Skip to content

PkgLift v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 19:19
v0.4.0
8f2cba2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PkgLift 0.4.0 makes a narrow class of external Git pods more explainable—without making them automatic.

What’s new

  • Typed Git provenance. PkgLift can now record source evidence for supported literal :git declarations in a Podfile.
  • Podfile and lockfile reconciliation. It compares the declaration with CocoaPods EXTERNAL SOURCES and CHECKOUT OPTIONS evidence without executing Ruby or contacting the source repository.
  • Sensitive URL data removed. URL user information, credentials, queries, and fragments are stripped before provenance reaches standard or portable JSON.
  • Fail-closed preflight. Changed, lossy, incomplete, conflicting, credential-bearing, or otherwise unsafe external evidence is refused before project files are written.
  • Real-project refusal evidence. The pinned, read-only XcodeBenchmark and Hammerspoon pilots now assert unpinned and incomplete-tag Git cases with a complete no-AUTO result.

The safety boundary is unchanged

External Git sources are never classified as AUTO in 0.4.0. They remain REVIEW, BLOCKED, or UNKNOWN until a separately reviewed migration path has enough evidence to be safe.

Local :path dependencies, private authentication, network repository resolution, Podspec generation, and automatic migration of external sources remain intentionally deferred.

Upgrade

brew upgrade pkglift
pkglift version

New users can install with:

brew install Alexsvensson99/tap/pkglift
Assets 4
Loading