podreg

Documentation

Overview

Package podreg asks the CocoaPods registry what it knows about the pods a diff touches (Podfile.lock resolves against the trunk registry via the CDN). Neither OSV nor deps.dev has a CocoaPods system, so for the iOS/macOS world this package IS the metadata layer, not a fallback:

• The version listing comes from the same sharded CDN index that `pod install` itself resolves against (all_pods_versions_*.txt), so unlisted detection is registry-verified: an incoming version missing from the index while the pod's other versions ARE listed is what a deleted or moderated (malicious) release looks like. Pods the index does not know at all are never flagged, and the parser marks git/path pins and private-specs-repo pods NonRegistry besides.
• Release ages and the ⏱ cooldown flag, from the trunk API's per-version publish timestamps (native builds only: trunk sends no CORS headers, so the browser build goes without ages here).
• Deprecated pods land in the deprecation lane with the podspec's own replacement ("deprecated on CocoaPods; in favor of X") — `pod trunk deprecate` rewrites every version's podspec, so the incoming version's spec carries the verdict.
• License changes old → new, from the two versions' podspecs.
• The upstream source repository from the podspec's source.git, which the changelog layers turn into verified compare links and release notes.

Requests are small and anonymous: one CDN index GET per shard, one trunk GET per pod (native), and up to two podspec GETs per bumped pod, 8-way concurrent. The browser (wasm) build reads the CDN through its CORS-open jsDelivr mirror and skips trunk.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Variables

var CDNURL = "https://cdn.cocoapods.org"

CDNURL is the CocoaPods CDN base; the wasm build switches it to the CORS-open jsDelivr mirror (https://cdn.jsdelivr.net/cocoa), tests to an httptest server.

var Now = time.Now

Now is a var so tests can pin the clock.

var TrunkURL = "https://trunk.cocoapods.org"

TrunkURL is the trunk registry API base; a var so tests can fake it.

var UseTrunk = true

UseTrunk gates the trunk API (publish timestamps). The wasm build disables it: trunk answers without CORS headers.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)