How to find usage of non-public API in Mac Qt App - macos

Question

Our qtwebkit-based application is rejected by apple after submission to mac app store. One of the reasons for rejection is the usage of non-public API. I've managed found six of them in the source code for qtwebkit. But I have no where to find the rest. I searched through the source code of our application and the entire source code of QT.
The six non-public api I found in qtwebkit source is:
CFHTTPCookieStorageSetCookieAcceptPolicy
CFURLCacheCopyResponseForRequest
CFURLResponseGetMIMEType
CFURLResponseCopySuggestedFilename
CFURLCacheSetMemoryCapacity
CFURLCacheSetDiskCapacity
Here is the full list of violations found by apple:
The use of non-public APIs can lead to a poor user experience should
these APIs change in the future, and is therefore not permitted. The
following non-public APIs are included in your application:
NSAccessibilityCreateAXUIElementRef
NSAccessibilityHandleFocusChanged
NSAccessibilityUnregisterUniqueIdForUIElement NSAppKitPropertyCreator
NSCarbonWindowPropertyTag NSMouseMovedNotification
_NSDrawCarbonThemeBezel _NSDrawCarbonThemeListBox _NSPopUpCarbonMenu3 _NXShowKeyAndMain from the framework: '/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit'
AXTextMarkerCreate AXTextMarkerGetBytePtr AXTextMarkerGetLength
AXTextMarkerGetTypeID AXTextMarkerRangeCopyEndMarker
AXTextMarkerRangeCopyStartMarker AXTextMarkerRangeCreate
AXTextMarkerRangeGetTypeID CTLineCreateWithUniCharProvider
CoreDragGetCurrentDrag CoreDragSetImage from the framework:
'/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices'
GetNativeWindowFromWindowRef TSMGetInputSourceProperty from the
framework:
'/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon'
CFReadStreamSignalEvent _CFAppVersionCheckLessThan
_CFBundleSetDefaultLocalization _CFStringGetUserDefaultEncoding from the framework:
'/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation'
CFHTTPCookieStorageCopyCookiesForURL CFHTTPCookieStorageDeleteCookie
CFHTTPCookieStorageGetCookieAcceptPolicy
CFHTTPCookieStorageSetCookieAcceptPolicy
CFHTTPCookieStorageSetCookies CFURLCacheCopyResponseForRequest
CFURLCacheSetDiskCapacity CFURLCacheSetMemoryCapacity
CFURLRequestCreateMutableCopy CFURLResponseCopySuggestedFilename
CFURLResponseGetExpectedContentLength CFURLResponseGetHTTPResponse
CFURLResponseGetMIMEType CFURLResponseGetURL
CFURLResponseSetExpectedContentLength CFURLResponseSetMIMEType
_CFNetworkHTTPConnectionCacheGetLimit _CFNetworkHTTPConnectionCacheSetLimit _CFURLCacheCopyCacheDirectory _CFURLRequestCreateArchiveList _CFURLRequestCreateFromArchiveList _CFURLResponseCreateArchiveList _CFURLResponseCreateFromArchiveList _CFURLResponseGetSSLCertificateContext _LSGetCurrentApplicationASN _LSSetApplicationInformationItem _kLSDisplayNameKey kCFStreamPropertyCONNECTAdditionalHeaders
kCFStreamPropertyCONNECTProxy kCFStreamPropertyCONNECTProxyHost
kCFStreamPropertyCONNECTProxyPort kCFStreamPropertyCONNECTResponse
kCFURLResponseExpectedContentLengthUnknown from the framework:
'/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices'
NSPopAutoreleasePool NSPushAutoreleasePool from the framework:
'/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation'
CARenderCGDestroy CARenderCGNew CARenderCGRender
CARenderNotificationAddObserver CARenderNotificationRemoveObserver
CARenderServerGetPort CARenderServerStart CARenderUpdateAddContext
CARenderUpdateAddRect CARenderUpdateBegin CARenderUpdateFinish
kCAContextPortNumber from the framework:
'/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore'
If you have defined methods in your source code with the same names as
the above-mentioned APIs, we suggest altering your method names so
that they no longer collide with Apple's private APIs to avoid your
application being flagged in future submissions.
Additionally, one or more of the above-mentioned APIs may reside in a
library included with your application. If you do not have access to
the library's source, you may be able to search the compiled binary
using "strings" or "otool" command line tools. The "strings" tool can
output a list of the methods that the library calls and "otool -ov"
will output the Objective-C class structures and their defined
methods. These techniques can help you narrow down where the
problematic code resides.

Answer 1

I've finally traced down to the location where these so-called privatate apis are called. They are called from inside webkit. webkit uses a webkit system interface library which is directly supplied from apple in the format of compiled static library+header file. More specifically, they are the four files located under the path src\3rdparty\webkit\WebKitLibraries:
libWebKitSystemInterfaceLeopard.a
libWebKitSystemInterfaceLion.a
libWebKitSystemInterfaceMountainLion.a
libWebKitSystemInterfaceSnowLeopard.a
I always wondered if it's really a private api, who else would know how to call it without any documentation? Now it's turned out to be apple itself. Since neither nokia or digia has the source code to these libraries, there is probably nothing they can do about it.
Now isn't it ironic that any qtwebkit-based apps will be rejected by apple due to private api access from libraries created?
Please correct me if I am wrong or miss anything. I really hope I am wrong.