From 5ead7a8164f57a7872fb99aaf0e7bcf2c05ebe68 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 31 Oct 2026 17:23:19 +0100
Subject: [PATCH] chore: declare the end-to-end encryption for app store export
 compliance #58

---
 app.config.js                               |  8 ++++----
 src/lib/__tests__/export-compliance.test.ts | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 src/lib/__tests__/export-compliance.test.ts

diff --git a/app.config.js b/app.config.js
index 562fda1a..08714d55 100644
--- a/app.config.js
+++ b/app.config.js
@@ -58,10 +58,10 @@ module.exports = {
       bundleIdentifier: 'org.bulwarkmail.mobile',
       buildNumber: IOS_BUILD_NUMBER,
       config: {
-        // The app only speaks HTTPS/TLS and uses platform crypto, which is
-        // exempt. Declaring it here skips the manual export-compliance
-        // questionnaire that otherwise blocks every TestFlight build.
-        usesNonExemptEncryption: false,
+        // PGP and S/MIME (#58) add end-to-end encryption beyond HTTPS/TLS,
+        // so the app declares non-exempt encryption; App Store Connect asks
+        // for the export compliance documentation on upload.
+        usesNonExemptEncryption: true,
       },
     },
     android: {
diff --git a/src/lib/__tests__/export-compliance.test.ts b/src/lib/__tests__/export-compliance.test.ts
new file mode 100644
index 00000000..d50a0134
--- /dev/null
+++ b/src/lib/__tests__/export-compliance.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+
+// With PGP and S/MIME in the app (#58) the encryption is no longer only
+// HTTPS/TLS, so the App Store export compliance answer must say so.
+
+describe('export compliance', () => {
+  it('declares non-exempt encryption for iOS', () => {
+    const src = fs.readFileSync(path.resolve(__dirname, '../../../app.config.js'), 'utf8');
+    expect(src).toMatch(/usesNonExemptEncryption: true/);
+    expect(src).not.toMatch(/usesNonExemptEncryption: false/);
+  });
+});