1
00:00:00,001 --> 00:00:04,800
So it's been a little while since we've actually done an episode, right Sven?
2
00:00:04,800 --> 00:00:06,400
It's been a little bit of a...
3
00:00:06,400 --> 00:00:07,400
It's been a minute.
4
00:00:07,400 --> 00:00:09,080
A little bit of a break in the system.
5
00:00:09,080 --> 00:00:15,160
I've been away on holiday, just got back, and we've been fairly busy with other things.
6
00:00:15,160 --> 00:00:16,320
So we're on a...
7
00:00:16,320 --> 00:00:20,560
This is the end of a little bit of a hiatus on the podcast.
8
00:00:20,560 --> 00:00:21,280
Yeah.
9
00:00:21,280 --> 00:00:28,200
So, and as you maybe have heard then, we have a new voice on the podcast this episode.
10
00:00:28,200 --> 00:00:38,480
We have a guest on this week's episode, Orta Thurrox, who I'm sure needs no introduction,
11
00:00:38,480 --> 00:00:41,320
but just in case, would you like to introduce yourself, Orta?
12
00:00:41,320 --> 00:00:48,200
Yeah, I guess I was sort of there at the beginning of the iOS community, I guess, and sort of
13
00:00:48,200 --> 00:00:52,400
built out a lot of the foundational ideas and sort of hung out with a lot of people
14
00:00:52,400 --> 00:00:56,040
trying to do odd things and share code of each other.
15
00:00:56,040 --> 00:01:02,520
So people might know me from CocoaPods or from Danger, at least in this space.
16
00:01:02,520 --> 00:01:05,960
I guess we were some of the first people to experiment trying to build production apps
17
00:01:05,960 --> 00:01:06,960
with Swift.
18
00:01:06,960 --> 00:01:09,720
So like Swift version one and two.
19
00:01:09,720 --> 00:01:12,480
And we did some pretty intense write-ups on how to do that.
20
00:01:12,480 --> 00:01:17,400
And I helped make it possible for getting Swift to run in CocoaPods at all, which was
21
00:01:17,400 --> 00:01:19,200
quite a lot of work.
22
00:01:19,200 --> 00:01:22,640
I mean, I think it really was a...
23
00:01:22,640 --> 00:01:26,960
It was a time when lots of problems needed solving, right?
24
00:01:26,960 --> 00:01:29,880
It was like a period where lots of...
25
00:01:29,880 --> 00:01:35,480
When Apple were not providing many solutions for community style problems.
26
00:01:35,480 --> 00:01:40,200
And so it usually required someone to step up and to do the work themselves because they
27
00:01:40,200 --> 00:01:41,200
were still like a very...
28
00:01:41,200 --> 00:01:44,080
They were still trying to figure out the iOS SDK, I think, in my head.
29
00:01:44,080 --> 00:01:50,560
Whereas we were like, "I just want to share grabbing an image and putting it onto a flat
30
00:01:50,560 --> 00:01:51,560
surface somewhere."
31
00:01:51,560 --> 00:01:52,560
Right.
32
00:01:52,560 --> 00:01:53,560
Yeah.
33
00:01:53,560 --> 00:01:54,560
Well, it was...
34
00:01:54,560 --> 00:02:04,000
I mean, CocoaPods, especially, but also Danger, have both been incredibly influential tools
35
00:02:04,000 --> 00:02:10,520
in iOS development and macOS development over the years.
36
00:02:10,520 --> 00:02:15,840
And we are going to talk about those more, but I'd also be interested in a quick update
37
00:02:15,840 --> 00:02:17,320
on what you're up to these days.
38
00:02:17,320 --> 00:02:20,040
I know I'm going to preempt you slightly.
39
00:02:20,040 --> 00:02:22,200
I know what it is because I'm a big fan.
40
00:02:22,200 --> 00:02:31,680
I play Puzmo regularly, especially I like the crossword, which is the first crossword
41
00:02:31,680 --> 00:02:34,520
that I've ever stuck with.
42
00:02:34,520 --> 00:02:40,800
I've tried many crossword providers over the years and never really stuck with one.
43
00:02:40,800 --> 00:02:45,480
And Puzmo has grabbed me, which is great.
44
00:02:45,480 --> 00:02:55,040
I guess a TL;DR of my career is that I ran a mobile team doing iOS native, and we concluded
45
00:02:55,040 --> 00:03:00,640
that the set of abstractions that were provided by Apple were not probably optimal for the
46
00:03:00,640 --> 00:03:04,280
type of clients we were making.
47
00:03:04,280 --> 00:03:11,880
So we switched to React Native, and that just led me down into this JavaScript massive ecosystem,
48
00:03:11,880 --> 00:03:12,880
semi hellhole.
49
00:03:12,880 --> 00:03:17,760
And just before you carry on, just give people a quick rundown of what Puzmo is.
50
00:03:17,760 --> 00:03:18,760
Sure.
51
00:03:18,760 --> 00:03:19,760
Oh yeah.
52
00:03:19,760 --> 00:03:20,760
Puzmo itself.
53
00:03:20,760 --> 00:03:21,760
Yeah, I was going to get to that.
54
00:03:21,760 --> 00:03:22,760
Sorry.
55
00:03:22,760 --> 00:03:23,760
Yeah.
56
00:03:23,760 --> 00:03:26,880
But Puzmo itself is like a daily games platform.
57
00:03:26,880 --> 00:03:30,160
For a lot of people, that would just be, you'll have seen something like the New York Times
58
00:03:30,160 --> 00:03:33,180
games with crosswords and Wordle and things like that.
59
00:03:33,180 --> 00:03:35,640
We do that same type of thing.
60
00:03:35,640 --> 00:03:38,720
We're probably the biggest competitor to them at this point.
61
00:03:38,720 --> 00:03:43,800
And we have like a native app and lots of cool, interesting games that we build ourselves.
62
00:03:43,800 --> 00:03:44,800
That's great.
63
00:03:44,800 --> 00:03:46,520
Are you aware of Puzmo, Sven?
64
00:03:46,520 --> 00:03:47,520
I am.
65
00:03:47,520 --> 00:03:48,520
I followed it.
66
00:03:48,520 --> 00:03:52,600
I saw it come out, but I'm not really a puzzle gamer.
67
00:03:52,600 --> 00:03:56,200
This episode is fantastic because I don't have imposter syndrome.
68
00:03:56,200 --> 00:04:02,240
I'm straight up imposter because the last time I've actually used CocoaPods in earnest
69
00:04:02,240 --> 00:04:04,520
is more than 10 years ago.
70
00:04:04,520 --> 00:04:06,360
And even then it was tangential.
71
00:04:06,360 --> 00:04:07,360
I didn't set it up.
72
00:04:07,360 --> 00:04:10,320
I just kind of used it as part of the team.
73
00:04:10,320 --> 00:04:19,520
So I'm out of my depth today, but I'm going to have fun listening in mostly, I guess.
74
00:04:19,520 --> 00:04:23,400
That sounds really cool because it gives you a good insight that I think more and more
75
00:04:23,400 --> 00:04:29,400
people will have, which is that this is a tool that existed that has been around, but
76
00:04:29,400 --> 00:04:31,240
you don't necessarily need it.
77
00:04:31,240 --> 00:04:34,840
And so they don't actually know why it's a big deal that it's being deprecated and all
78
00:04:34,840 --> 00:04:35,840
these sort of things.
79
00:04:35,840 --> 00:04:36,840
Yeah.
80
00:04:36,840 --> 00:04:44,000
Well, I guess it's also testament to the tool in that I, at the time, I didn't have to set
81
00:04:44,000 --> 00:04:45,000
it up.
82
00:04:45,000 --> 00:04:47,760
I knew the basic commands I needed to run to update things.
83
00:04:47,760 --> 00:04:49,560
And then it wasn't really in the way.
84
00:04:49,560 --> 00:04:51,160
It was just there and did its job.
85
00:04:51,160 --> 00:04:53,880
That's actually the best thing you can say about the tool, right?
86
00:04:53,880 --> 00:04:54,880
Yeah.
87
00:04:54,880 --> 00:04:55,880
I mean, it is.
88
00:04:55,880 --> 00:05:00,240
At one point it was absolutely ubiquitous.
89
00:05:00,240 --> 00:05:06,640
But you're right that over the years since Swift Package Manager became a viable tool
90
00:05:06,640 --> 00:05:15,480
for building iOS and Mac apps, it has certainly become less ubiquitous.
91
00:05:15,480 --> 00:05:21,640
But it is a big deal that we're going to talk about today with it going into kind of maintenance
92
00:05:21,640 --> 00:05:25,840
mode because these tools live forever.
93
00:05:25,840 --> 00:05:31,960
Because unless there is a really good reason to switch, the things that are working tend
94
00:05:31,960 --> 00:05:40,320
to stay working and tend to just persist by default, don't they?
95
00:05:40,320 --> 00:05:41,920
It's like a build is fine.
96
00:05:41,920 --> 00:05:45,560
You know, if it continues to work, it's just a dependency.
97
00:05:45,560 --> 00:05:48,640
And for some people, they might even put their dependencies in their repo.
98
00:05:48,640 --> 00:05:54,200
And so you might not even ever use CocoaPods to actually do the updates anyway.
99
00:05:54,200 --> 00:06:00,440
That reminds me of a big, well not controversy, but a big talking point when CocoaPods was
100
00:06:00,440 --> 00:06:04,640
at its height was, do you commit your dependency sources or not?
101
00:06:04,640 --> 00:06:09,480
And at the time I was very much on the side of you should commit every source file that
102
00:06:09,480 --> 00:06:14,240
you need to build your application because there's no guarantee that it will be there
103
00:06:14,240 --> 00:06:17,560
in the future if you need to rebuild.
104
00:06:17,560 --> 00:06:22,800
But actually with Swift Package Manager, making that probably a little bit more difficult
105
00:06:22,800 --> 00:06:26,760
than it was with CocoaPods.
106
00:06:26,760 --> 00:06:32,240
I certainly don't do that anymore and I don't think many people do, but that problem still
107
00:06:32,240 --> 00:06:33,240
exists.
108
00:06:33,240 --> 00:06:38,120
Like you may have a project that you can never build again because that dependency source
109
00:06:38,120 --> 00:06:39,120
may have gone away.
110
00:06:39,120 --> 00:06:44,720
Yeah, especially if it's distributed like CocoaPods and SPMR.
111
00:06:44,720 --> 00:06:52,000
There's no VC backed company or megacorp holding all your source code in a single place because
112
00:06:52,000 --> 00:06:53,800
it allows for many.
113
00:06:53,800 --> 00:06:56,920
Unless you count GitHub as that VC backed megacorp.
114
00:06:56,920 --> 00:07:05,560
Does SPM only support Git repos now?
115
00:07:05,560 --> 00:07:13,800
Swift Package Manager, well no, Swift Package Manager has full support for the registry
116
00:07:13,800 --> 00:07:18,200
specification that was defined and that works.
117
00:07:18,200 --> 00:07:22,120
And you can, there are multiple registries out there.
118
00:07:22,120 --> 00:07:25,800
You can do your own private registries if you want with various companies.
119
00:07:25,800 --> 00:07:30,800
JFrog, I think has one and I think Amazon has one as well.
120
00:07:30,800 --> 00:07:41,920
And there's also a mirror of all the packages in the Swift Package Index that's run by the
121
00:07:41,920 --> 00:07:53,560
Tuist folks who they run a registry that vends any package that's in the Swift Package Index.
122
00:07:53,560 --> 00:07:58,480
Well, also you don't even need a registry, just a different Git URL would work.
123
00:07:58,480 --> 00:08:02,160
So you're not tied to the GitHub Git based URLs.
124
00:08:02,160 --> 00:08:03,760
It could be GitLab or anything else.
125
00:08:03,760 --> 00:08:09,840
So in that sense, it's, you know, even without a registry, it is fully distributed.
126
00:08:09,840 --> 00:08:15,400
But we've kind of skirted around the main issue and I did mention it, but let's get
127
00:08:15,400 --> 00:08:20,400
to the meat of what we're about to talk about here, which is that CocoaPods, the CocoaPods
128
00:08:20,400 --> 00:08:28,160
team and Orta specifically have been posting for the last year and a bit on the CocoaPods
129
00:08:28,160 --> 00:08:35,240
blog about the fact that CocoaPods is going to enter maintenance mode shortly.
130
00:08:35,240 --> 00:08:39,720
So do you want to give us a quick rundown of what that means and what people need to
131
00:08:39,720 --> 00:08:42,600
be thinking about if they're still using it?
132
00:08:42,600 --> 00:08:43,600
Yeah.
133
00:08:43,600 --> 00:08:50,800
So I guess one way to think about it is, you know, CocoaPods, I think this was the first
134
00:08:50,800 --> 00:08:55,760
year where we didn't release an update to CocoaPods when there was an update to Xcode.
135
00:08:55,760 --> 00:08:56,760
Right.
136
00:08:56,760 --> 00:09:01,640
I don't think anything broke, which is actually kind of a really good news for the idea of
137
00:09:01,640 --> 00:09:07,920
sort of moving it towards a much more like it through maintenance mode version of the
138
00:09:07,920 --> 00:09:09,240
project.
139
00:09:09,240 --> 00:09:16,080
But generally speaking, you know, CocoaPods is a dependency manager and those dependencies,
140
00:09:16,080 --> 00:09:20,620
they are distributed in a similar way that you have the Swift package index.
141
00:09:20,620 --> 00:09:26,280
We have something called the CocoaPods trunk and the CocoaPods trunk is sort of like an
142
00:09:26,280 --> 00:09:31,600
authentication process that gives us the ability to say, hey, this person owns this exact name.
143
00:09:31,600 --> 00:09:36,360
Because CocoaPods was like before the era of let's just rely entirely on GitHub for
144
00:09:36,360 --> 00:09:38,560
all our dependency managers.
145
00:09:38,560 --> 00:09:42,880
I think it still has support for subversion and things like that inside it.
146
00:09:42,880 --> 00:09:43,880
Really, right?
147
00:09:43,880 --> 00:09:44,880
Yeah.
148
00:09:44,880 --> 00:09:50,640
And it's got like, we made it so that there was a single namespace basically.
149
00:09:50,640 --> 00:09:57,760
So you know, there would be the pod a la stack view, so auto stack view.
150
00:09:57,760 --> 00:10:02,080
And that wouldn't be like, you have to go find this repo with that one.
151
00:10:02,080 --> 00:10:04,720
It would be straight up like you have to go to a central index.
152
00:10:04,720 --> 00:10:10,560
It will tell you when you from that index where you can go and find the Git repo.
153
00:10:10,560 --> 00:10:18,720
And so that central piece of technology is sort of both the biggest, the bit that makes
154
00:10:18,720 --> 00:10:25,200
a lot of the system easy to use, but at the same time, it's the bit of the system that
155
00:10:25,200 --> 00:10:31,040
has the highest attack surface for people that want to sort of do security research
156
00:10:31,040 --> 00:10:34,120
and do like black hat hacking.
157
00:10:34,120 --> 00:10:37,640
Because there's a huge amount of work going on in that space at the moment to try and
158
00:10:37,640 --> 00:10:43,400
find out what are the holes in the sort of dependency tree for people.
159
00:10:43,400 --> 00:10:50,200
Because if you can get some code, sneakily shipped into an iOS app that's used by millions
160
00:10:50,200 --> 00:10:54,800
of people, you could get that there's a lot of value in that in terms of like selling
161
00:10:54,800 --> 00:10:56,560
that exploit to people.
162
00:10:56,560 --> 00:10:57,560
Yes.
163
00:10:57,560 --> 00:11:01,000
And this has happened in many ways over the years.
164
00:11:01,000 --> 00:11:03,640
Not not has it ever happened through CocoaPods?
165
00:11:03,640 --> 00:11:07,560
I know it's happened through compromised versions of Xcode.
166
00:11:07,560 --> 00:11:11,680
Yeah, compromised versions of Xcode is what killed Xcode plugins back in the day.
167
00:11:11,680 --> 00:11:18,080
Yeah, I would say no one has ever done it through CocoaPods, especially not at scale,
168
00:11:18,080 --> 00:11:19,080
right?
169
00:11:19,080 --> 00:11:21,400
You can't build up a CocoaPod pretending to be another one.
170
00:11:21,400 --> 00:11:25,600
So like Alamo Fire is pretty famous.
171
00:11:25,600 --> 00:11:31,520
And so you could make Alamo Fire where the I is an L and you can persuade people that
172
00:11:31,520 --> 00:11:33,240
like that is the real one.
173
00:11:33,240 --> 00:11:34,840
But that's not like a scale attack.
174
00:11:34,840 --> 00:11:40,480
But the most we've ever had has been like security researchers after finding an effective
175
00:11:40,480 --> 00:11:47,520
bug going in and making like post install scripts on existing pods to be like, so they
176
00:11:47,520 --> 00:11:54,760
can count how many people are vulnerable to the exploit they just found, which is which
177
00:11:54,760 --> 00:12:00,120
was very worrying the two times that this happened and is now impossible to happen.
178
00:12:00,120 --> 00:12:04,880
But right, those are the only things that have really ever happened with CocoaPods at
179
00:12:04,880 --> 00:12:05,880
scale.
180
00:12:05,880 --> 00:12:12,280
And so would you say that that is was the primary driver to making the transition into
181
00:12:12,280 --> 00:12:18,640
maintenance mode that as the project became less, I'm putting words in your mouth here,
182
00:12:18,640 --> 00:12:25,040
as the project became less used, and therefore less maintained and less updated, that there
183
00:12:25,040 --> 00:12:26,880
were less eyes on it?
184
00:12:26,880 --> 00:12:28,760
And is that what drove the decision?
185
00:12:28,760 --> 00:12:33,640
Yeah, in part, like I'm a bit tired of dealing with the security researchers.
186
00:12:33,640 --> 00:12:41,280
I got one yesterday, for example, there was like a real I'd say it's a real it's a real
187
00:12:41,280 --> 00:12:42,280
possible vulnerability.
188
00:12:42,280 --> 00:12:47,640
And there's lots of people that are very financially incentivized to find these holes.
189
00:12:47,640 --> 00:12:48,640
Yes.
190
00:12:48,640 --> 00:12:54,840
And so, you know, we have to come out, I have to go through the full security like process.
191
00:12:54,840 --> 00:12:57,320
And that usually takes a day or two of my of my time.
192
00:12:57,320 --> 00:12:58,680
And then we do a fix as well.
193
00:12:58,680 --> 00:13:04,200
And then if it's something that I would consider like, very bad, then I would do a write up
194
00:13:04,200 --> 00:13:05,680
and do all the work.
195
00:13:05,680 --> 00:13:08,880
And we had a few of those in the last two years.
196
00:13:08,880 --> 00:13:14,120
And they just have not feeling great about all of it.
197
00:13:14,120 --> 00:13:19,200
And then one of the other engineers that contributes a lot was like, maybe an answer is not to
198
00:13:19,200 --> 00:13:21,280
shut down, but to go read only.
199
00:13:21,280 --> 00:13:22,280
Right.
200
00:13:22,280 --> 00:13:27,680
Which I thought was like a really elegant solution to the problem of like, we don't
201
00:13:27,680 --> 00:13:33,960
want to necessarily even have the access to be able to say, hey, you are his, you have
202
00:13:33,960 --> 00:13:40,840
access to upload the Facebook SDK, which I'm sure is used massively.
203
00:13:40,840 --> 00:13:44,600
And so if we can get to a point where they are self hosting, because they have their
204
00:13:44,600 --> 00:13:49,120
own incentives to go to Swift Package Manager over the time, then that's probably the right
205
00:13:49,120 --> 00:13:50,120
pattern for us.
206
00:13:50,120 --> 00:13:55,920
And it's a very thankless task to be the person who has to deal with those security problems
207
00:13:55,920 --> 00:13:57,680
and maintenance issues.
208
00:13:57,680 --> 00:14:04,560
And I know that I have been incredibly grateful over the years for all of the work that the
209
00:14:04,560 --> 00:14:06,120
entire team has put in.
210
00:14:06,120 --> 00:14:12,200
And actually, we got a couple of thank yous off, we posted yesterday on social media for
211
00:14:12,200 --> 00:14:13,200
questions and stuff.
212
00:14:13,200 --> 00:14:18,120
And several people said, thank you for all of your work, not just yours, but the whole
213
00:14:18,120 --> 00:14:20,920
team's work over the years.
214
00:14:20,920 --> 00:14:26,160
But actually, I think it is fair to call you out specifically, because you have taken that
215
00:14:26,160 --> 00:14:28,760
responsibility for those security issues going forward.
216
00:14:28,760 --> 00:14:35,240
And I think everybody who's been involved, you know, this project has been a wonderful,
217
00:14:35,240 --> 00:14:41,000
positive influence on the iOS and macOS development community over the years.
218
00:14:41,000 --> 00:14:46,400
And I certainly would love to say, you know, thank you publicly to all of you for that
219
00:14:46,400 --> 00:14:47,400
work.
220
00:14:47,400 --> 00:14:49,120
You know, it's amazing.
221
00:14:49,120 --> 00:14:50,120
Thank you.
222
00:14:50,120 --> 00:14:56,120
It's interesting, because you come from an iOS/macOS background.
223
00:14:56,120 --> 00:15:01,720
And so, and obviously are deeply involved in the Swift Package Manager community.
224
00:15:01,720 --> 00:15:06,560
But like, Cocoapods is getting more downloads now than it ever has by far.
225
00:15:06,560 --> 00:15:10,760
It's like significantly bigger than it previously was.
226
00:15:10,760 --> 00:15:13,160
That was going to be a question I was going to ask later.
227
00:15:13,160 --> 00:15:16,800
But that is fascinating.
228
00:15:16,800 --> 00:15:19,200
Can you quantify that at all?
229
00:15:19,200 --> 00:15:22,000
Yeah, I mean, I did once.
230
00:15:22,000 --> 00:15:29,120
I use a website called Ruby Toolbox to generally get a general sense of where everything is
231
00:15:29,120 --> 00:15:30,920
going in terms of dependency-wise.
232
00:15:30,920 --> 00:15:31,920
So there we go.
233
00:15:31,920 --> 00:15:32,920
It's loading up.
234
00:15:32,920 --> 00:15:39,960
But yeah, and it's still getting, you know, back when we all thought that Cocoapods was
235
00:15:39,960 --> 00:15:46,000
effectively dead, which I guess would have been maybe 2020, it sort of doubled in traffic
236
00:15:46,000 --> 00:15:48,600
since then, for example.
237
00:15:48,600 --> 00:15:57,160
And I put that towards a very simple one, which is that like Flutter and React Native
238
00:15:57,160 --> 00:16:00,560
are very, very big ecosystems.
239
00:16:00,560 --> 00:16:01,560
Yeah.
240
00:16:01,560 --> 00:16:04,320
Well, that's interesting.
241
00:16:04,320 --> 00:16:08,600
You mentioned React Native, because one of the questions we had on social media was from
242
00:16:08,600 --> 00:16:10,960
John Stube.
243
00:16:10,960 --> 00:16:15,440
And his question was, what's the impact on React Native with this news?
244
00:16:15,440 --> 00:16:18,720
Will React Native going to finally switch over to SPM?
245
00:16:18,720 --> 00:16:23,600
And I know you probably can't answer that question, but do you have any opinion on that?
246
00:16:23,600 --> 00:16:26,520
Yeah, I can read the pull requests.
247
00:16:26,520 --> 00:16:31,240
They know to DM me because I helped build the Cocoapods integration that is in React
248
00:16:31,240 --> 00:16:32,240
Native today.
249
00:16:32,240 --> 00:16:33,240
Right, right.
250
00:16:33,240 --> 00:16:38,040
So generally, yes, people are working on it.
251
00:16:38,040 --> 00:16:44,280
And we gave a two year, like, here's our deprecation route.
252
00:16:44,280 --> 00:16:49,280
But at heart, the interesting thing about something like React Native and Flutter are
253
00:16:49,280 --> 00:16:54,120
that you don't necessarily use Cocoapods as your main dependency manager.
254
00:16:54,120 --> 00:16:59,040
You would use like, I don't know what they use in Flutter, but, you know, NPM is the
255
00:16:59,040 --> 00:17:00,760
big one in the React Native world.
256
00:17:00,760 --> 00:17:06,760
And so people aren't actually using the Cocoapods trunk to get these dependencies.
257
00:17:06,760 --> 00:17:10,720
These dependencies are coming in through their node modules.
258
00:17:10,720 --> 00:17:15,240
So like an NPM dependency they've got that includes the Cocoapods pod spec.
259
00:17:15,240 --> 00:17:19,600
And so it's sort of like they're actually vending their own dependencies in a different
260
00:17:19,600 --> 00:17:21,000
dependency manager.
261
00:17:21,000 --> 00:17:26,680
And it may well be that like, when we turn it to be read-only, that it actually doesn't
262
00:17:26,680 --> 00:17:30,640
affect them at all because they're not using Cocoapods to vend their dependencies.
263
00:17:30,640 --> 00:17:33,800
Do you get what I mean?
264
00:17:33,800 --> 00:17:36,160
Let's elaborate on that a little bit.
265
00:17:36,160 --> 00:17:45,360
I am a React Native project user and I have a dependency that's called React Native Navigation,
266
00:17:45,360 --> 00:17:46,360
right?
267
00:17:46,360 --> 00:17:51,160
It's like something that wraps a UI navigation controller and gives you like some infrastructure
268
00:17:51,160 --> 00:17:53,160
for doing that in JavaScript.
269
00:17:53,160 --> 00:17:54,160
Okay.
270
00:17:54,160 --> 00:17:59,960
If I include that dependency in my NPM project, right, which is a separate dependency manager,
271
00:17:59,960 --> 00:18:04,880
it's going to put a file in a folder that's called React Native Navigation.
272
00:18:04,880 --> 00:18:12,460
And the Cocoapods integration for React Native will look inside the NPM folder first.
273
00:18:12,460 --> 00:18:15,320
So you will not go into like a pod file.
274
00:18:15,320 --> 00:18:18,960
In fact, I don't know if by default it even ships with a pod file.
275
00:18:18,960 --> 00:18:21,840
It's sort of one that auto-generate is generated for you.
276
00:18:21,840 --> 00:18:22,840
Interesting.
277
00:18:22,840 --> 00:18:27,680
And so you're not actually asking for the original things from the Cocoapods registry.
278
00:18:27,680 --> 00:18:30,960
You're just using the ones that have come in from your existing dependencies.
279
00:18:30,960 --> 00:18:31,960
That's really interesting.
280
00:18:31,960 --> 00:18:38,000
So eventually the impact on React Native may not be what people are expecting.
281
00:18:38,000 --> 00:18:39,680
I would expect so.
282
00:18:39,680 --> 00:18:42,040
I'm sure there's edge cases because there always will be.
283
00:18:42,040 --> 00:18:44,240
Of course, there's always edge cases.
284
00:18:44,240 --> 00:18:45,240
Yeah.
285
00:18:45,240 --> 00:18:46,240
Yep.
286
00:18:46,240 --> 00:18:49,040
What does Cocoapods actually do in that case for React Native?
287
00:18:49,040 --> 00:18:53,960
Is it sort of just to bootstrap and very rarely update it in case something at the top level
288
00:18:53,960 --> 00:18:57,000
changes or what's the point of all this then?
289
00:18:57,000 --> 00:19:07,320
Well, React Native, the team aren't that interested in building out all of the Xcode level integration
290
00:19:07,320 --> 00:19:08,320
stuff.
291
00:19:08,320 --> 00:19:12,640
So they want to be operating in JavaScript ecosystem and the same with the Flutter.
292
00:19:12,640 --> 00:19:18,480
So when you want a new library, then because it's all Ruby and very dynamic, then it can
293
00:19:18,480 --> 00:19:22,600
just look up the folder file system to see if there's any pod specs and then say, "Hey,
294
00:19:22,600 --> 00:19:25,400
that's one that should be defined in the pod file."
295
00:19:25,400 --> 00:19:26,400
Right.
296
00:19:26,400 --> 00:19:32,280
So it's really a scaffolding tool rather than a dependency manager and that they just
297
00:19:32,280 --> 00:19:38,240
sort of piggybacking onto the setup procedure and the discovery paths within the project
298
00:19:38,240 --> 00:19:41,400
rather than managing actual dependencies.
299
00:19:41,400 --> 00:19:42,400
Is that about right?
300
00:19:42,400 --> 00:19:43,400
To some extent.
301
00:19:43,400 --> 00:19:50,760
I think that's close enough to be accurate, but it's also that sometimes those dependencies
302
00:19:50,760 --> 00:19:51,920
have dependencies, you know?
303
00:19:51,920 --> 00:19:57,520
And now suddenly you're having CocoaPods do the native dependencies and in the way that
304
00:19:57,520 --> 00:20:00,760
they might have Gradle do the native dependencies for Android too.
305
00:20:00,760 --> 00:20:01,760
Right.
306
00:20:01,760 --> 00:20:06,120
It's complicated, but these projects are really complicated at heart because they're trying
307
00:20:06,120 --> 00:20:08,120
to do something strange.
308
00:20:08,120 --> 00:20:09,120
Yeah.
309
00:20:09,120 --> 00:20:13,720
Well, I think that's a good chance to talk about another kind of huge question with this
310
00:20:13,720 --> 00:20:22,400
is are there cases that you're aware of where people, and I'm guessing this is going to
311
00:20:22,400 --> 00:20:28,640
be large companies, are unable to move away from CocoaPods?
312
00:20:28,640 --> 00:20:31,080
I'm sure you've heard stories over the years.
313
00:20:31,080 --> 00:20:39,400
Are those stories still coming in or are you expecting a kind of a quiet transition?
314
00:20:39,400 --> 00:20:44,480
So far on every blog post I have wrote, if you have problems with these timelines and
315
00:20:44,480 --> 00:20:47,080
things like that, then you're welcome to contact us.
316
00:20:47,080 --> 00:20:49,160
And I've not had a single contact.
317
00:20:49,160 --> 00:20:54,000
So I'm assuming right now everybody, I mean, two years is such a long time.
318
00:20:54,000 --> 00:20:56,440
You read a blog post and you're like, "Oh, we've got forever."
319
00:20:56,440 --> 00:20:57,440
Sure.
320
00:20:57,440 --> 00:20:58,440
We're at one year now.
321
00:20:58,440 --> 00:20:59,440
And then suddenly it's tomorrow, right?
322
00:20:59,440 --> 00:21:00,440
Yeah.
323
00:21:00,440 --> 00:21:08,400
So there's a chance that next year, sometime around November, like our plan is that sometime
324
00:21:08,400 --> 00:21:16,040
in November next year, trying to avoid that American holiday, Thanksgiving, we're going
325
00:21:16,040 --> 00:21:22,760
to do like a short term brownout, so make it for a week.
326
00:21:22,760 --> 00:21:26,000
You'll probably get a few emails that week.
327
00:21:26,000 --> 00:21:30,360
And then that gives you a month afterwards of finding out that you can't upload to CocoaPods
328
00:21:30,360 --> 00:21:34,680
that maybe you're going to have to make sure that that's okay in the next month.
329
00:21:34,680 --> 00:21:40,600
Yeah, I mean, I think one of the things that I've really admired about the process of this
330
00:21:40,600 --> 00:21:48,880
is how much notice you've given people that this is happening and how open you are to
331
00:21:48,880 --> 00:21:51,520
hearing about the problems that may be caused.
332
00:21:51,520 --> 00:21:57,240
And I'm happy to hear that you have not been swamped with emails and requests so far.
333
00:21:57,240 --> 00:22:01,680
And I think, I mean, it's been a long time.
334
00:22:01,680 --> 00:22:05,160
I know there are always edge cases, but it's been a long time, right?
335
00:22:05,160 --> 00:22:06,160
Yeah.
336
00:22:06,160 --> 00:22:10,280
So when I wrote that blog post about like us starting to do the support and maintenance
337
00:22:10,280 --> 00:22:16,480
plans, so that's like 2024, SPM had been around for nine years.
338
00:22:16,480 --> 00:22:18,920
Although not usable in iOS projects for nine years.
339
00:22:18,920 --> 00:22:19,920
Absolutely.
340
00:22:19,920 --> 00:22:24,640
I think in my head, it took three or four years to start being maybe more, just not
341
00:22:24,640 --> 00:22:26,080
being super useful.
342
00:22:26,080 --> 00:22:31,680
But, you know, for CocoaPods, from CocoaPods' perspective, the day that came out was like
343
00:22:31,680 --> 00:22:37,120
the end of the value of working on CocoaPods, generally speaking.
344
00:22:37,120 --> 00:22:38,120
Sure.
345
00:22:38,120 --> 00:22:44,520
And I think actually that was quite a harmful thing to the community that happened, that
346
00:22:44,520 --> 00:22:51,440
SPM came out and that definitely made a line in the sand of like, okay, Apple are doing
347
00:22:51,440 --> 00:22:53,120
dependency management.
348
00:22:53,120 --> 00:22:54,720
This is Swift dependency management.
349
00:22:54,720 --> 00:22:57,520
This is going to be the standard and blah, blah, blah.
350
00:22:57,520 --> 00:23:04,640
And then it wasn't actually usable in iOS and macOS projects for years afterwards.
351
00:23:04,640 --> 00:23:12,720
And I think that I won't try to speak for the Swift team, but I would imagine they have
352
00:23:12,720 --> 00:23:15,080
some regrets around how that happened.
353
00:23:15,080 --> 00:23:16,080
Yeah.
354
00:23:16,080 --> 00:23:18,800
It's one of those tricky problems, right?
355
00:23:18,800 --> 00:23:25,760
Because they had to release a build for Linux as Swift, otherwise they were just like releasing
356
00:23:25,760 --> 00:23:30,160
another Apple language and the rest of the world was not going to take much attention.
357
00:23:30,160 --> 00:23:32,640
And so they needed something.
358
00:23:32,640 --> 00:23:33,640
Yes.
359
00:23:33,640 --> 00:23:39,200
But like framing it as the package manager may indeed have really shot them in the foot
360
00:23:39,200 --> 00:23:40,200
for a little bit.
361
00:23:40,200 --> 00:23:44,080
A little bit being it was quite a while.
362
00:23:44,080 --> 00:23:45,080
Yeah.
363
00:23:45,080 --> 00:23:46,080
Yeah.
364
00:23:46,080 --> 00:23:48,040
I mean, these decisions are never simple.
365
00:23:48,040 --> 00:23:52,000
There's always more to it than is on the surface.
366
00:23:52,000 --> 00:23:59,920
But yes, it was a slightly messy time for how is dependency management going to look
367
00:23:59,920 --> 00:24:04,360
on for Swift around that time.
368
00:24:04,360 --> 00:24:09,760
And I can see that as somebody who, well, the whole team has probably felt the same
369
00:24:09,760 --> 00:24:14,840
way, is, well, why are we putting all of our time and effort into this project when it's
370
00:24:14,840 --> 00:24:17,760
going to be deprecated at some point?
371
00:24:17,760 --> 00:24:22,880
I used to frame my work on CocoaPods as being like, it's like a tentpole project for the
372
00:24:22,880 --> 00:24:23,880
community.
373
00:24:23,880 --> 00:24:27,760
Like any work you do raises the tent and makes everything a little bit bigger for everybody
374
00:24:27,760 --> 00:24:30,680
to be able to do cool stuff on.
375
00:24:30,680 --> 00:24:35,000
And then slowly it just started to not be as valuable.
376
00:24:35,000 --> 00:24:42,240
And also like CocoaPods is built in a different technology stack than the majority of the
377
00:24:42,240 --> 00:24:44,520
work you do on your iOS work.
378
00:24:44,520 --> 00:24:50,120
And I think what we found is the people that started working on CocoaPods stopped building
379
00:24:50,120 --> 00:24:55,600
iOS apps quite quickly because of the skills that they got doing this ended up being really
380
00:24:55,600 --> 00:24:56,600
interesting.
381
00:24:56,600 --> 00:24:58,520
And off they went into the Ruby world.
382
00:24:58,520 --> 00:24:59,520
Yes, exactly.
383
00:24:59,520 --> 00:25:00,520
Yeah.
384
00:25:00,520 --> 00:25:01,520
Yeah.
385
00:25:01,520 --> 00:25:03,120
I can, I can certainly see that.
386
00:25:03,120 --> 00:25:04,120
Yeah.
387
00:25:04,120 --> 00:25:10,680
This would all have been different if there was a Ruby SDK to build iOS apps, I suppose.
388
00:25:10,680 --> 00:25:13,560
Which I think there was, wasn't there a MacOS thing?
389
00:25:13,560 --> 00:25:15,840
There was, yeah, there was.
390
00:25:15,840 --> 00:25:16,840
Yeah.
391
00:25:16,840 --> 00:25:17,840
RubyMotion.
392
00:25:17,840 --> 00:25:19,600
That's what it was called.
393
00:25:19,600 --> 00:25:20,600
Yeah.
394
00:25:20,600 --> 00:25:21,600
Yeah.
395
00:25:21,600 --> 00:25:22,600
There was a Python one as well, right?
396
00:25:22,600 --> 00:25:24,360
Oh, there was an official one.
397
00:25:24,360 --> 00:25:26,680
Ruby Cocoa was built into the Mac.
398
00:25:26,680 --> 00:25:28,240
That was, that was one of the originals.
399
00:25:28,240 --> 00:25:30,000
That was my first job.
400
00:25:30,000 --> 00:25:31,000
My first programming job.
401
00:25:31,000 --> 00:25:32,000
How was it?
402
00:25:32,000 --> 00:25:33,000
Was it really?
403
00:25:33,000 --> 00:25:35,440
Tell us about your first programming job then.
404
00:25:35,440 --> 00:25:45,360
I went and moved out to Brazil and did a sort of, worked on a blogging client that was like,
405
00:25:45,360 --> 00:25:49,440
you know, it supported Tumblr, it supported WordPress.
406
00:25:49,440 --> 00:25:56,320
And the guy that did it was like a Ruby fanaticist and would refuse to do anything else.
407
00:25:56,320 --> 00:25:59,920
So he was like, we are going to figure out how to make this work.
408
00:25:59,920 --> 00:26:04,400
And it was good, but it was not good enough to be fully production worthy.
409
00:26:04,400 --> 00:26:08,680
Which is why RubyMotion ended up coming out of, like the guy that wrote that in Apple,
410
00:26:08,680 --> 00:26:13,480
eventually Laurent Sansonetti, he moved out of Apple and turned it into a startup.
411
00:26:13,480 --> 00:26:15,360
That was RubyMotion, the one that everybody had heard of.
412
00:26:15,360 --> 00:26:17,120
And that was RubyMotion, of course it was.
413
00:26:17,120 --> 00:26:18,120
Yes.
414
00:26:18,120 --> 00:26:24,920
I remember that Laurent used to work for Apple, but I'd forgotten that he'd come away and
415
00:26:24,920 --> 00:26:26,560
tried to do that as a startup.
416
00:26:26,560 --> 00:26:27,560
Yeah.
417
00:26:27,560 --> 00:26:28,560
Is it still going?
418
00:26:28,560 --> 00:26:29,560
I presume it's not.
419
00:26:29,560 --> 00:26:30,560
It's not.
420
00:26:30,560 --> 00:26:35,200
It's not NVIDIA now, but Alloy is like the original creator of CocoaPods.
421
00:26:35,200 --> 00:26:39,440
I'm just the guy that came like a few months down the line and said, this is a good idea.
422
00:26:39,440 --> 00:26:41,560
He worked on RubyMotion.
423
00:26:41,560 --> 00:26:46,960
So he ended up like, ended up back in this world of like runtime engine stuff before
424
00:26:46,960 --> 00:26:48,960
eventually coming to work with me at Artsy.
425
00:26:48,960 --> 00:26:49,960
Right.
426
00:26:49,960 --> 00:26:50,960
Okay.
427
00:26:50,960 --> 00:26:51,960
Right.
428
00:26:51,960 --> 00:26:52,960
There you go.
429
00:26:52,960 --> 00:26:53,960
Small world.
430
00:26:53,960 --> 00:26:54,960
It is.
431
00:26:54,960 --> 00:26:58,200
And certainly it was a very close knit community of the CocoaPods people, wasn't it?
432
00:26:58,200 --> 00:27:01,560
We don't like, you know, you get to a point and people invite you to conferences and then
433
00:27:01,560 --> 00:27:04,760
you go to the conference and you meet all the other people that are working on it because
434
00:27:04,760 --> 00:27:07,560
there's always something interesting in that space.
435
00:27:07,560 --> 00:27:12,040
So we had a couple more questions off the social media posts, which we should probably
436
00:27:12,040 --> 00:27:13,640
get to.
437
00:27:13,640 --> 00:27:19,320
One from Kali Coding said, there are other tools, for example, Fastlane that rely on
438
00:27:19,320 --> 00:27:23,720
the Xcode project gem from CocoaPods, but this gem has not kept up to date with the
439
00:27:23,720 --> 00:27:25,640
latest Xcode project file changes.
440
00:27:25,640 --> 00:27:28,640
Specifically, it doesn't support buildable folders.
441
00:27:28,640 --> 00:27:33,080
Is this gem also being put into maintenance mode and will that also carry over to Fastlane?
442
00:27:33,080 --> 00:27:35,400
Now, I appreciate you're not the maintainer of Fastlane.
443
00:27:35,400 --> 00:27:38,680
We should maybe get Josh on to answer that question.
444
00:27:38,680 --> 00:27:42,800
But I wondered if you had any thoughts on that.
445
00:27:42,800 --> 00:27:48,040
I think I honestly never considered it until this just came up.
446
00:27:48,040 --> 00:27:53,400
But like, it's not mine to give away, but it's also like, yeah, I don't see a reason
447
00:27:53,400 --> 00:27:56,920
why we couldn't just decouple it from the CocoaPods infrastructure and make it available
448
00:27:56,920 --> 00:27:57,920
for people.
449
00:27:57,920 --> 00:27:58,920
It in itself has value.
450
00:27:58,920 --> 00:28:06,720
And of course that gem can still be maintained under, or is that gem also going to be made
451
00:28:06,720 --> 00:28:07,720
archived?
452
00:28:07,720 --> 00:28:10,720
Is that going to be, is there a plan to archive that gem?
453
00:28:10,720 --> 00:28:17,280
The only plan officially is to make trunk read only.
454
00:28:17,280 --> 00:28:21,960
But the reality I think of the situation is Xcode project is used in more than just CocoaPods.
455
00:28:21,960 --> 00:28:26,480
And so I think it is more valid to move it to be able to be supported by a team that
456
00:28:26,480 --> 00:28:28,280
would actually support it.
457
00:28:28,280 --> 00:28:36,360
Well, Josh, if you're listening, drop us an email and we'll, I mean, I'm sure you and
458
00:28:36,360 --> 00:28:39,480
Josh have talked many, many times over the years, right?
459
00:28:39,480 --> 00:28:41,640
Yeah, yeah, yeah.
460
00:28:41,640 --> 00:28:48,360
Josh is part of why I'm recommending my Swift package later on down the line.
461
00:28:48,360 --> 00:28:49,360
Teases for later.
462
00:28:49,360 --> 00:28:50,360
Don't spoil it.
463
00:28:50,360 --> 00:28:58,760
Another question here from Alexander Steiner.
464
00:28:58,760 --> 00:29:01,120
Is there anything you would have done differently in hindsight?
465
00:29:01,120 --> 00:29:02,120
That's a great question.
466
00:29:02,120 --> 00:29:03,120
This is interesting.
467
00:29:03,120 --> 00:29:11,360
Like, because there's tons of things that I think that is fun to do on a community of
468
00:29:11,360 --> 00:29:14,120
the size that we have for CocoaPods.
469
00:29:14,120 --> 00:29:18,440
Like I used to spend a lot of time building really interesting statistics and try and
470
00:29:18,440 --> 00:29:20,680
like generate all this.
471
00:29:20,680 --> 00:29:25,160
We have like interesting analytics that were like unique within dependency managers because
472
00:29:25,160 --> 00:29:32,160
we weren't just relying on whether it was, you know, seen or dependent on what its dependencies
473
00:29:32,160 --> 00:29:33,160
were.
474
00:29:33,160 --> 00:29:39,840
I've been really interested in like, I think there's something really cool about having
475
00:29:39,840 --> 00:29:47,120
a small set of dependencies and having authors be able to say like, I trust this person and
476
00:29:47,120 --> 00:29:50,480
being able to make web of trust around dependencies.
477
00:29:50,480 --> 00:29:52,480
So it'd be like, I trust Dave Verwer.
478
00:29:52,480 --> 00:29:56,320
Dave Verwer has said that he has read the software Llama Fire.
479
00:29:56,320 --> 00:29:57,320
Yeah, yeah, exactly.
480
00:29:57,320 --> 00:30:00,920
I get to choose to make those mistakes.
481
00:30:00,920 --> 00:30:02,600
And that's kind of fun.
482
00:30:02,600 --> 00:30:09,400
I'd love to see like a web of trust system built on top of CocoaPods' dependencies.
483
00:30:09,400 --> 00:30:14,600
And I would have loved to have the technology I have today to be able to like redo a lot
484
00:30:14,600 --> 00:30:17,000
of the analytics pipelines and things like that.
485
00:30:17,000 --> 00:30:22,240
Back then it was like unbearably expensive to be able to generate analytics for people
486
00:30:22,240 --> 00:30:23,960
on their pods.
487
00:30:23,960 --> 00:30:33,000
But today I have a self-hosted system that uses Clickhouse that is honestly, you know,
488
00:30:33,000 --> 00:30:37,000
the same quality as the one that I had for CocoaPods for a while that cost a thousand
489
00:30:37,000 --> 00:30:39,200
dollars a month.
490
00:30:39,200 --> 00:30:41,960
And so some of that stuff I would have loved to do.
491
00:30:41,960 --> 00:30:46,120
But you know, for me, I'm super proud of the design work I did on CocoaPods.
492
00:30:46,120 --> 00:30:48,160
That's like some of my favorite stuff.
493
00:30:48,160 --> 00:30:50,720
And just like committing to something for such a long time.
494
00:30:50,720 --> 00:30:51,720
It's like, it's hard.
495
00:30:51,720 --> 00:30:56,160
It's been a decade or two, but it's been fun.
496
00:30:56,160 --> 00:31:02,800
Well certainly many aspects of CocoaPods were inspiration for what we built with the Swift
497
00:31:02,800 --> 00:31:09,800
Package Index, especially my favorite little bit of CocoaPods that shut down a long time
498
00:31:09,800 --> 00:31:14,880
before CocoaPods itself is going to transition to maintenance mode, but was CocoaDocs, which
499
00:31:14,880 --> 00:31:21,080
was the documentation hosting for, I think you used, what's the tool called?
500
00:31:21,080 --> 00:31:24,360
Beans with a J. Jazzy, Jazzy.
501
00:31:24,360 --> 00:31:28,640
I wanted to say Jazzy, but it's Jazzy.
502
00:31:28,640 --> 00:31:30,360
Oh, what was the original one?
503
00:31:30,360 --> 00:31:33,280
Well, Jazzy didn't support Objective-C projects.
504
00:31:33,280 --> 00:31:36,040
So I first built it with an Objective-C version of that.
505
00:31:36,040 --> 00:31:37,680
Oh, there you go.
506
00:31:37,680 --> 00:31:38,880
But yeah, I agree.
507
00:31:38,880 --> 00:31:40,400
No one else was attacking those types of problems.
508
00:31:40,400 --> 00:31:42,720
You need a centralized system to do that.
509
00:31:42,720 --> 00:31:43,720
Yeah.
510
00:31:43,720 --> 00:31:49,640
And yeah, so what we've built with Package Index having documentation hosting and what
511
00:31:49,640 --> 00:31:54,000
we consider very easy to enable documentation hosting, you just put a little configuration
512
00:31:54,000 --> 00:31:58,480
file in your project and we'll take care of everything else.
513
00:31:58,480 --> 00:32:04,080
That kind of problem is only possible when you've built the underlying infrastructure.
514
00:32:04,080 --> 00:32:09,520
In CocoaPods case, it was CocoaPods itself and in Swift Package Index, it was the index.
515
00:32:09,520 --> 00:32:11,840
And actually it's more than that.
516
00:32:11,840 --> 00:32:16,760
It's the index plus the build system because with DocC, you can't build the documentation
517
00:32:16,760 --> 00:32:18,680
until you've built the package.
518
00:32:18,680 --> 00:32:25,200
And so we were able to kind of tack that on with less work than it would have been if
519
00:32:25,200 --> 00:32:27,280
we hadn't had that build system.
520
00:32:27,280 --> 00:32:33,640
So CocoaPods has been hugely influential in what we've built with Package Index.
521
00:32:33,640 --> 00:32:34,640
So again, thank you for that.
522
00:32:34,640 --> 00:32:39,120
Yeah, it's cool to see people trying new things from the same ideas.
523
00:32:39,120 --> 00:32:42,120
Yeah, yeah, absolutely.
524
00:32:42,120 --> 00:32:48,320
In terms of other open source projects, are there any precedents for a project going read-only
525
00:32:48,320 --> 00:32:52,240
like this or kind of transitioning into a maintenance mode like this that you can talk
526
00:32:52,240 --> 00:32:53,240
about?
527
00:32:53,240 --> 00:32:54,240
Not to my knowledge.
528
00:32:54,240 --> 00:32:59,840
We spent some time trying to research this to see if there is good examples of people
529
00:32:59,840 --> 00:33:04,560
trying to move off dependency managers.
530
00:33:04,560 --> 00:33:07,400
And honestly, I couldn't find much.
531
00:33:07,400 --> 00:33:10,800
And that has made it kind of interesting.
532
00:33:10,800 --> 00:33:15,800
There's like discords where people that run dependency managers hang out.
533
00:33:15,800 --> 00:33:20,480
And there's also, we talked a little bit, I think with the Linux Foundation about what
534
00:33:20,480 --> 00:33:22,160
they've ever done in this space.
535
00:33:22,160 --> 00:33:30,160
But realistically, it's relatively unprecedented to turn a dependency manager read-only.
536
00:33:30,160 --> 00:33:37,840
And so it's funny to just be just doing it and just seeing where it goes step by step.
537
00:33:37,840 --> 00:33:44,560
But that's kind of why we gave it such a long process because if it takes two years, that's
538
00:33:44,560 --> 00:33:45,560
fine.
539
00:33:45,560 --> 00:33:48,000
Then someone might tell us where the problem is on route.
540
00:33:48,000 --> 00:33:51,440
But for now, it just seems to be that we're sort of operating in a new space.
541
00:33:51,440 --> 00:33:52,440
It's kind of surprising.
542
00:33:52,440 --> 00:33:55,440
There's so many projects out there.
543
00:33:55,440 --> 00:33:57,440
Do they just shut down?
544
00:33:57,440 --> 00:34:00,720
Well, I think a lot of them do actually.
545
00:34:00,720 --> 00:34:07,880
I think a lot of open source projects, when the maintainers move on, they actually don't
546
00:34:07,880 --> 00:34:08,880
even shut down.
547
00:34:08,880 --> 00:34:09,880
They just get abandoned.
548
00:34:09,880 --> 00:34:10,880
Yeah.
549
00:34:10,880 --> 00:34:11,880
Yeah.
550
00:34:11,880 --> 00:34:14,560
You're giving a lot of grace period there.
551
00:34:14,560 --> 00:34:20,360
I was wondering, is there anything you can think of or you might have thought of that
552
00:34:20,360 --> 00:34:24,360
might block people from moving off of CocoaPods to SwiftPM?
553
00:34:24,360 --> 00:34:29,360
Are there any features that are missing and that are hard to sort of replace?
554
00:34:29,360 --> 00:34:37,720
The hard part, and again, I don't know all of the modern features of Swift Package Manager,
555
00:34:37,720 --> 00:34:44,360
but it definitely used to be a case where adopting Swift Package Manager for a library
556
00:34:44,360 --> 00:34:50,800
like OpenCV was just kind of not really feasible because it required changing that file structure
557
00:34:50,800 --> 00:34:59,400
to fit and to be usable in a way where Xcode was a priority of the build system.
558
00:34:59,400 --> 00:35:04,680
And so you do, I think, have quite a few of these crazy C libraries that people use that
559
00:35:04,680 --> 00:35:06,920
may or may not be possible to migrate over.
560
00:35:06,920 --> 00:35:08,280
I'm not entirely sure.
561
00:35:08,280 --> 00:35:09,280
We were very build flexible.
562
00:35:09,280 --> 00:35:10,280
Right.
563
00:35:10,280 --> 00:35:12,160
So I don't have an answer for those.
564
00:35:12,160 --> 00:35:15,680
At the same time, if you were vending it, you may have the technical experience to be
565
00:35:15,680 --> 00:35:19,400
able to put it in your Xcode project, like natively.
566
00:35:19,400 --> 00:35:20,760
Maybe you're not updating so often.
567
00:35:20,760 --> 00:35:21,760
Right.
568
00:35:21,760 --> 00:35:24,280
That's my guess, but no one has said anything.
569
00:35:24,280 --> 00:35:25,280
Right.
570
00:35:25,280 --> 00:35:26,280
Right.
571
00:35:26,280 --> 00:35:29,640
And what happens after the maintenance period?
572
00:35:29,640 --> 00:35:30,640
Is that the end?
573
00:35:30,640 --> 00:35:32,360
Is that the end of it?
574
00:35:32,360 --> 00:35:38,160
I think we've been on such like a, again, because there was no releases this year.
575
00:35:38,160 --> 00:35:46,280
I think we're definitely at a point where people are not fully operating the machine.
576
00:35:46,280 --> 00:35:49,160
So I don't know.
577
00:35:49,160 --> 00:35:54,880
By removing the authentication and moving to be read-only, we effectively allow the
578
00:35:54,880 --> 00:36:01,000
key server to sort of, it doesn't need to turn off because it only costs a 10 or a month
579
00:36:01,000 --> 00:36:02,680
to operate.
580
00:36:02,680 --> 00:36:11,200
But I think trying to figure out, do we do updates to the CLI client to be like, you
581
00:36:11,200 --> 00:36:16,360
have touched a pod that came from KUKA.PODS's trunk.
582
00:36:16,360 --> 00:36:17,680
This will never get an update.
583
00:36:17,680 --> 00:36:19,720
Are you sure you want to do this?
584
00:36:19,720 --> 00:36:20,720
Yeah.
585
00:36:20,720 --> 00:36:21,720
Is probably something we're not going to do.
586
00:36:21,720 --> 00:36:22,720
I think that would be a good idea.
587
00:36:22,720 --> 00:36:23,720
Yeah.
588
00:36:23,720 --> 00:36:24,720
Yeah.
589
00:36:24,720 --> 00:36:25,720
I think that would be a good idea.
590
00:36:25,720 --> 00:36:28,040
Just so that those people see it every time they update.
591
00:36:28,040 --> 00:36:29,040
Yeah, exactly.
592
00:36:29,040 --> 00:36:34,920
And it might not be that often, but some people might be using a dependency that was built
593
00:36:34,920 --> 00:36:37,200
10 years ago and has never updated since.
594
00:36:37,200 --> 00:36:38,400
And it was probably just fine.
595
00:36:38,400 --> 00:36:44,040
I think that's the only situation that is going to be a problem.
596
00:36:44,040 --> 00:36:51,200
And it's not really going to be a problem because it is just the passage of time is
597
00:36:51,200 --> 00:36:57,680
that there are a lot of iOS and macOS projects that were built at a point in time and haven't
598
00:36:57,680 --> 00:36:59,440
been touched since.
599
00:36:59,440 --> 00:37:02,960
And resurrecting those projects will become even harder.
600
00:37:02,960 --> 00:37:08,040
But honestly, resurrecting those projects is already an enormous task because the APIs
601
00:37:08,040 --> 00:37:09,640
have changed so much.
602
00:37:09,640 --> 00:37:11,280
The tooling has changed so much.
603
00:37:11,280 --> 00:37:13,680
The Swift has changed so much.
604
00:37:13,680 --> 00:37:15,280
You know, it's more than a few years old.
605
00:37:15,280 --> 00:37:16,280
It's not going to compile.
606
00:37:16,280 --> 00:37:21,480
Well, if it's Objective-C, I mean, it'll compile, but maybe people are replacing that stuff
607
00:37:21,480 --> 00:37:22,480
anyway.
608
00:37:22,480 --> 00:37:25,120
And those won't see any changes probably either.
609
00:37:25,120 --> 00:37:28,480
So that'll just age out, I suppose.
610
00:37:28,480 --> 00:37:29,480
Yeah.
611
00:37:29,480 --> 00:37:30,480
Yeah.
612
00:37:30,480 --> 00:37:33,960
That's our theory that like, you know, people that are using building Swift projects at
613
00:37:33,960 --> 00:37:38,000
this point will probably have moved to Swift Package Manager.
614
00:37:38,000 --> 00:37:43,200
People that don't control their projects like React Native or Flutter are at a point where
615
00:37:43,200 --> 00:37:46,800
eventually there'll be a point release in their Flutter or React Native that switches
616
00:37:46,800 --> 00:37:48,760
fully over to Swift Package Manager.
617
00:37:48,760 --> 00:37:52,720
But most of the time their dependencies are not coming through CocoaPods.
618
00:37:52,720 --> 00:37:57,120
And anybody with an old build still works perfectly fine because the same pods are going
619
00:37:57,120 --> 00:37:58,120
to be there.
620
00:37:58,120 --> 00:38:00,000
There just won't be updates to new ones.
621
00:38:00,000 --> 00:38:01,000
That's right.
622
00:38:01,000 --> 00:38:02,000
Yeah.
623
00:38:02,000 --> 00:38:03,000
The tooling still runs.
624
00:38:03,000 --> 00:38:04,000
The pods still exist.
625
00:38:04,000 --> 00:38:05,920
The GitHub repository is still there.
626
00:38:05,920 --> 00:38:06,920
Yeah, absolutely.
627
00:38:06,920 --> 00:38:07,920
Yeah.
628
00:38:07,920 --> 00:38:08,920
It's good.
629
00:38:08,920 --> 00:38:13,320
I hope and predict a smooth transition.
630
00:38:13,320 --> 00:38:19,600
Well, I've gained enough internet credit over these years to take a few flames if we need
631
00:38:19,600 --> 00:38:20,600
to.
632
00:38:20,600 --> 00:38:21,600
Yes, you have.
633
00:38:21,600 --> 00:38:23,760
Well, I hope you don't need to.
634
00:38:23,760 --> 00:38:27,160
And I hope nobody does that because it is not deserved.
635
00:38:27,160 --> 00:38:29,920
Well, that's been very interesting.
636
00:38:29,920 --> 00:38:34,000
And thank you so much for coming on the podcast to talk about that.
637
00:38:34,000 --> 00:38:38,920
But before we finish, let's do some package picks, shall we?
638
00:38:38,920 --> 00:38:40,520
Shall I start?
639
00:38:40,520 --> 00:38:43,960
Sven, why don't you kick us off?
640
00:38:43,960 --> 00:38:46,200
All right, I can do that.
641
00:38:46,200 --> 00:38:56,600
My pick this week or this time is Swift Configuration, a package by Apple that I believe was just
642
00:38:56,600 --> 00:39:02,800
announced this week or last week with the 1.0 release.
643
00:39:02,800 --> 00:39:05,800
So it's very fresh.
644
00:39:05,800 --> 00:39:12,840
And this package is about app configuration in terms of configuration files, environment
645
00:39:12,840 --> 00:39:15,120
variables, command line arguments.
646
00:39:15,120 --> 00:39:20,120
So there's lots of ways you can get configuration into your app.
647
00:39:20,120 --> 00:39:21,320
It supports hierarchy.
648
00:39:21,320 --> 00:39:27,120
So you can have overrides, like for instance, typically command line arguments would override
649
00:39:27,120 --> 00:39:31,120
file-based configuration, that sort of thing.
650
00:39:31,120 --> 00:39:34,240
Yeah, 1.0 came out.
651
00:39:34,240 --> 00:39:36,840
It supports these things I mentioned.
652
00:39:36,840 --> 00:39:38,860
Also, it redacts.
653
00:39:38,860 --> 00:39:44,000
You can declare a configuration value as secret.
654
00:39:44,000 --> 00:39:49,720
So it'll be redacted from logs automatically, which is very nice.
655
00:39:49,720 --> 00:39:54,840
I also want to mention another package while I mention this one.
656
00:39:54,840 --> 00:40:01,440
And that is called Swift Configs by Danil Voidilov.
657
00:40:01,440 --> 00:40:02,720
And that is slightly older.
658
00:40:02,720 --> 00:40:07,480
So he published that four months ago.
659
00:40:07,480 --> 00:40:09,640
Danil is two months old.
660
00:40:09,640 --> 00:40:17,120
So he was with Sherlock within two months of starting his package.
661
00:40:17,120 --> 00:40:25,200
I actually have to say I like the API in Danil's package a bit better than Apple's.
662
00:40:25,200 --> 00:40:32,360
There are trade-offs here because Apple's package has a couple more features like the
663
00:40:32,360 --> 00:40:33,360
overrides.
664
00:40:33,360 --> 00:40:37,920
But, you know, pick the one that you prefer.
665
00:40:37,920 --> 00:40:44,640
If you don't need the overrides, Danil's package might be the way to go with.
666
00:40:44,640 --> 00:40:50,280
And both packages will surely do the job if you need to configure your app.
667
00:40:50,280 --> 00:40:51,280
So there you go.
668
00:40:51,280 --> 00:40:56,240
That's Swift Configuration by Apple and Swift Configs by Danil Voidilov.
669
00:40:56,240 --> 00:40:57,240
Interesting.
670
00:40:57,240 --> 00:41:09,560
Sherlock's after two months is certainly a prize of sorts.
671
00:41:09,560 --> 00:41:11,560
Congratulations on winning that competition.
672
00:41:11,560 --> 00:41:15,760
Otto, do you want to give us your pick?
673
00:41:15,760 --> 00:41:21,080
So I have Danger in Swift is a Swift package manager package.
674
00:41:21,080 --> 00:41:24,360
So I guess to some extent that is one of them.
675
00:41:24,360 --> 00:41:33,880
But I only use one Swift package in Pusmo's iOS app, and that is RevenueCat.
676
00:41:33,880 --> 00:41:35,800
I've been really happy with that.
677
00:41:35,800 --> 00:41:41,000
So I just vendor the entire thing, put it inside the source code, and they make my life
678
00:41:41,000 --> 00:41:45,760
quite a lot easier considering how much work I had to do to do the web version of RevenueCat.
679
00:41:45,760 --> 00:41:49,080
Well, that was going to be my next question.
680
00:41:49,080 --> 00:41:50,760
Do you use their web?
681
00:41:50,760 --> 00:41:54,120
Because they have a web SDK as well, right?
682
00:41:54,120 --> 00:41:55,120
They do.
683
00:41:55,120 --> 00:41:57,440
Yeah, you can hook it into like Stripe and stuff like that.
684
00:41:57,440 --> 00:41:59,680
But I had already built all that stuff by hand.
685
00:41:59,680 --> 00:42:01,120
You'd already built that, right.
686
00:42:01,120 --> 00:42:07,280
Like giving them extra revenue from going back and undoing all that work, and this wasn't
687
00:42:07,280 --> 00:42:08,280
worth it for me.
688
00:42:08,280 --> 00:42:11,520
Oh, if it's already done, absolutely.
689
00:42:11,520 --> 00:42:12,520
Yeah.
690
00:42:12,520 --> 00:42:13,520
Yeah.
691
00:42:13,520 --> 00:42:17,280
And so, yeah, just one Swift package, that's some kind of record.
692
00:42:17,280 --> 00:42:20,720
Although I presume many, many JavaScript dependencies as well, right?
693
00:42:20,720 --> 00:42:22,160
Oh, you don't want to know.
694
00:42:22,160 --> 00:42:24,080
You do not want to know.
695
00:42:24,080 --> 00:42:26,920
Does JavaScript encourage lots of dependency?
696
00:42:26,920 --> 00:42:29,920
I had no idea.
697
00:42:29,920 --> 00:42:30,920
Imagine.
698
00:42:30,920 --> 00:42:37,480
Well, thank you for the pick.
699
00:42:37,480 --> 00:42:42,200
And certainly, it's a popular pick.
700
00:42:42,200 --> 00:42:46,840
I'm not sure if it's ever been recommended on here before, Sven.
701
00:42:46,840 --> 00:42:48,840
Do you recollect?
702
00:42:48,840 --> 00:42:52,880
Possibly, but it's been a while, if it has been.
703
00:42:52,880 --> 00:42:53,880
So yeah.
704
00:42:53,880 --> 00:42:54,880
Yeah, yeah, yeah.
705
00:42:54,880 --> 00:42:58,560
It's a good one.
706
00:42:58,560 --> 00:43:06,000
My first package this week is called Monocle by Dennis Muller.
707
00:43:06,000 --> 00:43:14,400
And it is a Swift symbol lookup CLI powered by SourceKit LSP tuned for coding agents.
708
00:43:14,400 --> 00:43:22,800
And so it's a command line tool where you can, for example, ask Monocle, this tool,
709
00:43:22,800 --> 00:43:30,000
to inspect a specific file at a specific line, even a specific column in that line.
710
00:43:30,000 --> 00:43:37,080
And it will describe what it's seeing at that position.
711
00:43:37,080 --> 00:43:44,720
You can have it output in human readable output or in JSON.
712
00:43:44,720 --> 00:43:49,760
And what you can do is you can tell if you're using something like Cloud Code or any of
713
00:43:49,760 --> 00:43:57,480
the agents, you can, in your agents.markdown file, you can give instructions to the agent
714
00:43:57,480 --> 00:43:58,960
on how to use Monocle.
715
00:43:58,960 --> 00:44:03,240
So for example, they actually give you a little snippet here that you can say, treat the Monocle
716
00:44:03,240 --> 00:44:07,000
CLI as your default tool for Swift symbol information.
717
00:44:07,000 --> 00:44:12,400
If you need definition file signature parameters or document comments for any Swift symbol,
718
00:44:12,400 --> 00:44:14,240
run this tool.
719
00:44:14,240 --> 00:44:19,400
And on it goes, you know, list checked out Swift dependencies, resolve any symbol at
720
00:44:19,400 --> 00:44:21,700
a specific location.
721
00:44:21,700 --> 00:44:31,720
And so it gives the agent the knowledge of how to properly inspect Swift symbols inside
722
00:44:31,720 --> 00:44:32,720
your project.
723
00:44:32,720 --> 00:44:36,560
And I thought it was a really interesting little tool.
724
00:44:36,560 --> 00:44:42,040
It's also got a server mode where you can keep the LSP server running constantly so
725
00:44:42,040 --> 00:44:46,920
that calls to the Monocle tool are really quick because it's already booted up that
726
00:44:46,920 --> 00:44:51,400
whole infrastructure of LSP.
727
00:44:51,400 --> 00:44:57,800
And I thought it was a very, very interesting tool and a fantastic readme file.
728
00:44:57,800 --> 00:45:00,520
Looks really easy to get started with.
729
00:45:00,520 --> 00:45:03,160
So yeah, it looked great.
730
00:45:03,160 --> 00:45:05,600
Well I think, are there any other package picks?
731
00:45:05,600 --> 00:45:07,320
Not for me, no.
732
00:45:07,320 --> 00:45:14,280
Well, I just have one, one lightweight one at the end then, which is a package called
733
00:45:14,280 --> 00:45:17,120
Swift for Swifts.
734
00:45:17,120 --> 00:45:25,920
It's by Rob Whittaker and it actually goes along with a website and the website is swiftforswifts.org.
735
00:45:25,920 --> 00:45:38,360
And it is a project to help save the humble Swift bird, not the language, the bird.
736
00:45:38,360 --> 00:45:46,520
It is a project which is, the package can add a link to the website and a little badge
737
00:45:46,520 --> 00:45:52,080
into your about screen or wherever you want in your application.
738
00:45:52,080 --> 00:45:58,240
And what they're doing is they're trying to save the Swift.
739
00:45:58,240 --> 00:46:04,840
Yeah, in the UK, numbers of Swifts have plummeted by 66% in the past 30 years and the species
740
00:46:04,840 --> 00:46:07,560
is globally threatened.
741
00:46:07,560 --> 00:46:16,120
So it would be a terrible shame if the birds with which our favorite language is named
742
00:46:16,120 --> 00:46:19,520
after were to become endangered.
743
00:46:19,520 --> 00:46:24,040
And so it's great to see this project, great to see Rob take this initiative and get this
744
00:46:24,040 --> 00:46:25,680
up and running.
745
00:46:25,680 --> 00:46:30,440
And even if you don't integrate the package into your application, check out the website
746
00:46:30,440 --> 00:46:34,240
and get involved with what they're doing there.
747
00:46:34,240 --> 00:46:36,520
Save the Swifts.
748
00:46:36,520 --> 00:46:37,520
Swift for Swifts.org.
749
00:46:37,520 --> 00:46:44,640
And we'll include links to that in the show notes and also various links to the Cocoa
750
00:46:44,640 --> 00:46:50,120
Pods announcements if you need the kind of official timeline.
751
00:46:50,120 --> 00:46:55,160
Just so that we actually do mention the date, what's the date of the maintenance switchover?
752
00:46:55,160 --> 00:46:57,840
December of next year.
753
00:46:57,840 --> 00:46:59,640
That's the final turn off.
754
00:46:59,640 --> 00:47:00,640
So a year.
755
00:47:00,640 --> 00:47:03,680
And then there was a kind of a test in November, right?
756
00:47:03,680 --> 00:47:05,360
Yeah, that's my plan.
757
00:47:05,360 --> 00:47:06,360
Yeah, wonderful.
758
00:47:06,360 --> 00:47:07,360
All right.
759
00:47:07,360 --> 00:47:12,240
Well, thank you so much for your time, Orta, for coming on and talking all about this.
760
00:47:12,240 --> 00:47:14,280
And thank you so much as well.
761
00:47:14,280 --> 00:47:19,360
Not just to you, but to the whole team and whoever contributed to Cocoa Pods over the
762
00:47:19,360 --> 00:47:20,360
years.
763
00:47:20,360 --> 00:47:24,680
It was an incredible tool that revolutionized iOS development.
764
00:47:24,680 --> 00:47:25,680
It really did.
765
00:47:25,680 --> 00:47:26,680
Yeah, I agree.
766
00:47:26,680 --> 00:47:27,680
It was fun.
767
00:47:27,680 --> 00:47:28,680
I'm glad it's had its time.
768
00:47:28,680 --> 00:47:29,680
Thank you, Orta.
769
00:47:29,680 --> 00:47:30,680
All right.
770
00:47:30,680 --> 00:47:31,680
And we'll be back in a few weeks.
771
00:47:31,680 --> 00:47:32,680
So we'll speak to you then.
772
00:47:32,680 --> 00:47:33,680
All right.
773
00:47:33,680 --> 00:47:34,680
See you next time.
774
00:47:34,680 --> 00:47:35,680
Thank you for having me.
775
00:47:35,680 --> 00:47:36,680
All right.
776
00:47:36,680 --> 00:47:37,680
Take care.
777
00:47:37,680 --> 00:47:37,680
Bye bye.
778
00:47:37,680 --> 00:47:42,680
Bye bye.
00:00:00,001 --> 00:00:04,800
So it's been a little while since we've actually done an episode, right Sven?
2
00:00:04,800 --> 00:00:06,400
It's been a little bit of a...
3
00:00:06,400 --> 00:00:07,400
It's been a minute.
4
00:00:07,400 --> 00:00:09,080
A little bit of a break in the system.
5
00:00:09,080 --> 00:00:15,160
I've been away on holiday, just got back, and we've been fairly busy with other things.
6
00:00:15,160 --> 00:00:16,320
So we're on a...
7
00:00:16,320 --> 00:00:20,560
This is the end of a little bit of a hiatus on the podcast.
8
00:00:20,560 --> 00:00:21,280
Yeah.
9
00:00:21,280 --> 00:00:28,200
So, and as you maybe have heard then, we have a new voice on the podcast this episode.
10
00:00:28,200 --> 00:00:38,480
We have a guest on this week's episode, Orta Thurrox, who I'm sure needs no introduction,
11
00:00:38,480 --> 00:00:41,320
but just in case, would you like to introduce yourself, Orta?
12
00:00:41,320 --> 00:00:48,200
Yeah, I guess I was sort of there at the beginning of the iOS community, I guess, and sort of
13
00:00:48,200 --> 00:00:52,400
built out a lot of the foundational ideas and sort of hung out with a lot of people
14
00:00:52,400 --> 00:00:56,040
trying to do odd things and share code of each other.
15
00:00:56,040 --> 00:01:02,520
So people might know me from CocoaPods or from Danger, at least in this space.
16
00:01:02,520 --> 00:01:05,960
I guess we were some of the first people to experiment trying to build production apps
17
00:01:05,960 --> 00:01:06,960
with Swift.
18
00:01:06,960 --> 00:01:09,720
So like Swift version one and two.
19
00:01:09,720 --> 00:01:12,480
And we did some pretty intense write-ups on how to do that.
20
00:01:12,480 --> 00:01:17,400
And I helped make it possible for getting Swift to run in CocoaPods at all, which was
21
00:01:17,400 --> 00:01:19,200
quite a lot of work.
22
00:01:19,200 --> 00:01:22,640
I mean, I think it really was a...
23
00:01:22,640 --> 00:01:26,960
It was a time when lots of problems needed solving, right?
24
00:01:26,960 --> 00:01:29,880
It was like a period where lots of...
25
00:01:29,880 --> 00:01:35,480
When Apple were not providing many solutions for community style problems.
26
00:01:35,480 --> 00:01:40,200
And so it usually required someone to step up and to do the work themselves because they
27
00:01:40,200 --> 00:01:41,200
were still like a very...
28
00:01:41,200 --> 00:01:44,080
They were still trying to figure out the iOS SDK, I think, in my head.
29
00:01:44,080 --> 00:01:50,560
Whereas we were like, "I just want to share grabbing an image and putting it onto a flat
30
00:01:50,560 --> 00:01:51,560
surface somewhere."
31
00:01:51,560 --> 00:01:52,560
Right.
32
00:01:52,560 --> 00:01:53,560
Yeah.
33
00:01:53,560 --> 00:01:54,560
Well, it was...
34
00:01:54,560 --> 00:02:04,000
I mean, CocoaPods, especially, but also Danger, have both been incredibly influential tools
35
00:02:04,000 --> 00:02:10,520
in iOS development and macOS development over the years.
36
00:02:10,520 --> 00:02:15,840
And we are going to talk about those more, but I'd also be interested in a quick update
37
00:02:15,840 --> 00:02:17,320
on what you're up to these days.
38
00:02:17,320 --> 00:02:20,040
I know I'm going to preempt you slightly.
39
00:02:20,040 --> 00:02:22,200
I know what it is because I'm a big fan.
40
00:02:22,200 --> 00:02:31,680
I play Puzmo regularly, especially I like the crossword, which is the first crossword
41
00:02:31,680 --> 00:02:34,520
that I've ever stuck with.
42
00:02:34,520 --> 00:02:40,800
I've tried many crossword providers over the years and never really stuck with one.
43
00:02:40,800 --> 00:02:45,480
And Puzmo has grabbed me, which is great.
44
00:02:45,480 --> 00:02:55,040
I guess a TL;DR of my career is that I ran a mobile team doing iOS native, and we concluded
45
00:02:55,040 --> 00:03:00,640
that the set of abstractions that were provided by Apple were not probably optimal for the
46
00:03:00,640 --> 00:03:04,280
type of clients we were making.
47
00:03:04,280 --> 00:03:11,880
So we switched to React Native, and that just led me down into this JavaScript massive ecosystem,
48
00:03:11,880 --> 00:03:12,880
semi hellhole.
49
00:03:12,880 --> 00:03:17,760
And just before you carry on, just give people a quick rundown of what Puzmo is.
50
00:03:17,760 --> 00:03:18,760
Sure.
51
00:03:18,760 --> 00:03:19,760
Oh yeah.
52
00:03:19,760 --> 00:03:20,760
Puzmo itself.
53
00:03:20,760 --> 00:03:21,760
Yeah, I was going to get to that.
54
00:03:21,760 --> 00:03:22,760
Sorry.
55
00:03:22,760 --> 00:03:23,760
Yeah.
56
00:03:23,760 --> 00:03:26,880
But Puzmo itself is like a daily games platform.
57
00:03:26,880 --> 00:03:30,160
For a lot of people, that would just be, you'll have seen something like the New York Times
58
00:03:30,160 --> 00:03:33,180
games with crosswords and Wordle and things like that.
59
00:03:33,180 --> 00:03:35,640
We do that same type of thing.
60
00:03:35,640 --> 00:03:38,720
We're probably the biggest competitor to them at this point.
61
00:03:38,720 --> 00:03:43,800
And we have like a native app and lots of cool, interesting games that we build ourselves.
62
00:03:43,800 --> 00:03:44,800
That's great.
63
00:03:44,800 --> 00:03:46,520
Are you aware of Puzmo, Sven?
64
00:03:46,520 --> 00:03:47,520
I am.
65
00:03:47,520 --> 00:03:48,520
I followed it.
66
00:03:48,520 --> 00:03:52,600
I saw it come out, but I'm not really a puzzle gamer.
67
00:03:52,600 --> 00:03:56,200
This episode is fantastic because I don't have imposter syndrome.
68
00:03:56,200 --> 00:04:02,240
I'm straight up imposter because the last time I've actually used CocoaPods in earnest
69
00:04:02,240 --> 00:04:04,520
is more than 10 years ago.
70
00:04:04,520 --> 00:04:06,360
And even then it was tangential.
71
00:04:06,360 --> 00:04:07,360
I didn't set it up.
72
00:04:07,360 --> 00:04:10,320
I just kind of used it as part of the team.
73
00:04:10,320 --> 00:04:19,520
So I'm out of my depth today, but I'm going to have fun listening in mostly, I guess.
74
00:04:19,520 --> 00:04:23,400
That sounds really cool because it gives you a good insight that I think more and more
75
00:04:23,400 --> 00:04:29,400
people will have, which is that this is a tool that existed that has been around, but
76
00:04:29,400 --> 00:04:31,240
you don't necessarily need it.
77
00:04:31,240 --> 00:04:34,840
And so they don't actually know why it's a big deal that it's being deprecated and all
78
00:04:34,840 --> 00:04:35,840
these sort of things.
79
00:04:35,840 --> 00:04:36,840
Yeah.
80
00:04:36,840 --> 00:04:44,000
Well, I guess it's also testament to the tool in that I, at the time, I didn't have to set
81
00:04:44,000 --> 00:04:45,000
it up.
82
00:04:45,000 --> 00:04:47,760
I knew the basic commands I needed to run to update things.
83
00:04:47,760 --> 00:04:49,560
And then it wasn't really in the way.
84
00:04:49,560 --> 00:04:51,160
It was just there and did its job.
85
00:04:51,160 --> 00:04:53,880
That's actually the best thing you can say about the tool, right?
86
00:04:53,880 --> 00:04:54,880
Yeah.
87
00:04:54,880 --> 00:04:55,880
I mean, it is.
88
00:04:55,880 --> 00:05:00,240
At one point it was absolutely ubiquitous.
89
00:05:00,240 --> 00:05:06,640
But you're right that over the years since Swift Package Manager became a viable tool
90
00:05:06,640 --> 00:05:15,480
for building iOS and Mac apps, it has certainly become less ubiquitous.
91
00:05:15,480 --> 00:05:21,640
But it is a big deal that we're going to talk about today with it going into kind of maintenance
92
00:05:21,640 --> 00:05:25,840
mode because these tools live forever.
93
00:05:25,840 --> 00:05:31,960
Because unless there is a really good reason to switch, the things that are working tend
94
00:05:31,960 --> 00:05:40,320
to stay working and tend to just persist by default, don't they?
95
00:05:40,320 --> 00:05:41,920
It's like a build is fine.
96
00:05:41,920 --> 00:05:45,560
You know, if it continues to work, it's just a dependency.
97
00:05:45,560 --> 00:05:48,640
And for some people, they might even put their dependencies in their repo.
98
00:05:48,640 --> 00:05:54,200
And so you might not even ever use CocoaPods to actually do the updates anyway.
99
00:05:54,200 --> 00:06:00,440
That reminds me of a big, well not controversy, but a big talking point when CocoaPods was
100
00:06:00,440 --> 00:06:04,640
at its height was, do you commit your dependency sources or not?
101
00:06:04,640 --> 00:06:09,480
And at the time I was very much on the side of you should commit every source file that
102
00:06:09,480 --> 00:06:14,240
you need to build your application because there's no guarantee that it will be there
103
00:06:14,240 --> 00:06:17,560
in the future if you need to rebuild.
104
00:06:17,560 --> 00:06:22,800
But actually with Swift Package Manager, making that probably a little bit more difficult
105
00:06:22,800 --> 00:06:26,760
than it was with CocoaPods.
106
00:06:26,760 --> 00:06:32,240
I certainly don't do that anymore and I don't think many people do, but that problem still
107
00:06:32,240 --> 00:06:33,240
exists.
108
00:06:33,240 --> 00:06:38,120
Like you may have a project that you can never build again because that dependency source
109
00:06:38,120 --> 00:06:39,120
may have gone away.
110
00:06:39,120 --> 00:06:44,720
Yeah, especially if it's distributed like CocoaPods and SPMR.
111
00:06:44,720 --> 00:06:52,000
There's no VC backed company or megacorp holding all your source code in a single place because
112
00:06:52,000 --> 00:06:53,800
it allows for many.
113
00:06:53,800 --> 00:06:56,920
Unless you count GitHub as that VC backed megacorp.
114
00:06:56,920 --> 00:07:05,560
Does SPM only support Git repos now?
115
00:07:05,560 --> 00:07:13,800
Swift Package Manager, well no, Swift Package Manager has full support for the registry
116
00:07:13,800 --> 00:07:18,200
specification that was defined and that works.
117
00:07:18,200 --> 00:07:22,120
And you can, there are multiple registries out there.
118
00:07:22,120 --> 00:07:25,800
You can do your own private registries if you want with various companies.
119
00:07:25,800 --> 00:07:30,800
JFrog, I think has one and I think Amazon has one as well.
120
00:07:30,800 --> 00:07:41,920
And there's also a mirror of all the packages in the Swift Package Index that's run by the
121
00:07:41,920 --> 00:07:53,560
Tuist folks who they run a registry that vends any package that's in the Swift Package Index.
122
00:07:53,560 --> 00:07:58,480
Well, also you don't even need a registry, just a different Git URL would work.
123
00:07:58,480 --> 00:08:02,160
So you're not tied to the GitHub Git based URLs.
124
00:08:02,160 --> 00:08:03,760
It could be GitLab or anything else.
125
00:08:03,760 --> 00:08:09,840
So in that sense, it's, you know, even without a registry, it is fully distributed.
126
00:08:09,840 --> 00:08:15,400
But we've kind of skirted around the main issue and I did mention it, but let's get
127
00:08:15,400 --> 00:08:20,400
to the meat of what we're about to talk about here, which is that CocoaPods, the CocoaPods
128
00:08:20,400 --> 00:08:28,160
team and Orta specifically have been posting for the last year and a bit on the CocoaPods
129
00:08:28,160 --> 00:08:35,240
blog about the fact that CocoaPods is going to enter maintenance mode shortly.
130
00:08:35,240 --> 00:08:39,720
So do you want to give us a quick rundown of what that means and what people need to
131
00:08:39,720 --> 00:08:42,600
be thinking about if they're still using it?
132
00:08:42,600 --> 00:08:43,600
Yeah.
133
00:08:43,600 --> 00:08:50,800
So I guess one way to think about it is, you know, CocoaPods, I think this was the first
134
00:08:50,800 --> 00:08:55,760
year where we didn't release an update to CocoaPods when there was an update to Xcode.
135
00:08:55,760 --> 00:08:56,760
Right.
136
00:08:56,760 --> 00:09:01,640
I don't think anything broke, which is actually kind of a really good news for the idea of
137
00:09:01,640 --> 00:09:07,920
sort of moving it towards a much more like it through maintenance mode version of the
138
00:09:07,920 --> 00:09:09,240
project.
139
00:09:09,240 --> 00:09:16,080
But generally speaking, you know, CocoaPods is a dependency manager and those dependencies,
140
00:09:16,080 --> 00:09:20,620
they are distributed in a similar way that you have the Swift package index.
141
00:09:20,620 --> 00:09:26,280
We have something called the CocoaPods trunk and the CocoaPods trunk is sort of like an
142
00:09:26,280 --> 00:09:31,600
authentication process that gives us the ability to say, hey, this person owns this exact name.
143
00:09:31,600 --> 00:09:36,360
Because CocoaPods was like before the era of let's just rely entirely on GitHub for
144
00:09:36,360 --> 00:09:38,560
all our dependency managers.
145
00:09:38,560 --> 00:09:42,880
I think it still has support for subversion and things like that inside it.
146
00:09:42,880 --> 00:09:43,880
Really, right?
147
00:09:43,880 --> 00:09:44,880
Yeah.
148
00:09:44,880 --> 00:09:50,640
And it's got like, we made it so that there was a single namespace basically.
149
00:09:50,640 --> 00:09:57,760
So you know, there would be the pod a la stack view, so auto stack view.
150
00:09:57,760 --> 00:10:02,080
And that wouldn't be like, you have to go find this repo with that one.
151
00:10:02,080 --> 00:10:04,720
It would be straight up like you have to go to a central index.
152
00:10:04,720 --> 00:10:10,560
It will tell you when you from that index where you can go and find the Git repo.
153
00:10:10,560 --> 00:10:18,720
And so that central piece of technology is sort of both the biggest, the bit that makes
154
00:10:18,720 --> 00:10:25,200
a lot of the system easy to use, but at the same time, it's the bit of the system that
155
00:10:25,200 --> 00:10:31,040
has the highest attack surface for people that want to sort of do security research
156
00:10:31,040 --> 00:10:34,120
and do like black hat hacking.
157
00:10:34,120 --> 00:10:37,640
Because there's a huge amount of work going on in that space at the moment to try and
158
00:10:37,640 --> 00:10:43,400
find out what are the holes in the sort of dependency tree for people.
159
00:10:43,400 --> 00:10:50,200
Because if you can get some code, sneakily shipped into an iOS app that's used by millions
160
00:10:50,200 --> 00:10:54,800
of people, you could get that there's a lot of value in that in terms of like selling
161
00:10:54,800 --> 00:10:56,560
that exploit to people.
162
00:10:56,560 --> 00:10:57,560
Yes.
163
00:10:57,560 --> 00:11:01,000
And this has happened in many ways over the years.
164
00:11:01,000 --> 00:11:03,640
Not not has it ever happened through CocoaPods?
165
00:11:03,640 --> 00:11:07,560
I know it's happened through compromised versions of Xcode.
166
00:11:07,560 --> 00:11:11,680
Yeah, compromised versions of Xcode is what killed Xcode plugins back in the day.
167
00:11:11,680 --> 00:11:18,080
Yeah, I would say no one has ever done it through CocoaPods, especially not at scale,
168
00:11:18,080 --> 00:11:19,080
right?
169
00:11:19,080 --> 00:11:21,400
You can't build up a CocoaPod pretending to be another one.
170
00:11:21,400 --> 00:11:25,600
So like Alamo Fire is pretty famous.
171
00:11:25,600 --> 00:11:31,520
And so you could make Alamo Fire where the I is an L and you can persuade people that
172
00:11:31,520 --> 00:11:33,240
like that is the real one.
173
00:11:33,240 --> 00:11:34,840
But that's not like a scale attack.
174
00:11:34,840 --> 00:11:40,480
But the most we've ever had has been like security researchers after finding an effective
175
00:11:40,480 --> 00:11:47,520
bug going in and making like post install scripts on existing pods to be like, so they
176
00:11:47,520 --> 00:11:54,760
can count how many people are vulnerable to the exploit they just found, which is which
177
00:11:54,760 --> 00:12:00,120
was very worrying the two times that this happened and is now impossible to happen.
178
00:12:00,120 --> 00:12:04,880
But right, those are the only things that have really ever happened with CocoaPods at
179
00:12:04,880 --> 00:12:05,880
scale.
180
00:12:05,880 --> 00:12:12,280
And so would you say that that is was the primary driver to making the transition into
181
00:12:12,280 --> 00:12:18,640
maintenance mode that as the project became less, I'm putting words in your mouth here,
182
00:12:18,640 --> 00:12:25,040
as the project became less used, and therefore less maintained and less updated, that there
183
00:12:25,040 --> 00:12:26,880
were less eyes on it?
184
00:12:26,880 --> 00:12:28,760
And is that what drove the decision?
185
00:12:28,760 --> 00:12:33,640
Yeah, in part, like I'm a bit tired of dealing with the security researchers.
186
00:12:33,640 --> 00:12:41,280
I got one yesterday, for example, there was like a real I'd say it's a real it's a real
187
00:12:41,280 --> 00:12:42,280
possible vulnerability.
188
00:12:42,280 --> 00:12:47,640
And there's lots of people that are very financially incentivized to find these holes.
189
00:12:47,640 --> 00:12:48,640
Yes.
190
00:12:48,640 --> 00:12:54,840
And so, you know, we have to come out, I have to go through the full security like process.
191
00:12:54,840 --> 00:12:57,320
And that usually takes a day or two of my of my time.
192
00:12:57,320 --> 00:12:58,680
And then we do a fix as well.
193
00:12:58,680 --> 00:13:04,200
And then if it's something that I would consider like, very bad, then I would do a write up
194
00:13:04,200 --> 00:13:05,680
and do all the work.
195
00:13:05,680 --> 00:13:08,880
And we had a few of those in the last two years.
196
00:13:08,880 --> 00:13:14,120
And they just have not feeling great about all of it.
197
00:13:14,120 --> 00:13:19,200
And then one of the other engineers that contributes a lot was like, maybe an answer is not to
198
00:13:19,200 --> 00:13:21,280
shut down, but to go read only.
199
00:13:21,280 --> 00:13:22,280
Right.
200
00:13:22,280 --> 00:13:27,680
Which I thought was like a really elegant solution to the problem of like, we don't
201
00:13:27,680 --> 00:13:33,960
want to necessarily even have the access to be able to say, hey, you are his, you have
202
00:13:33,960 --> 00:13:40,840
access to upload the Facebook SDK, which I'm sure is used massively.
203
00:13:40,840 --> 00:13:44,600
And so if we can get to a point where they are self hosting, because they have their
204
00:13:44,600 --> 00:13:49,120
own incentives to go to Swift Package Manager over the time, then that's probably the right
205
00:13:49,120 --> 00:13:50,120
pattern for us.
206
00:13:50,120 --> 00:13:55,920
And it's a very thankless task to be the person who has to deal with those security problems
207
00:13:55,920 --> 00:13:57,680
and maintenance issues.
208
00:13:57,680 --> 00:14:04,560
And I know that I have been incredibly grateful over the years for all of the work that the
209
00:14:04,560 --> 00:14:06,120
entire team has put in.
210
00:14:06,120 --> 00:14:12,200
And actually, we got a couple of thank yous off, we posted yesterday on social media for
211
00:14:12,200 --> 00:14:13,200
questions and stuff.
212
00:14:13,200 --> 00:14:18,120
And several people said, thank you for all of your work, not just yours, but the whole
213
00:14:18,120 --> 00:14:20,920
team's work over the years.
214
00:14:20,920 --> 00:14:26,160
But actually, I think it is fair to call you out specifically, because you have taken that
215
00:14:26,160 --> 00:14:28,760
responsibility for those security issues going forward.
216
00:14:28,760 --> 00:14:35,240
And I think everybody who's been involved, you know, this project has been a wonderful,
217
00:14:35,240 --> 00:14:41,000
positive influence on the iOS and macOS development community over the years.
218
00:14:41,000 --> 00:14:46,400
And I certainly would love to say, you know, thank you publicly to all of you for that
219
00:14:46,400 --> 00:14:47,400
work.
220
00:14:47,400 --> 00:14:49,120
You know, it's amazing.
221
00:14:49,120 --> 00:14:50,120
Thank you.
222
00:14:50,120 --> 00:14:56,120
It's interesting, because you come from an iOS/macOS background.
223
00:14:56,120 --> 00:15:01,720
And so, and obviously are deeply involved in the Swift Package Manager community.
224
00:15:01,720 --> 00:15:06,560
But like, Cocoapods is getting more downloads now than it ever has by far.
225
00:15:06,560 --> 00:15:10,760
It's like significantly bigger than it previously was.
226
00:15:10,760 --> 00:15:13,160
That was going to be a question I was going to ask later.
227
00:15:13,160 --> 00:15:16,800
But that is fascinating.
228
00:15:16,800 --> 00:15:19,200
Can you quantify that at all?
229
00:15:19,200 --> 00:15:22,000
Yeah, I mean, I did once.
230
00:15:22,000 --> 00:15:29,120
I use a website called Ruby Toolbox to generally get a general sense of where everything is
231
00:15:29,120 --> 00:15:30,920
going in terms of dependency-wise.
232
00:15:30,920 --> 00:15:31,920
So there we go.
233
00:15:31,920 --> 00:15:32,920
It's loading up.
234
00:15:32,920 --> 00:15:39,960
But yeah, and it's still getting, you know, back when we all thought that Cocoapods was
235
00:15:39,960 --> 00:15:46,000
effectively dead, which I guess would have been maybe 2020, it sort of doubled in traffic
236
00:15:46,000 --> 00:15:48,600
since then, for example.
237
00:15:48,600 --> 00:15:57,160
And I put that towards a very simple one, which is that like Flutter and React Native
238
00:15:57,160 --> 00:16:00,560
are very, very big ecosystems.
239
00:16:00,560 --> 00:16:01,560
Yeah.
240
00:16:01,560 --> 00:16:04,320
Well, that's interesting.
241
00:16:04,320 --> 00:16:08,600
You mentioned React Native, because one of the questions we had on social media was from
242
00:16:08,600 --> 00:16:10,960
John Stube.
243
00:16:10,960 --> 00:16:15,440
And his question was, what's the impact on React Native with this news?
244
00:16:15,440 --> 00:16:18,720
Will React Native going to finally switch over to SPM?
245
00:16:18,720 --> 00:16:23,600
And I know you probably can't answer that question, but do you have any opinion on that?
246
00:16:23,600 --> 00:16:26,520
Yeah, I can read the pull requests.
247
00:16:26,520 --> 00:16:31,240
They know to DM me because I helped build the Cocoapods integration that is in React
248
00:16:31,240 --> 00:16:32,240
Native today.
249
00:16:32,240 --> 00:16:33,240
Right, right.
250
00:16:33,240 --> 00:16:38,040
So generally, yes, people are working on it.
251
00:16:38,040 --> 00:16:44,280
And we gave a two year, like, here's our deprecation route.
252
00:16:44,280 --> 00:16:49,280
But at heart, the interesting thing about something like React Native and Flutter are
253
00:16:49,280 --> 00:16:54,120
that you don't necessarily use Cocoapods as your main dependency manager.
254
00:16:54,120 --> 00:16:59,040
You would use like, I don't know what they use in Flutter, but, you know, NPM is the
255
00:16:59,040 --> 00:17:00,760
big one in the React Native world.
256
00:17:00,760 --> 00:17:06,760
And so people aren't actually using the Cocoapods trunk to get these dependencies.
257
00:17:06,760 --> 00:17:10,720
These dependencies are coming in through their node modules.
258
00:17:10,720 --> 00:17:15,240
So like an NPM dependency they've got that includes the Cocoapods pod spec.
259
00:17:15,240 --> 00:17:19,600
And so it's sort of like they're actually vending their own dependencies in a different
260
00:17:19,600 --> 00:17:21,000
dependency manager.
261
00:17:21,000 --> 00:17:26,680
And it may well be that like, when we turn it to be read-only, that it actually doesn't
262
00:17:26,680 --> 00:17:30,640
affect them at all because they're not using Cocoapods to vend their dependencies.
263
00:17:30,640 --> 00:17:33,800
Do you get what I mean?
264
00:17:33,800 --> 00:17:36,160
Let's elaborate on that a little bit.
265
00:17:36,160 --> 00:17:45,360
I am a React Native project user and I have a dependency that's called React Native Navigation,
266
00:17:45,360 --> 00:17:46,360
right?
267
00:17:46,360 --> 00:17:51,160
It's like something that wraps a UI navigation controller and gives you like some infrastructure
268
00:17:51,160 --> 00:17:53,160
for doing that in JavaScript.
269
00:17:53,160 --> 00:17:54,160
Okay.
270
00:17:54,160 --> 00:17:59,960
If I include that dependency in my NPM project, right, which is a separate dependency manager,
271
00:17:59,960 --> 00:18:04,880
it's going to put a file in a folder that's called React Native Navigation.
272
00:18:04,880 --> 00:18:12,460
And the Cocoapods integration for React Native will look inside the NPM folder first.
273
00:18:12,460 --> 00:18:15,320
So you will not go into like a pod file.
274
00:18:15,320 --> 00:18:18,960
In fact, I don't know if by default it even ships with a pod file.
275
00:18:18,960 --> 00:18:21,840
It's sort of one that auto-generate is generated for you.
276
00:18:21,840 --> 00:18:22,840
Interesting.
277
00:18:22,840 --> 00:18:27,680
And so you're not actually asking for the original things from the Cocoapods registry.
278
00:18:27,680 --> 00:18:30,960
You're just using the ones that have come in from your existing dependencies.
279
00:18:30,960 --> 00:18:31,960
That's really interesting.
280
00:18:31,960 --> 00:18:38,000
So eventually the impact on React Native may not be what people are expecting.
281
00:18:38,000 --> 00:18:39,680
I would expect so.
282
00:18:39,680 --> 00:18:42,040
I'm sure there's edge cases because there always will be.
283
00:18:42,040 --> 00:18:44,240
Of course, there's always edge cases.
284
00:18:44,240 --> 00:18:45,240
Yeah.
285
00:18:45,240 --> 00:18:46,240
Yep.
286
00:18:46,240 --> 00:18:49,040
What does Cocoapods actually do in that case for React Native?
287
00:18:49,040 --> 00:18:53,960
Is it sort of just to bootstrap and very rarely update it in case something at the top level
288
00:18:53,960 --> 00:18:57,000
changes or what's the point of all this then?
289
00:18:57,000 --> 00:19:07,320
Well, React Native, the team aren't that interested in building out all of the Xcode level integration
290
00:19:07,320 --> 00:19:08,320
stuff.
291
00:19:08,320 --> 00:19:12,640
So they want to be operating in JavaScript ecosystem and the same with the Flutter.
292
00:19:12,640 --> 00:19:18,480
So when you want a new library, then because it's all Ruby and very dynamic, then it can
293
00:19:18,480 --> 00:19:22,600
just look up the folder file system to see if there's any pod specs and then say, "Hey,
294
00:19:22,600 --> 00:19:25,400
that's one that should be defined in the pod file."
295
00:19:25,400 --> 00:19:26,400
Right.
296
00:19:26,400 --> 00:19:32,280
So it's really a scaffolding tool rather than a dependency manager and that they just
297
00:19:32,280 --> 00:19:38,240
sort of piggybacking onto the setup procedure and the discovery paths within the project
298
00:19:38,240 --> 00:19:41,400
rather than managing actual dependencies.
299
00:19:41,400 --> 00:19:42,400
Is that about right?
300
00:19:42,400 --> 00:19:43,400
To some extent.
301
00:19:43,400 --> 00:19:50,760
I think that's close enough to be accurate, but it's also that sometimes those dependencies
302
00:19:50,760 --> 00:19:51,920
have dependencies, you know?
303
00:19:51,920 --> 00:19:57,520
And now suddenly you're having CocoaPods do the native dependencies and in the way that
304
00:19:57,520 --> 00:20:00,760
they might have Gradle do the native dependencies for Android too.
305
00:20:00,760 --> 00:20:01,760
Right.
306
00:20:01,760 --> 00:20:06,120
It's complicated, but these projects are really complicated at heart because they're trying
307
00:20:06,120 --> 00:20:08,120
to do something strange.
308
00:20:08,120 --> 00:20:09,120
Yeah.
309
00:20:09,120 --> 00:20:13,720
Well, I think that's a good chance to talk about another kind of huge question with this
310
00:20:13,720 --> 00:20:22,400
is are there cases that you're aware of where people, and I'm guessing this is going to
311
00:20:22,400 --> 00:20:28,640
be large companies, are unable to move away from CocoaPods?
312
00:20:28,640 --> 00:20:31,080
I'm sure you've heard stories over the years.
313
00:20:31,080 --> 00:20:39,400
Are those stories still coming in or are you expecting a kind of a quiet transition?
314
00:20:39,400 --> 00:20:44,480
So far on every blog post I have wrote, if you have problems with these timelines and
315
00:20:44,480 --> 00:20:47,080
things like that, then you're welcome to contact us.
316
00:20:47,080 --> 00:20:49,160
And I've not had a single contact.
317
00:20:49,160 --> 00:20:54,000
So I'm assuming right now everybody, I mean, two years is such a long time.
318
00:20:54,000 --> 00:20:56,440
You read a blog post and you're like, "Oh, we've got forever."
319
00:20:56,440 --> 00:20:57,440
Sure.
320
00:20:57,440 --> 00:20:58,440
We're at one year now.
321
00:20:58,440 --> 00:20:59,440
And then suddenly it's tomorrow, right?
322
00:20:59,440 --> 00:21:00,440
Yeah.
323
00:21:00,440 --> 00:21:08,400
So there's a chance that next year, sometime around November, like our plan is that sometime
324
00:21:08,400 --> 00:21:16,040
in November next year, trying to avoid that American holiday, Thanksgiving, we're going
325
00:21:16,040 --> 00:21:22,760
to do like a short term brownout, so make it for a week.
326
00:21:22,760 --> 00:21:26,000
You'll probably get a few emails that week.
327
00:21:26,000 --> 00:21:30,360
And then that gives you a month afterwards of finding out that you can't upload to CocoaPods
328
00:21:30,360 --> 00:21:34,680
that maybe you're going to have to make sure that that's okay in the next month.
329
00:21:34,680 --> 00:21:40,600
Yeah, I mean, I think one of the things that I've really admired about the process of this
330
00:21:40,600 --> 00:21:48,880
is how much notice you've given people that this is happening and how open you are to
331
00:21:48,880 --> 00:21:51,520
hearing about the problems that may be caused.
332
00:21:51,520 --> 00:21:57,240
And I'm happy to hear that you have not been swamped with emails and requests so far.
333
00:21:57,240 --> 00:22:01,680
And I think, I mean, it's been a long time.
334
00:22:01,680 --> 00:22:05,160
I know there are always edge cases, but it's been a long time, right?
335
00:22:05,160 --> 00:22:06,160
Yeah.
336
00:22:06,160 --> 00:22:10,280
So when I wrote that blog post about like us starting to do the support and maintenance
337
00:22:10,280 --> 00:22:16,480
plans, so that's like 2024, SPM had been around for nine years.
338
00:22:16,480 --> 00:22:18,920
Although not usable in iOS projects for nine years.
339
00:22:18,920 --> 00:22:19,920
Absolutely.
340
00:22:19,920 --> 00:22:24,640
I think in my head, it took three or four years to start being maybe more, just not
341
00:22:24,640 --> 00:22:26,080
being super useful.
342
00:22:26,080 --> 00:22:31,680
But, you know, for CocoaPods, from CocoaPods' perspective, the day that came out was like
343
00:22:31,680 --> 00:22:37,120
the end of the value of working on CocoaPods, generally speaking.
344
00:22:37,120 --> 00:22:38,120
Sure.
345
00:22:38,120 --> 00:22:44,520
And I think actually that was quite a harmful thing to the community that happened, that
346
00:22:44,520 --> 00:22:51,440
SPM came out and that definitely made a line in the sand of like, okay, Apple are doing
347
00:22:51,440 --> 00:22:53,120
dependency management.
348
00:22:53,120 --> 00:22:54,720
This is Swift dependency management.
349
00:22:54,720 --> 00:22:57,520
This is going to be the standard and blah, blah, blah.
350
00:22:57,520 --> 00:23:04,640
And then it wasn't actually usable in iOS and macOS projects for years afterwards.
351
00:23:04,640 --> 00:23:12,720
And I think that I won't try to speak for the Swift team, but I would imagine they have
352
00:23:12,720 --> 00:23:15,080
some regrets around how that happened.
353
00:23:15,080 --> 00:23:16,080
Yeah.
354
00:23:16,080 --> 00:23:18,800
It's one of those tricky problems, right?
355
00:23:18,800 --> 00:23:25,760
Because they had to release a build for Linux as Swift, otherwise they were just like releasing
356
00:23:25,760 --> 00:23:30,160
another Apple language and the rest of the world was not going to take much attention.
357
00:23:30,160 --> 00:23:32,640
And so they needed something.
358
00:23:32,640 --> 00:23:33,640
Yes.
359
00:23:33,640 --> 00:23:39,200
But like framing it as the package manager may indeed have really shot them in the foot
360
00:23:39,200 --> 00:23:40,200
for a little bit.
361
00:23:40,200 --> 00:23:44,080
A little bit being it was quite a while.
362
00:23:44,080 --> 00:23:45,080
Yeah.
363
00:23:45,080 --> 00:23:46,080
Yeah.
364
00:23:46,080 --> 00:23:48,040
I mean, these decisions are never simple.
365
00:23:48,040 --> 00:23:52,000
There's always more to it than is on the surface.
366
00:23:52,000 --> 00:23:59,920
But yes, it was a slightly messy time for how is dependency management going to look
367
00:23:59,920 --> 00:24:04,360
on for Swift around that time.
368
00:24:04,360 --> 00:24:09,760
And I can see that as somebody who, well, the whole team has probably felt the same
369
00:24:09,760 --> 00:24:14,840
way, is, well, why are we putting all of our time and effort into this project when it's
370
00:24:14,840 --> 00:24:17,760
going to be deprecated at some point?
371
00:24:17,760 --> 00:24:22,880
I used to frame my work on CocoaPods as being like, it's like a tentpole project for the
372
00:24:22,880 --> 00:24:23,880
community.
373
00:24:23,880 --> 00:24:27,760
Like any work you do raises the tent and makes everything a little bit bigger for everybody
374
00:24:27,760 --> 00:24:30,680
to be able to do cool stuff on.
375
00:24:30,680 --> 00:24:35,000
And then slowly it just started to not be as valuable.
376
00:24:35,000 --> 00:24:42,240
And also like CocoaPods is built in a different technology stack than the majority of the
377
00:24:42,240 --> 00:24:44,520
work you do on your iOS work.
378
00:24:44,520 --> 00:24:50,120
And I think what we found is the people that started working on CocoaPods stopped building
379
00:24:50,120 --> 00:24:55,600
iOS apps quite quickly because of the skills that they got doing this ended up being really
380
00:24:55,600 --> 00:24:56,600
interesting.
381
00:24:56,600 --> 00:24:58,520
And off they went into the Ruby world.
382
00:24:58,520 --> 00:24:59,520
Yes, exactly.
383
00:24:59,520 --> 00:25:00,520
Yeah.
384
00:25:00,520 --> 00:25:01,520
Yeah.
385
00:25:01,520 --> 00:25:03,120
I can, I can certainly see that.
386
00:25:03,120 --> 00:25:04,120
Yeah.
387
00:25:04,120 --> 00:25:10,680
This would all have been different if there was a Ruby SDK to build iOS apps, I suppose.
388
00:25:10,680 --> 00:25:13,560
Which I think there was, wasn't there a MacOS thing?
389
00:25:13,560 --> 00:25:15,840
There was, yeah, there was.
390
00:25:15,840 --> 00:25:16,840
Yeah.
391
00:25:16,840 --> 00:25:17,840
RubyMotion.
392
00:25:17,840 --> 00:25:19,600
That's what it was called.
393
00:25:19,600 --> 00:25:20,600
Yeah.
394
00:25:20,600 --> 00:25:21,600
Yeah.
395
00:25:21,600 --> 00:25:22,600
There was a Python one as well, right?
396
00:25:22,600 --> 00:25:24,360
Oh, there was an official one.
397
00:25:24,360 --> 00:25:26,680
Ruby Cocoa was built into the Mac.
398
00:25:26,680 --> 00:25:28,240
That was, that was one of the originals.
399
00:25:28,240 --> 00:25:30,000
That was my first job.
400
00:25:30,000 --> 00:25:31,000
My first programming job.
401
00:25:31,000 --> 00:25:32,000
How was it?
402
00:25:32,000 --> 00:25:33,000
Was it really?
403
00:25:33,000 --> 00:25:35,440
Tell us about your first programming job then.
404
00:25:35,440 --> 00:25:45,360
I went and moved out to Brazil and did a sort of, worked on a blogging client that was like,
405
00:25:45,360 --> 00:25:49,440
you know, it supported Tumblr, it supported WordPress.
406
00:25:49,440 --> 00:25:56,320
And the guy that did it was like a Ruby fanaticist and would refuse to do anything else.
407
00:25:56,320 --> 00:25:59,920
So he was like, we are going to figure out how to make this work.
408
00:25:59,920 --> 00:26:04,400
And it was good, but it was not good enough to be fully production worthy.
409
00:26:04,400 --> 00:26:08,680
Which is why RubyMotion ended up coming out of, like the guy that wrote that in Apple,
410
00:26:08,680 --> 00:26:13,480
eventually Laurent Sansonetti, he moved out of Apple and turned it into a startup.
411
00:26:13,480 --> 00:26:15,360
That was RubyMotion, the one that everybody had heard of.
412
00:26:15,360 --> 00:26:17,120
And that was RubyMotion, of course it was.
413
00:26:17,120 --> 00:26:18,120
Yes.
414
00:26:18,120 --> 00:26:24,920
I remember that Laurent used to work for Apple, but I'd forgotten that he'd come away and
415
00:26:24,920 --> 00:26:26,560
tried to do that as a startup.
416
00:26:26,560 --> 00:26:27,560
Yeah.
417
00:26:27,560 --> 00:26:28,560
Is it still going?
418
00:26:28,560 --> 00:26:29,560
I presume it's not.
419
00:26:29,560 --> 00:26:30,560
It's not.
420
00:26:30,560 --> 00:26:35,200
It's not NVIDIA now, but Alloy is like the original creator of CocoaPods.
421
00:26:35,200 --> 00:26:39,440
I'm just the guy that came like a few months down the line and said, this is a good idea.
422
00:26:39,440 --> 00:26:41,560
He worked on RubyMotion.
423
00:26:41,560 --> 00:26:46,960
So he ended up like, ended up back in this world of like runtime engine stuff before
424
00:26:46,960 --> 00:26:48,960
eventually coming to work with me at Artsy.
425
00:26:48,960 --> 00:26:49,960
Right.
426
00:26:49,960 --> 00:26:50,960
Okay.
427
00:26:50,960 --> 00:26:51,960
Right.
428
00:26:51,960 --> 00:26:52,960
There you go.
429
00:26:52,960 --> 00:26:53,960
Small world.
430
00:26:53,960 --> 00:26:54,960
It is.
431
00:26:54,960 --> 00:26:58,200
And certainly it was a very close knit community of the CocoaPods people, wasn't it?
432
00:26:58,200 --> 00:27:01,560
We don't like, you know, you get to a point and people invite you to conferences and then
433
00:27:01,560 --> 00:27:04,760
you go to the conference and you meet all the other people that are working on it because
434
00:27:04,760 --> 00:27:07,560
there's always something interesting in that space.
435
00:27:07,560 --> 00:27:12,040
So we had a couple more questions off the social media posts, which we should probably
436
00:27:12,040 --> 00:27:13,640
get to.
437
00:27:13,640 --> 00:27:19,320
One from Kali Coding said, there are other tools, for example, Fastlane that rely on
438
00:27:19,320 --> 00:27:23,720
the Xcode project gem from CocoaPods, but this gem has not kept up to date with the
439
00:27:23,720 --> 00:27:25,640
latest Xcode project file changes.
440
00:27:25,640 --> 00:27:28,640
Specifically, it doesn't support buildable folders.
441
00:27:28,640 --> 00:27:33,080
Is this gem also being put into maintenance mode and will that also carry over to Fastlane?
442
00:27:33,080 --> 00:27:35,400
Now, I appreciate you're not the maintainer of Fastlane.
443
00:27:35,400 --> 00:27:38,680
We should maybe get Josh on to answer that question.
444
00:27:38,680 --> 00:27:42,800
But I wondered if you had any thoughts on that.
445
00:27:42,800 --> 00:27:48,040
I think I honestly never considered it until this just came up.
446
00:27:48,040 --> 00:27:53,400
But like, it's not mine to give away, but it's also like, yeah, I don't see a reason
447
00:27:53,400 --> 00:27:56,920
why we couldn't just decouple it from the CocoaPods infrastructure and make it available
448
00:27:56,920 --> 00:27:57,920
for people.
449
00:27:57,920 --> 00:27:58,920
It in itself has value.
450
00:27:58,920 --> 00:28:06,720
And of course that gem can still be maintained under, or is that gem also going to be made
451
00:28:06,720 --> 00:28:07,720
archived?
452
00:28:07,720 --> 00:28:10,720
Is that going to be, is there a plan to archive that gem?
453
00:28:10,720 --> 00:28:17,280
The only plan officially is to make trunk read only.
454
00:28:17,280 --> 00:28:21,960
But the reality I think of the situation is Xcode project is used in more than just CocoaPods.
455
00:28:21,960 --> 00:28:26,480
And so I think it is more valid to move it to be able to be supported by a team that
456
00:28:26,480 --> 00:28:28,280
would actually support it.
457
00:28:28,280 --> 00:28:36,360
Well, Josh, if you're listening, drop us an email and we'll, I mean, I'm sure you and
458
00:28:36,360 --> 00:28:39,480
Josh have talked many, many times over the years, right?
459
00:28:39,480 --> 00:28:41,640
Yeah, yeah, yeah.
460
00:28:41,640 --> 00:28:48,360
Josh is part of why I'm recommending my Swift package later on down the line.
461
00:28:48,360 --> 00:28:49,360
Teases for later.
462
00:28:49,360 --> 00:28:50,360
Don't spoil it.
463
00:28:50,360 --> 00:28:58,760
Another question here from Alexander Steiner.
464
00:28:58,760 --> 00:29:01,120
Is there anything you would have done differently in hindsight?
465
00:29:01,120 --> 00:29:02,120
That's a great question.
466
00:29:02,120 --> 00:29:03,120
This is interesting.
467
00:29:03,120 --> 00:29:11,360
Like, because there's tons of things that I think that is fun to do on a community of
468
00:29:11,360 --> 00:29:14,120
the size that we have for CocoaPods.
469
00:29:14,120 --> 00:29:18,440
Like I used to spend a lot of time building really interesting statistics and try and
470
00:29:18,440 --> 00:29:20,680
like generate all this.
471
00:29:20,680 --> 00:29:25,160
We have like interesting analytics that were like unique within dependency managers because
472
00:29:25,160 --> 00:29:32,160
we weren't just relying on whether it was, you know, seen or dependent on what its dependencies
473
00:29:32,160 --> 00:29:33,160
were.
474
00:29:33,160 --> 00:29:39,840
I've been really interested in like, I think there's something really cool about having
475
00:29:39,840 --> 00:29:47,120
a small set of dependencies and having authors be able to say like, I trust this person and
476
00:29:47,120 --> 00:29:50,480
being able to make web of trust around dependencies.
477
00:29:50,480 --> 00:29:52,480
So it'd be like, I trust Dave Verwer.
478
00:29:52,480 --> 00:29:56,320
Dave Verwer has said that he has read the software Llama Fire.
479
00:29:56,320 --> 00:29:57,320
Yeah, yeah, exactly.
480
00:29:57,320 --> 00:30:00,920
I get to choose to make those mistakes.
481
00:30:00,920 --> 00:30:02,600
And that's kind of fun.
482
00:30:02,600 --> 00:30:09,400
I'd love to see like a web of trust system built on top of CocoaPods' dependencies.
483
00:30:09,400 --> 00:30:14,600
And I would have loved to have the technology I have today to be able to like redo a lot
484
00:30:14,600 --> 00:30:17,000
of the analytics pipelines and things like that.
485
00:30:17,000 --> 00:30:22,240
Back then it was like unbearably expensive to be able to generate analytics for people
486
00:30:22,240 --> 00:30:23,960
on their pods.
487
00:30:23,960 --> 00:30:33,000
But today I have a self-hosted system that uses Clickhouse that is honestly, you know,
488
00:30:33,000 --> 00:30:37,000
the same quality as the one that I had for CocoaPods for a while that cost a thousand
489
00:30:37,000 --> 00:30:39,200
dollars a month.
490
00:30:39,200 --> 00:30:41,960
And so some of that stuff I would have loved to do.
491
00:30:41,960 --> 00:30:46,120
But you know, for me, I'm super proud of the design work I did on CocoaPods.
492
00:30:46,120 --> 00:30:48,160
That's like some of my favorite stuff.
493
00:30:48,160 --> 00:30:50,720
And just like committing to something for such a long time.
494
00:30:50,720 --> 00:30:51,720
It's like, it's hard.
495
00:30:51,720 --> 00:30:56,160
It's been a decade or two, but it's been fun.
496
00:30:56,160 --> 00:31:02,800
Well certainly many aspects of CocoaPods were inspiration for what we built with the Swift
497
00:31:02,800 --> 00:31:09,800
Package Index, especially my favorite little bit of CocoaPods that shut down a long time
498
00:31:09,800 --> 00:31:14,880
before CocoaPods itself is going to transition to maintenance mode, but was CocoaDocs, which
499
00:31:14,880 --> 00:31:21,080
was the documentation hosting for, I think you used, what's the tool called?
500
00:31:21,080 --> 00:31:24,360
Beans with a J. Jazzy, Jazzy.
501
00:31:24,360 --> 00:31:28,640
I wanted to say Jazzy, but it's Jazzy.
502
00:31:28,640 --> 00:31:30,360
Oh, what was the original one?
503
00:31:30,360 --> 00:31:33,280
Well, Jazzy didn't support Objective-C projects.
504
00:31:33,280 --> 00:31:36,040
So I first built it with an Objective-C version of that.
505
00:31:36,040 --> 00:31:37,680
Oh, there you go.
506
00:31:37,680 --> 00:31:38,880
But yeah, I agree.
507
00:31:38,880 --> 00:31:40,400
No one else was attacking those types of problems.
508
00:31:40,400 --> 00:31:42,720
You need a centralized system to do that.
509
00:31:42,720 --> 00:31:43,720
Yeah.
510
00:31:43,720 --> 00:31:49,640
And yeah, so what we've built with Package Index having documentation hosting and what
511
00:31:49,640 --> 00:31:54,000
we consider very easy to enable documentation hosting, you just put a little configuration
512
00:31:54,000 --> 00:31:58,480
file in your project and we'll take care of everything else.
513
00:31:58,480 --> 00:32:04,080
That kind of problem is only possible when you've built the underlying infrastructure.
514
00:32:04,080 --> 00:32:09,520
In CocoaPods case, it was CocoaPods itself and in Swift Package Index, it was the index.
515
00:32:09,520 --> 00:32:11,840
And actually it's more than that.
516
00:32:11,840 --> 00:32:16,760
It's the index plus the build system because with DocC, you can't build the documentation
517
00:32:16,760 --> 00:32:18,680
until you've built the package.
518
00:32:18,680 --> 00:32:25,200
And so we were able to kind of tack that on with less work than it would have been if
519
00:32:25,200 --> 00:32:27,280
we hadn't had that build system.
520
00:32:27,280 --> 00:32:33,640
So CocoaPods has been hugely influential in what we've built with Package Index.
521
00:32:33,640 --> 00:32:34,640
So again, thank you for that.
522
00:32:34,640 --> 00:32:39,120
Yeah, it's cool to see people trying new things from the same ideas.
523
00:32:39,120 --> 00:32:42,120
Yeah, yeah, absolutely.
524
00:32:42,120 --> 00:32:48,320
In terms of other open source projects, are there any precedents for a project going read-only
525
00:32:48,320 --> 00:32:52,240
like this or kind of transitioning into a maintenance mode like this that you can talk
526
00:32:52,240 --> 00:32:53,240
about?
527
00:32:53,240 --> 00:32:54,240
Not to my knowledge.
528
00:32:54,240 --> 00:32:59,840
We spent some time trying to research this to see if there is good examples of people
529
00:32:59,840 --> 00:33:04,560
trying to move off dependency managers.
530
00:33:04,560 --> 00:33:07,400
And honestly, I couldn't find much.
531
00:33:07,400 --> 00:33:10,800
And that has made it kind of interesting.
532
00:33:10,800 --> 00:33:15,800
There's like discords where people that run dependency managers hang out.
533
00:33:15,800 --> 00:33:20,480
And there's also, we talked a little bit, I think with the Linux Foundation about what
534
00:33:20,480 --> 00:33:22,160
they've ever done in this space.
535
00:33:22,160 --> 00:33:30,160
But realistically, it's relatively unprecedented to turn a dependency manager read-only.
536
00:33:30,160 --> 00:33:37,840
And so it's funny to just be just doing it and just seeing where it goes step by step.
537
00:33:37,840 --> 00:33:44,560
But that's kind of why we gave it such a long process because if it takes two years, that's
538
00:33:44,560 --> 00:33:45,560
fine.
539
00:33:45,560 --> 00:33:48,000
Then someone might tell us where the problem is on route.
540
00:33:48,000 --> 00:33:51,440
But for now, it just seems to be that we're sort of operating in a new space.
541
00:33:51,440 --> 00:33:52,440
It's kind of surprising.
542
00:33:52,440 --> 00:33:55,440
There's so many projects out there.
543
00:33:55,440 --> 00:33:57,440
Do they just shut down?
544
00:33:57,440 --> 00:34:00,720
Well, I think a lot of them do actually.
545
00:34:00,720 --> 00:34:07,880
I think a lot of open source projects, when the maintainers move on, they actually don't
546
00:34:07,880 --> 00:34:08,880
even shut down.
547
00:34:08,880 --> 00:34:09,880
They just get abandoned.
548
00:34:09,880 --> 00:34:10,880
Yeah.
549
00:34:10,880 --> 00:34:11,880
Yeah.
550
00:34:11,880 --> 00:34:14,560
You're giving a lot of grace period there.
551
00:34:14,560 --> 00:34:20,360
I was wondering, is there anything you can think of or you might have thought of that
552
00:34:20,360 --> 00:34:24,360
might block people from moving off of CocoaPods to SwiftPM?
553
00:34:24,360 --> 00:34:29,360
Are there any features that are missing and that are hard to sort of replace?
554
00:34:29,360 --> 00:34:37,720
The hard part, and again, I don't know all of the modern features of Swift Package Manager,
555
00:34:37,720 --> 00:34:44,360
but it definitely used to be a case where adopting Swift Package Manager for a library
556
00:34:44,360 --> 00:34:50,800
like OpenCV was just kind of not really feasible because it required changing that file structure
557
00:34:50,800 --> 00:34:59,400
to fit and to be usable in a way where Xcode was a priority of the build system.
558
00:34:59,400 --> 00:35:04,680
And so you do, I think, have quite a few of these crazy C libraries that people use that
559
00:35:04,680 --> 00:35:06,920
may or may not be possible to migrate over.
560
00:35:06,920 --> 00:35:08,280
I'm not entirely sure.
561
00:35:08,280 --> 00:35:09,280
We were very build flexible.
562
00:35:09,280 --> 00:35:10,280
Right.
563
00:35:10,280 --> 00:35:12,160
So I don't have an answer for those.
564
00:35:12,160 --> 00:35:15,680
At the same time, if you were vending it, you may have the technical experience to be
565
00:35:15,680 --> 00:35:19,400
able to put it in your Xcode project, like natively.
566
00:35:19,400 --> 00:35:20,760
Maybe you're not updating so often.
567
00:35:20,760 --> 00:35:21,760
Right.
568
00:35:21,760 --> 00:35:24,280
That's my guess, but no one has said anything.
569
00:35:24,280 --> 00:35:25,280
Right.
570
00:35:25,280 --> 00:35:26,280
Right.
571
00:35:26,280 --> 00:35:29,640
And what happens after the maintenance period?
572
00:35:29,640 --> 00:35:30,640
Is that the end?
573
00:35:30,640 --> 00:35:32,360
Is that the end of it?
574
00:35:32,360 --> 00:35:38,160
I think we've been on such like a, again, because there was no releases this year.
575
00:35:38,160 --> 00:35:46,280
I think we're definitely at a point where people are not fully operating the machine.
576
00:35:46,280 --> 00:35:49,160
So I don't know.
577
00:35:49,160 --> 00:35:54,880
By removing the authentication and moving to be read-only, we effectively allow the
578
00:35:54,880 --> 00:36:01,000
key server to sort of, it doesn't need to turn off because it only costs a 10 or a month
579
00:36:01,000 --> 00:36:02,680
to operate.
580
00:36:02,680 --> 00:36:11,200
But I think trying to figure out, do we do updates to the CLI client to be like, you
581
00:36:11,200 --> 00:36:16,360
have touched a pod that came from KUKA.PODS's trunk.
582
00:36:16,360 --> 00:36:17,680
This will never get an update.
583
00:36:17,680 --> 00:36:19,720
Are you sure you want to do this?
584
00:36:19,720 --> 00:36:20,720
Yeah.
585
00:36:20,720 --> 00:36:21,720
Is probably something we're not going to do.
586
00:36:21,720 --> 00:36:22,720
I think that would be a good idea.
587
00:36:22,720 --> 00:36:23,720
Yeah.
588
00:36:23,720 --> 00:36:24,720
Yeah.
589
00:36:24,720 --> 00:36:25,720
I think that would be a good idea.
590
00:36:25,720 --> 00:36:28,040
Just so that those people see it every time they update.
591
00:36:28,040 --> 00:36:29,040
Yeah, exactly.
592
00:36:29,040 --> 00:36:34,920
And it might not be that often, but some people might be using a dependency that was built
593
00:36:34,920 --> 00:36:37,200
10 years ago and has never updated since.
594
00:36:37,200 --> 00:36:38,400
And it was probably just fine.
595
00:36:38,400 --> 00:36:44,040
I think that's the only situation that is going to be a problem.
596
00:36:44,040 --> 00:36:51,200
And it's not really going to be a problem because it is just the passage of time is
597
00:36:51,200 --> 00:36:57,680
that there are a lot of iOS and macOS projects that were built at a point in time and haven't
598
00:36:57,680 --> 00:36:59,440
been touched since.
599
00:36:59,440 --> 00:37:02,960
And resurrecting those projects will become even harder.
600
00:37:02,960 --> 00:37:08,040
But honestly, resurrecting those projects is already an enormous task because the APIs
601
00:37:08,040 --> 00:37:09,640
have changed so much.
602
00:37:09,640 --> 00:37:11,280
The tooling has changed so much.
603
00:37:11,280 --> 00:37:13,680
The Swift has changed so much.
604
00:37:13,680 --> 00:37:15,280
You know, it's more than a few years old.
605
00:37:15,280 --> 00:37:16,280
It's not going to compile.
606
00:37:16,280 --> 00:37:21,480
Well, if it's Objective-C, I mean, it'll compile, but maybe people are replacing that stuff
607
00:37:21,480 --> 00:37:22,480
anyway.
608
00:37:22,480 --> 00:37:25,120
And those won't see any changes probably either.
609
00:37:25,120 --> 00:37:28,480
So that'll just age out, I suppose.
610
00:37:28,480 --> 00:37:29,480
Yeah.
611
00:37:29,480 --> 00:37:30,480
Yeah.
612
00:37:30,480 --> 00:37:33,960
That's our theory that like, you know, people that are using building Swift projects at
613
00:37:33,960 --> 00:37:38,000
this point will probably have moved to Swift Package Manager.
614
00:37:38,000 --> 00:37:43,200
People that don't control their projects like React Native or Flutter are at a point where
615
00:37:43,200 --> 00:37:46,800
eventually there'll be a point release in their Flutter or React Native that switches
616
00:37:46,800 --> 00:37:48,760
fully over to Swift Package Manager.
617
00:37:48,760 --> 00:37:52,720
But most of the time their dependencies are not coming through CocoaPods.
618
00:37:52,720 --> 00:37:57,120
And anybody with an old build still works perfectly fine because the same pods are going
619
00:37:57,120 --> 00:37:58,120
to be there.
620
00:37:58,120 --> 00:38:00,000
There just won't be updates to new ones.
621
00:38:00,000 --> 00:38:01,000
That's right.
622
00:38:01,000 --> 00:38:02,000
Yeah.
623
00:38:02,000 --> 00:38:03,000
The tooling still runs.
624
00:38:03,000 --> 00:38:04,000
The pods still exist.
625
00:38:04,000 --> 00:38:05,920
The GitHub repository is still there.
626
00:38:05,920 --> 00:38:06,920
Yeah, absolutely.
627
00:38:06,920 --> 00:38:07,920
Yeah.
628
00:38:07,920 --> 00:38:08,920
It's good.
629
00:38:08,920 --> 00:38:13,320
I hope and predict a smooth transition.
630
00:38:13,320 --> 00:38:19,600
Well, I've gained enough internet credit over these years to take a few flames if we need
631
00:38:19,600 --> 00:38:20,600
to.
632
00:38:20,600 --> 00:38:21,600
Yes, you have.
633
00:38:21,600 --> 00:38:23,760
Well, I hope you don't need to.
634
00:38:23,760 --> 00:38:27,160
And I hope nobody does that because it is not deserved.
635
00:38:27,160 --> 00:38:29,920
Well, that's been very interesting.
636
00:38:29,920 --> 00:38:34,000
And thank you so much for coming on the podcast to talk about that.
637
00:38:34,000 --> 00:38:38,920
But before we finish, let's do some package picks, shall we?
638
00:38:38,920 --> 00:38:40,520
Shall I start?
639
00:38:40,520 --> 00:38:43,960
Sven, why don't you kick us off?
640
00:38:43,960 --> 00:38:46,200
All right, I can do that.
641
00:38:46,200 --> 00:38:56,600
My pick this week or this time is Swift Configuration, a package by Apple that I believe was just
642
00:38:56,600 --> 00:39:02,800
announced this week or last week with the 1.0 release.
643
00:39:02,800 --> 00:39:05,800
So it's very fresh.
644
00:39:05,800 --> 00:39:12,840
And this package is about app configuration in terms of configuration files, environment
645
00:39:12,840 --> 00:39:15,120
variables, command line arguments.
646
00:39:15,120 --> 00:39:20,120
So there's lots of ways you can get configuration into your app.
647
00:39:20,120 --> 00:39:21,320
It supports hierarchy.
648
00:39:21,320 --> 00:39:27,120
So you can have overrides, like for instance, typically command line arguments would override
649
00:39:27,120 --> 00:39:31,120
file-based configuration, that sort of thing.
650
00:39:31,120 --> 00:39:34,240
Yeah, 1.0 came out.
651
00:39:34,240 --> 00:39:36,840
It supports these things I mentioned.
652
00:39:36,840 --> 00:39:38,860
Also, it redacts.
653
00:39:38,860 --> 00:39:44,000
You can declare a configuration value as secret.
654
00:39:44,000 --> 00:39:49,720
So it'll be redacted from logs automatically, which is very nice.
655
00:39:49,720 --> 00:39:54,840
I also want to mention another package while I mention this one.
656
00:39:54,840 --> 00:40:01,440
And that is called Swift Configs by Danil Voidilov.
657
00:40:01,440 --> 00:40:02,720
And that is slightly older.
658
00:40:02,720 --> 00:40:07,480
So he published that four months ago.
659
00:40:07,480 --> 00:40:09,640
Danil is two months old.
660
00:40:09,640 --> 00:40:17,120
So he was with Sherlock within two months of starting his package.
661
00:40:17,120 --> 00:40:25,200
I actually have to say I like the API in Danil's package a bit better than Apple's.
662
00:40:25,200 --> 00:40:32,360
There are trade-offs here because Apple's package has a couple more features like the
663
00:40:32,360 --> 00:40:33,360
overrides.
664
00:40:33,360 --> 00:40:37,920
But, you know, pick the one that you prefer.
665
00:40:37,920 --> 00:40:44,640
If you don't need the overrides, Danil's package might be the way to go with.
666
00:40:44,640 --> 00:40:50,280
And both packages will surely do the job if you need to configure your app.
667
00:40:50,280 --> 00:40:51,280
So there you go.
668
00:40:51,280 --> 00:40:56,240
That's Swift Configuration by Apple and Swift Configs by Danil Voidilov.
669
00:40:56,240 --> 00:40:57,240
Interesting.
670
00:40:57,240 --> 00:41:09,560
Sherlock's after two months is certainly a prize of sorts.
671
00:41:09,560 --> 00:41:11,560
Congratulations on winning that competition.
672
00:41:11,560 --> 00:41:15,760
Otto, do you want to give us your pick?
673
00:41:15,760 --> 00:41:21,080
So I have Danger in Swift is a Swift package manager package.
674
00:41:21,080 --> 00:41:24,360
So I guess to some extent that is one of them.
675
00:41:24,360 --> 00:41:33,880
But I only use one Swift package in Pusmo's iOS app, and that is RevenueCat.
676
00:41:33,880 --> 00:41:35,800
I've been really happy with that.
677
00:41:35,800 --> 00:41:41,000
So I just vendor the entire thing, put it inside the source code, and they make my life
678
00:41:41,000 --> 00:41:45,760
quite a lot easier considering how much work I had to do to do the web version of RevenueCat.
679
00:41:45,760 --> 00:41:49,080
Well, that was going to be my next question.
680
00:41:49,080 --> 00:41:50,760
Do you use their web?
681
00:41:50,760 --> 00:41:54,120
Because they have a web SDK as well, right?
682
00:41:54,120 --> 00:41:55,120
They do.
683
00:41:55,120 --> 00:41:57,440
Yeah, you can hook it into like Stripe and stuff like that.
684
00:41:57,440 --> 00:41:59,680
But I had already built all that stuff by hand.
685
00:41:59,680 --> 00:42:01,120
You'd already built that, right.
686
00:42:01,120 --> 00:42:07,280
Like giving them extra revenue from going back and undoing all that work, and this wasn't
687
00:42:07,280 --> 00:42:08,280
worth it for me.
688
00:42:08,280 --> 00:42:11,520
Oh, if it's already done, absolutely.
689
00:42:11,520 --> 00:42:12,520
Yeah.
690
00:42:12,520 --> 00:42:13,520
Yeah.
691
00:42:13,520 --> 00:42:17,280
And so, yeah, just one Swift package, that's some kind of record.
692
00:42:17,280 --> 00:42:20,720
Although I presume many, many JavaScript dependencies as well, right?
693
00:42:20,720 --> 00:42:22,160
Oh, you don't want to know.
694
00:42:22,160 --> 00:42:24,080
You do not want to know.
695
00:42:24,080 --> 00:42:26,920
Does JavaScript encourage lots of dependency?
696
00:42:26,920 --> 00:42:29,920
I had no idea.
697
00:42:29,920 --> 00:42:30,920
Imagine.
698
00:42:30,920 --> 00:42:37,480
Well, thank you for the pick.
699
00:42:37,480 --> 00:42:42,200
And certainly, it's a popular pick.
700
00:42:42,200 --> 00:42:46,840
I'm not sure if it's ever been recommended on here before, Sven.
701
00:42:46,840 --> 00:42:48,840
Do you recollect?
702
00:42:48,840 --> 00:42:52,880
Possibly, but it's been a while, if it has been.
703
00:42:52,880 --> 00:42:53,880
So yeah.
704
00:42:53,880 --> 00:42:54,880
Yeah, yeah, yeah.
705
00:42:54,880 --> 00:42:58,560
It's a good one.
706
00:42:58,560 --> 00:43:06,000
My first package this week is called Monocle by Dennis Muller.
707
00:43:06,000 --> 00:43:14,400
And it is a Swift symbol lookup CLI powered by SourceKit LSP tuned for coding agents.
708
00:43:14,400 --> 00:43:22,800
And so it's a command line tool where you can, for example, ask Monocle, this tool,
709
00:43:22,800 --> 00:43:30,000
to inspect a specific file at a specific line, even a specific column in that line.
710
00:43:30,000 --> 00:43:37,080
And it will describe what it's seeing at that position.
711
00:43:37,080 --> 00:43:44,720
You can have it output in human readable output or in JSON.
712
00:43:44,720 --> 00:43:49,760
And what you can do is you can tell if you're using something like Cloud Code or any of
713
00:43:49,760 --> 00:43:57,480
the agents, you can, in your agents.markdown file, you can give instructions to the agent
714
00:43:57,480 --> 00:43:58,960
on how to use Monocle.
715
00:43:58,960 --> 00:44:03,240
So for example, they actually give you a little snippet here that you can say, treat the Monocle
716
00:44:03,240 --> 00:44:07,000
CLI as your default tool for Swift symbol information.
717
00:44:07,000 --> 00:44:12,400
If you need definition file signature parameters or document comments for any Swift symbol,
718
00:44:12,400 --> 00:44:14,240
run this tool.
719
00:44:14,240 --> 00:44:19,400
And on it goes, you know, list checked out Swift dependencies, resolve any symbol at
720
00:44:19,400 --> 00:44:21,700
a specific location.
721
00:44:21,700 --> 00:44:31,720
And so it gives the agent the knowledge of how to properly inspect Swift symbols inside
722
00:44:31,720 --> 00:44:32,720
your project.
723
00:44:32,720 --> 00:44:36,560
And I thought it was a really interesting little tool.
724
00:44:36,560 --> 00:44:42,040
It's also got a server mode where you can keep the LSP server running constantly so
725
00:44:42,040 --> 00:44:46,920
that calls to the Monocle tool are really quick because it's already booted up that
726
00:44:46,920 --> 00:44:51,400
whole infrastructure of LSP.
727
00:44:51,400 --> 00:44:57,800
And I thought it was a very, very interesting tool and a fantastic readme file.
728
00:44:57,800 --> 00:45:00,520
Looks really easy to get started with.
729
00:45:00,520 --> 00:45:03,160
So yeah, it looked great.
730
00:45:03,160 --> 00:45:05,600
Well I think, are there any other package picks?
731
00:45:05,600 --> 00:45:07,320
Not for me, no.
732
00:45:07,320 --> 00:45:14,280
Well, I just have one, one lightweight one at the end then, which is a package called
733
00:45:14,280 --> 00:45:17,120
Swift for Swifts.
734
00:45:17,120 --> 00:45:25,920
It's by Rob Whittaker and it actually goes along with a website and the website is swiftforswifts.org.
735
00:45:25,920 --> 00:45:38,360
And it is a project to help save the humble Swift bird, not the language, the bird.
736
00:45:38,360 --> 00:45:46,520
It is a project which is, the package can add a link to the website and a little badge
737
00:45:46,520 --> 00:45:52,080
into your about screen or wherever you want in your application.
738
00:45:52,080 --> 00:45:58,240
And what they're doing is they're trying to save the Swift.
739
00:45:58,240 --> 00:46:04,840
Yeah, in the UK, numbers of Swifts have plummeted by 66% in the past 30 years and the species
740
00:46:04,840 --> 00:46:07,560
is globally threatened.
741
00:46:07,560 --> 00:46:16,120
So it would be a terrible shame if the birds with which our favorite language is named
742
00:46:16,120 --> 00:46:19,520
after were to become endangered.
743
00:46:19,520 --> 00:46:24,040
And so it's great to see this project, great to see Rob take this initiative and get this
744
00:46:24,040 --> 00:46:25,680
up and running.
745
00:46:25,680 --> 00:46:30,440
And even if you don't integrate the package into your application, check out the website
746
00:46:30,440 --> 00:46:34,240
and get involved with what they're doing there.
747
00:46:34,240 --> 00:46:36,520
Save the Swifts.
748
00:46:36,520 --> 00:46:37,520
Swift for Swifts.org.
749
00:46:37,520 --> 00:46:44,640
And we'll include links to that in the show notes and also various links to the Cocoa
750
00:46:44,640 --> 00:46:50,120
Pods announcements if you need the kind of official timeline.
751
00:46:50,120 --> 00:46:55,160
Just so that we actually do mention the date, what's the date of the maintenance switchover?
752
00:46:55,160 --> 00:46:57,840
December of next year.
753
00:46:57,840 --> 00:46:59,640
That's the final turn off.
754
00:46:59,640 --> 00:47:00,640
So a year.
755
00:47:00,640 --> 00:47:03,680
And then there was a kind of a test in November, right?
756
00:47:03,680 --> 00:47:05,360
Yeah, that's my plan.
757
00:47:05,360 --> 00:47:06,360
Yeah, wonderful.
758
00:47:06,360 --> 00:47:07,360
All right.
759
00:47:07,360 --> 00:47:12,240
Well, thank you so much for your time, Orta, for coming on and talking all about this.
760
00:47:12,240 --> 00:47:14,280
And thank you so much as well.
761
00:47:14,280 --> 00:47:19,360
Not just to you, but to the whole team and whoever contributed to Cocoa Pods over the
762
00:47:19,360 --> 00:47:20,360
years.
763
00:47:20,360 --> 00:47:24,680
It was an incredible tool that revolutionized iOS development.
764
00:47:24,680 --> 00:47:25,680
It really did.
765
00:47:25,680 --> 00:47:26,680
Yeah, I agree.
766
00:47:26,680 --> 00:47:27,680
It was fun.
767
00:47:27,680 --> 00:47:28,680
I'm glad it's had its time.
768
00:47:28,680 --> 00:47:29,680
Thank you, Orta.
769
00:47:29,680 --> 00:47:30,680
All right.
770
00:47:30,680 --> 00:47:31,680
And we'll be back in a few weeks.
771
00:47:31,680 --> 00:47:32,680
So we'll speak to you then.
772
00:47:32,680 --> 00:47:33,680
All right.
773
00:47:33,680 --> 00:47:34,680
See you next time.
774
00:47:34,680 --> 00:47:35,680
Thank you for having me.
775
00:47:35,680 --> 00:47:36,680
All right.
776
00:47:36,680 --> 00:47:37,680
Take care.
777
00:47:37,680 --> 00:47:37,680
Bye bye.
778
00:47:37,680 --> 00:47:42,680
Bye bye.
