fix(cocoapods) Podfile.lock SPEC CHECKSUMS drift for React XCFrameworks

[chrfalch]

Summary:

Two developers (or one developer on two paths, or CI vs. local) running pod install on the same React Native project at the same commit get different SPEC CHECKSUMS entries for React-Core-prebuilt and ReactNativeDependencies in Podfile.lock.

That breaks pod install-deployment style verification and any workflow that expects Podfile.lock to be reproducible.

CocoaPods derives SPEC CHECKSUMS entry by hashing the in-memory podspec JSON. Anything embedded in source.http, prepare_command, user_target_xcconfig, etc. becomes part of the hash.

Problem: Two podspec-resolution sites in this repo build their source.http from an absolute on-disk path, because project_pods_root is an absolute path, the resulting file:///... URL differs across machines or working-tree paths, so the hashed JSON differs, so the checksum differs.

How

The Maven URL for each tarball is already computed inside both functions (stable_tarball_url(...) / nightly_tarball_url(...) / release_tarball_url(...)). Returning that URL — a stable string identical across machines — instead of the local file:// URL makes source.http path-free. CocoaPods downloads from Maven and caches the tarball itself, so functionality is preserved.

The pre-existing local-tarball download is kept untouched (its only remaining consumer is the opt-in RCT_SYMBOLICATE_PREBUILT_FRAMEWORKS=1 dSYM-injection path in rncore.rb, which still needs file:// to feed CocoaPods a mutated tarball — gated by unless @@download_dsyms so the leak is preserved only for that flag).

**Out of scope: **

hermes-engine.podspec has the same shape of leak in user_target_xcconfig.HERMES_CLI_PATH. Fixing it requires a paired change to ensure hermesc lands at the new ${PODS_ROOT}-relative path; that's a separate PR.

NOTE:

In our scripts for downloading XCFrameworks we implemented the original problematic solution returning a full file path to avoid double downloading on pod install. (We need to know the location of these tarballs so that the script that switches between release/debug will work). With this solution, which is the correct way to solve this, we'll both let Cocoapods download (through its cache) the tarballs - and we'll download the release/debug artifacts. This is redundant, but hard to avoid without rewriting the download code completely - this can be done in a follow-up PR.

Changelog:

[IOS] [FIXED] - Fix Pod install checksum drifting

Test Plan:

Run pod install and verify that none of the following files contains absolute paths:

• Pods/Local Podspecs/React-Core-prebuilt.podspec.json
• Pods/Local Podspecs/ReactNativeDependencies.podspec.json

[meta-codesync]

@CalixTang has imported this pull request. If you are a Meta employee, you can view this in D104889112.

[meta-codesync]

@CalixTang merged this pull request in 814ebb1.

[react-native-bot]

This pull request was successfully merged by @chrfalch in 814ebb1

^{When will my fix make it into a release? | How to file a pick request?}