From 08ece825b43086908a67174b85923b81fdb82d3f Mon Sep 17 00:00:00 2001
From: Bill Booth <bill@erke.io>
Date: Tue, 13 Oct 2026 08:23:14 -0700
Subject: [PATCH] Declare ITSAppUsesNonExemptEncryption and bump build to 3

SnapSafe's AES-256-GCM media encryption is not exempt, so declare it in
the Info.plist instead of answering per build in App Store Connect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Snap-Safe-Info.plist               | 16 +++++++---------
 SnapSafe.xcodeproj/project.pbxproj |  4 ++--
 docs/HOW-TO-RELEASE.md             |  9 ++++-----
 3 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/Snap-Safe-Info.plist b/Snap-Safe-Info.plist
index 8090d45..dc1224d 100644
--- a/Snap-Safe-Info.plist
+++ b/Snap-Safe-Info.plist
@@ -2,14 +2,12 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<!-- Export compliance: SnapSafe uses non-exempt encryption (AES-256-GCM via
-	     CryptoKit is its core feature), but ITSAppUsesNonExemptEncryption is
-	     deliberately NOT set here. Declaring it without a matching
-	     ITSEncryptionExportComplianceCode makes App Store Connect reject the
-	     upload (error 90592), and the app has no approved encryption
-	     documentation/code yet. Leaving the key out makes App Store Connect ask
-	     the export compliance questions per build; answer them truthfully
-	     (uses encryption: yes, standard algorithms). If App Store Connect later
-	     issues a code, add both keys back together. -->
+	<!-- SnapSafe encrypts user media with AES-256-GCM (CryptoKit) as its core
+	     feature, which is NOT exempt encryption, so this must be true.
+	     App Store Connect rejects an upload that declares this without an
+	     ITSEncryptionExportComplianceCode matching the app's approved
+	     encryption documentation (altool error 90592). -->
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<true/>
 </dict>
 </plist>
diff --git a/SnapSafe.xcodeproj/project.pbxproj b/SnapSafe.xcodeproj/project.pbxproj
index 762ba72..9193708 100644
--- a/SnapSafe.xcodeproj/project.pbxproj
+++ b/SnapSafe.xcodeproj/project.pbxproj
@@ -1379,7 +1379,7 @@
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2;
+				CURRENT_PROJECT_VERSION = 3;
 				DEVELOPMENT_ASSET_PATHS = "\"SnapSafe/Preview Content\"";
 				DEVELOPMENT_TEAM = BP75F4S5N3;
 				ENABLE_PREVIEWS = YES;
@@ -1424,7 +1424,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 2;
+				CURRENT_PROJECT_VERSION = 3;
 				DEVELOPMENT_ASSET_PATHS = "\"SnapSafe/Preview Content\"";
 				DEVELOPMENT_TEAM = "";
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 8P3G3HT4J5;
diff --git a/docs/HOW-TO-RELEASE.md b/docs/HOW-TO-RELEASE.md
index 867b53a..3c11d58 100644
--- a/docs/HOW-TO-RELEASE.md
+++ b/docs/HOW-TO-RELEASE.md
@@ -43,11 +43,10 @@ git push origin vX.Y.Z
 ## 5. App Store Connect (manual)
 
 - [ ] Wait for the build to finish processing.
-- [ ] Answer the export compliance questions for the build (it shows "Missing Compliance" until you do).
-      SnapSafe uses non-exempt encryption: answer yes, standard algorithms. `Snap-Safe-Info.plist`
-      deliberately omits `ITSAppUsesNonExemptEncryption`: setting it without an
-      `ITSEncryptionExportComplianceCode` makes the upload fail with error 90592, and the app has no
-      approved encryption documentation code yet. If App Store Connect issues one, add both keys.
+- [ ] Check export compliance for the build. `Snap-Safe-Info.plist` declares
+      `ITSAppUsesNonExemptEncryption = YES` (SnapSafe's AES-256-GCM media encryption is not exempt).
+      App Store Connect rejects the upload with error 90592 unless the plist also carries an
+      `ITSEncryptionExportComplianceCode` matching the app's approved encryption documentation.
 - [ ] Create the new version, enter "What's New" release notes, and select the build.
 - [ ] Update screenshots if the UI changed.
 - [ ] Submit for review; release once approved.