SmartStore 13.2.1 XCFramework appears unsigned while repackaging FMDB

[mstohr1975]

Summary

The official Salesforce Mobile SDK iOS SPM distribution for version 13.2.1
provides SmartStore as a prebuilt binary XCFramework.

The distributed SmartStore XCFramework appears to be unsigned, while the
binary contains repackaged FMDB classes such as FMDatabase,
FMDatabasePool, FMDatabaseQueue, and FMResultSet.

Apple explicitly lists FMDB as an SDK requiring a privacy manifest and, when
used as a binary dependency, an SDK signature. Apple's documentation also
states that this requirement applies to SDKs that repackage a listed SDK.

Reference:
https://developer.apple.com/support/third-party-SDK-requirements/

Environment

• Salesforce Mobile SDK for iOS: 13.2.1
• Distribution:
  https://github.com/forcedotcom/SalesforceMobileSDK-iOS-SPM
• Artifact: SmartStore.xcframework.zip
• Integration: Swift Package Manager
• Xcode: 26.6
• Swift: 6.3.3
• SQLCipher: 4.10.0

Verification

The official 13.2.1 SmartStore archive was inspected without modifying or
re-signing it.

Signature verification of the device framework fails:

codesign --verify --strict --verbose=4 \
  SmartStore.xcframework/ios-arm64/SmartStore.framework

[mstohr1975]

Expected Result

The official prebuilt SmartStore.xcframework should provide a stable
Salesforce vendor signature that satisfies Apple's third-party SDK signature
requirements for TestFlight and App Store distribution.

If Salesforce does not intend to sign this artifact, the Mobile SDK
documentation should clearly describe an officially supported distribution
path, such as a source-based integration, that avoids the binary-signature
requirement.

Questions

1. Is the unsigned SmartStore.xcframework from Mobile SDK 13.2.1 officially
   supported for TestFlight and App Store distribution?

2. Can Salesforce provide a vendor-signed SmartStore XCFramework with a stable
   signing identity?

3. Has this issue already been addressed in another supported Mobile SDK
   release or artifact?

4. Is there an officially supported source-based SmartStore integration that
   avoids Apple's binary SDK signature requirement?

5. Has Salesforce confirmed with Apple that the current unsigned artifact is
   accepted despite containing repackaged FMDB classes?

6. If local re-signing is the recommended workaround, can Salesforce document
   the exact supported procedure and explain how SDK identity continuity is
   maintained across Mobile SDK updates?

Thank you for clarifying the supported and App-Store-compliant distribution
path for SmartStore.