[security] Install pods safety when they stored in Source control

[retyui]

• I've read and understood the CONTRIBUTING guidelines and have done my best effort to follow.

Report

What did you do?

pod install
# then I change one source file on library and commit it
git add Pods; git commit;

# finally I run again
pod install

What did you expect to happen?

Changes that I add to source code of library should be discarded and I will see it in git status

What happened instead?

Nothing happened(
Injected alien code has not been deleted

CocoaPods Environment

Stack

   CocoaPods : 1.8.4
        Ruby : ruby 2.3.7p456 (2018-03-28 revision 63024) [universal.x86_64-darwin18]
    RubyGems : 2.5.2.3
        Host : Mac OS X 10.14.6 (18G103)
       Xcode : 11.3.1 (11C504)
         Git : git version 2.24.0
Ruby lib dir : /System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib
Repositories : trunk - CDN - https://cdn.cocoapods.org/

Installation Source

Executable Path: /usr/local/bin/pod

Plugins

cocoapods-deintegrate : 1.0.4
cocoapods-plugins     : 1.0.0
cocoapods-search      : 1.0.0
cocoapods-stats       : 1.1.0
cocoapods-trunk       : 1.4.1
cocoapods-try         : 1.1.0

Project that demonstrates the issue

...

[paulb777]

rm -rf Pods before pod install is a workaround

[dnkoutso]

We could calculate a checksum for the current remote Pods and re-install it if it has changed. We should piggyback on the mechanism for incremental installation that generates those checksums and the list of files I think.