Decoding crash report IPS metadata JSON keys

I've recently started working with IPS files, specifically crash reports. According to the documentation there are a number of metadata keys included in these payloads, however, I have found a number that are present in real ips files from device but are not documented.

Does anyone know what version of iOS these 'new' metadata keys were introduced? How about if they're expected or if I should treat them as optional.

https://developer.apple.com/documentation/xcode/interpreting-the-json-format-of-a-crash-report#IPS-metadata

     {
         "app_name":"ApplicationNameHere",
         "timestamp":"2024-02-15 08:05:05.00 -0600",
         "app_version":"1.6.0",
         "slice_uuid":"6b1f9f4e-3025-364f-9847-914fc1fe14d1",
         "build_version":"800",
         "platform":2,
         "bundleID":"reverse.domainname.bundleidentifier",
         "share_with_app_devs":1,
         "is_first_party":0,
         "bug_type":"309",
         "os_version":"iPhone OS 17.3.1 (21D61)",
         "roots_installed":0,
         "name":"ApplicationNameHere",
         "incident_id":"1CF0B8A1-EB43-46B3-AA9F-CFA8A9259190"
     }

The following keys are not in the documentation: app_name, os_version, slice_uuid, share_with_app_devs, is_first_party, roots_installed

I created this feedback to request the documentation be updated with current state.

FB13631161 - Developer Documentation: Update IPS metadata to reflect latest values found in IPS Metadata JSON

Up vote post of edorphy Down vote post of edorphy
476 views
Posted by
edorphy
Reply
Add a Comment

Replies

I created this feedback to request the documentation be updated with current state.

FB13631161

Thanks.

My general advice on this front is to ignore any properties that aren’t documented.

Regarding the specific ones you called out:

  • app_name and os_version — These seem to be duplicating info provided by the main crash report, so you don’t lose anything by ignoring them.

  • slice_uuid — In this context slice refers to the way that the App Store constructed the app that was deployed to the device. I don’t think that’s particularly useful to you.

  • share_with_app_devs — The meaning of this seems pretty obvious, and not particularly useful to you.

  • is_first_party — Likewise.

  • roots_installed — In Apple parlance a root is a file hierarchy that has been installed on top of the base OS during OS development. I don’t think there’s much to be gained from you looking at this property.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo

  • Thanks @eskimo. In case it wasn't obvious this is related to my other post you replied to for some stuff I'm working on. https://developer.apple.com/forums/thread/746376

    Not useful to me agreed, but would it be useful (or required) to the Console app on Mac to attempt to parse the report into the friendly view? I will try removing keys that are not documented and see if the Console app can represent the 'translated report'. If I find anything that breaks I'll update my feedback.

    —
    edorphy
Add a Comment