From Privacy Disclosure to Supply-Chain Assurance: A Layered Analytical Model for Open Swift Packages Targeting iOS

Abstract

Context. Apple privacy manifests move part of the disclosure burden for data access and required-reason APIs from the application level into a composable package artifact. Yet the existence of a declaration file can be interpreted more broadly than its evidentiary function warrants: as evidence of actual behavior, security, or low software supply-chain risk. Objective. This study develops an analytical framework that separates these inferential layers and specifies a reproducible design for future research on open Swift packages targeting iOS. Materials and methods. We conducted a directed critical synthesis of 28 verified open sources: six Apple documents, four open repository and OpenSSF infrastructure sources, two assurance frameworks, ten software supply-chain studies, and six studies of privacy labels. The unit of analysis was a claim linking an observable artifact to a permissible inference. Results. The synthesis yields a four-layer adoption model: file presence, product integration, syntactic validity, and conservative code-to-declaration consistency. It also establishes an evidence boundary between disclosure, supply-chain exposure, and observed outcomes. A repository-mining protocol is specified in which these constructs remain separate and may be compared only through explicitly observational associations. Contribution. The study clarifies the scope of privacy manifests as transparency artifacts and operationalizes a future open-data investigation without converting proxies into security outcomes. The principal limitation is that repository extraction has not yet been executed and the source corpus is analytical rather than systematic; no adoption prevalence, regression estimate, or causal effect is reported.