediate certificate for signing App Store receipts will expire soon, and Apple requires apps performing on-device receipt validation to support the SHA-256 algorithm.
I am using SwiftyStoreKit for receipt validation in my app. Can you confirm if the library already supports SHA-256, or do I need to make any changes at the code level to ensure compatibility with the new requirements?

[vivek-mittal]

Question one - on-device verifcation yay or nay?
In this library I see we are using verifyReceipt endpoint here so it may appear we are using remote verification and NOT "on-device" verification. The current notification from the Apple's app store may not apply to us(users of this lib).

Question two - Another deadline approaching?
From the Apple's doc here -

The verifyReceipt endpoint is deprecated. To validate receipts on your server, follow the steps in Validating receipts on the device on your server.

In this repo, I do not see the use of AppTransaction which is what we should be doing for the remote verification since verifyReceipt endpoints are deprecated. This library would require update eventually may be not right away to move away from the verifyReceipt endpoints.

This is my analysis so far, authors or maintainer would be the best people to comment however.

[LBBB]

Has anyone confirmed that this library won't have issues with the SHA-256 requirement?

[tikamsingh]

@LBBB Yes if you are using this lib then it's ok, no need to change any thing because in this lib they are verify receipt in App Store Server, that API is deprecated but still we can use it.

[louiskabo]

Wondering same thing. Anyone have confirmation we will be OK after Jan 24?

[tikamsingh]

@louiskabo Yes if you are using this lib then it's ok, no need to change any thing because in this lib they are verify receipt in App Store Server, that API is deprecated but still we can use it.

[crexon]

I'm not sure at all. I'm migrating to StoreKit 2, because this is deprecated.

@louiskabo Yes if you are using this lib then it's ok, no need to change any thing because in this lib they are verify receipt in App Store Server, that API is deprecated but still we can use it.

[louiskabo]

What has me concerned is:

                let appleValidator = AppleReceiptValidator(service: .production, sharedSecret: "XXXXXXXXX")
                SwiftyStoreKit.verifyReceipt(using: appleValidator) { result in
                    switch result {
                    case .success(let receipt):
                 ...

Which I guess verifies the receipt in the App Store Server per @tikamsingh however, the apple warning "If your app performs on-device receipt validation" which technically, that is doing, no?

I understand it is querying Apple's servers for the receipt, but isn't the message basically saying, if you are asking us for the receipt using SHA1 (which SwiftyStoreKit uses) then you will not get a response?

Sucks having less than 20 days to rewrite such an important function. Swifty was amazing before SK2 came along, seems pretty easy now just a total pain in the a$$.

[tikamsingh]

@louiskabo: Check out this link: https://developer.apple.com/news/?id=smofnyhj. You don’t need to take any action. Remember, Swift's StoreKit doesn't use any algorithm for receipt verification—that’s handled by Apple’s servers. Relax, there's nothing to worry about!

[louiskabo]

@tikamsingh After reading that, I would agree we are OK. Thank you!

[bizz84]

Author and maintainer here. This project has not been maintained for 5+ years (and no further work is planned). I recommend migrating to the new StoreKit APIs or supported 3rd party solutions like RevenueCat.

[louiskabo]

@bizz84 thank you for all the past years of seamless IAP integration that this library provided. It was truly a life saver!