podreg

Documentation

Overview

Package podreg asks the CocoaPods registry what it knows about the pods a diff touches (Podfile.lock resolves against the trunk registry via the CDN). Neither OSV nor deps.dev has a CocoaPods system, so for the iOS/macOS world this package IS the metadata layer, not a fallback:

• The version listing comes from the same sharded CDN index that `pod install` itself resolves against (all_pods_versions_*.txt), so unlisted detection is registry-verified: an incoming version missing from the index while the pod's other versions ARE listed is what a deleted or moderated (malicious) release looks like. Pods the index does not know at all are never flagged, and the parser marks git/path pins and private-specs-repo pods NonRegistry besides.
• Release ages and the ⏱ cooldown flag, from the trunk API's per-version publish timestamps (native builds only: trunk sends no CORS headers, so the browser build goes without ages here).
• Deprecated pods land in the deprecation lane with the podspec's own replacement ("deprecated on CocoaPods; in favor of X") — `pod trunk deprecate` rewrites every version's podspec, so the incoming version's spec carries the verdict.
• License changes old → new, from the two versions' podspecs.
• The upstream source repository from the podspec's source.git, which the changelog layers turn into verified compare links and release notes.

Requests are small and anonymous: one CDN index GET per shard, one trunk GET per pod (native), and up to two podspec GETs per bumped pod, 8-way concurrent. The browser (wasm) build reads the CDN index directly (it is CORS-open), podspecs through the CORS-open jsDelivr mirror (the CDN redirects those without CORS headers), and skips trunk.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)
• func ShardVersions(name string) ([]string, int, error)

Variables

var CDNURL = "https://cdn.cocoapods.org"

CDNURL is the CocoaPods CDN base (shard index files); tests point it at an httptest server. Its index answers are CORS-open, so the wasm build uses it too.

var Now = time.Now

Now is a var so tests can pin the clock.

var SpecsURL = ""

SpecsURL overrides where podspec.json files are read from. Empty means CDNURL. The CDN 301-redirects /Specs/ paths to jsDelivr *without* CORS headers — browsers refuse to follow that — so the wasm build sets the CORS-open mirror (https://cdn.jsdelivr.net/cocoa) here directly.

var TrunkURL = "https://trunk.cocoapods.org"

TrunkURL is the trunk registry API base; a var so tests can fake it.

var UseTrunk = true

UseTrunk gates the trunk API (publish timestamps). The wasm build disables it: trunk answers without CORS headers.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

func ShardVersions

func ShardVersions(name string) ([]string, int, error)

ShardVersions returns every version the CDN index lists for one pod (the file `pod install` resolves against). Used by the latest-version lookup for `lockvet pkg pod:<name>`; an unknown pod returns an empty slice with status 200.