Publish SonarKit.podspec to the CocoaPods Master Repository

Currently SonarKit is published to the Facebook Sonar private repository. In order to get SonarKit.podspec published to the CocoaPods master repo, we first need to take care of fixing and publishing some of its direct dependencies:

• Yoga podspec should be updated to include the DEFINES_MODULE directive. We should be opening an issue in Yoga, a PR and ask the owners of the repository to pod trunk the new podspec. There are other workarounds to avoid modifying the podspec, like setting the :modular_headers directive for Yoga in a Podfile, but that would prevent us from being able to lint and push the SonarKit.podspec to CocoaPods.

• YogaKit has a dependency on the patch version of Yoga. We should tell the repository owners to avoid that, otherwise, if Yoga gets updated to 1.9 due to new API , or changes on its podspec, YogaKit won’t be able to pull a new minor version due to directly defining a dependency on a patch version. Long story short, YogaKit should depend on Yoga ~>1.8 instead of Yoga ~>1.8.1 or CocoaPods will treat 1.9 for example as a major version change, when it is not. Let’s make sure they publish the new podspec to the cocoapods master repo.

• Sonar. Well, unfortunately for Sonar.podspec, there is already a published pod with the same name. There is no much we can do here, unless we change Sonar podspec name to something else so we can publish it, or build a subspec in SonarKit where we define Sonar, or make Sonar subspec part of our Core subspec. If we don’t see other iOS developers consuming Sonar.podspec as a direct dependency, and its always through SonarKit, maybe a subspec would be the best option here.

• RSocket.podspec needs to be published to the cocoapods master repo. It doesn’t exist yet, so that is good for us. We need to create an issue and a PR in RSocket repository

• Peertalk needs to also be updated. I already opened an issue #48 in PeerTalk asking them to generate a new tag using the latest commit since their podspec is pointing to an old commit that doesn’t include the latest codebase.

• Folly. The latest pushed Folly.podspec seems so much different from the one SonarKit is depending. The one SonarKit depends on has more dependencies, more compiler flags, etc… We should get with the Folly owners and decide if our Folly.podspec should be pushed to cocoapods master

[KrauseFx]

I was thinking about this more, I’d recommend grabbing the official name as soon as possible, and putting a placeholder there for now, until this issue is fully completed.

Right now, a malicious actor could easily grab the flipper name on CocoaPods, and cause damage rather easily by abusing the prepare_command spec, or other attack vectors.

[israelidanny]

Is there an ETA for the Podpsec getting published on Cocoa Pods? And what’s an easy way to use Flipper meanwhile?