\n<\/p>\n
This story of a CocoaPods security problem<\/a> set me wondering about the state of dependency management in Swift again this week.<\/p>\n First, the security issue was a serious supply chain vulnerability, with potential attackers able to claim ownership of abandoned libraries. It stemmed from the migration to the CocoaPods \u201ctrunk\u201d system in 2014 and while this image<\/a> doesn\u2019t give a date for when the vulnerability started, I think the public API (and therefore the vulnerability) has been available for several years.<\/p>\n I don\u2019t write this to criticise CocoaPods. Once reported it was handled responsibly, fixed quickly<\/a>, and there was no evidence of it being exploited. But, the truth is that CocoaPods doesn\u2019t have as many eyes on its maintenance as it used to and it\u2019ll only lose more popularity as more people adopt SwiftPM. The maintenance team are all volunteers and do a great job of a thankless task, but SwiftPM is the future.<\/p>\n But is SwiftPM safe from supply chain attacks? Not in the way that 99% of people use it. There\u2019s an obvious supply chain vulnerability which is implicit in importing a dependency directly from tags in a git repository with SwiftPM. Git tags are not immutable and can be moved at the package author\u2019s convenience, so if you built SomeDependency v3.2.4 into your app and shipped it to the store, it\u2019s not guaranteed to be the same code I have in my app if I also depend on SomeDependency v3.2.4. Yes, that\u2019s not in the same ballpark of security issues as being able to take ownership of someone else\u2019s package, but it\u2019s still serious enough.<\/p>\n So what\u2019s the solution? Do we need a whole new package manager? No, we just need to use SwiftPM package registries<\/a>. Supported since Swift 5.7, SwiftPM has full support for package registries. Package registries treat versions of packages as immutable and serve zipped archives of packages rather than needing to check out a git repository. They are quicker in use and inherently more secure.<\/p>\n Some artefact hosting companies have even shipped registry implementations as part of their products. JFrog Artifactory<\/a> announced support in 2022, AWS CodeArtifact<\/a> in 2023, and just this May Cloudsmith<\/a> joined in.<\/p>\n What doesn\u2019t yet exist is a public open-source package registry hosting all the packages in, for example, a package index<\/a>. Sven and I are very aware of that and have been considering whether it might be something we could add to the Swift Package Index. We\u2019ve got nothing to announce today, but when everyone can use a package registry rather than git-based source code dependencies, we\u2019ll get a step forward in dependency management for Swift, too.<\/p>\n Dave Verwer<\/p>\n Worried about losing Microsoft App Center?<\/a><\/p>\n Bitrise has you covered! With Microsoft retiring its Visual Studio App Center, many developers are looking for robust, reliable alternatives. Bitrise\u2019s Release Management is not just a replacement, but a comprehensive upgrade for your mobile app development needs. Learn more<\/a>.<\/p>\n Plotting a Path to a Package Ecosystem without Data Race Errors<\/a><\/p>\n Here\u2019s some more information published on the Swift.org blog from Sven A. Schmidt<\/a> and me<\/a> about the Ready for Swift 6<\/a> project we\u2019re working on this summer at the Swift Package Index. We also just finished a test run using Xcode 16 beta 2, and the number of packages without data races continues to rise. Progress!<\/p>\n Make videos with SwiftUI<\/a><\/p>\n What a fun idea from Jordan Howlett<\/a>. Have you ever wanted to make motion graphics for video with SwiftUI? Now you can, with his new library, StreamUI<\/a>. Read the forum post above for a little background, or watch the sample video<\/a> to see what it can create.<\/p>\n Zoom transitions<\/a><\/p>\n Having access to some of the fancier transitions that Apple has perfected in the operating system over the years is so great. It not only makes apps that use them smoother and easier to use, but it increases consistency with third-party apps and the platform, too. Here\u2019s Douglas Hill<\/a> teaching us about this year\u2019s new zoom transition.<\/p>\n Consolidated ViewState<\/a><\/p>\n I found myself nodding along as I read this little tip from Luda Fux<\/a>. My first attempts with SwiftUI were full of Diffuse reflection UV computation tool<\/a><\/p>\n I\u2019d recommend watching this WWDC session video<\/a> before reading this post from Cristian D\u00edaz<\/a> that explains how to generate the \u201cemitter and attenuation UVs\u201d necessary to make this really impressive effect work.<\/p>\n I wish I had a Vision Pro so I could experience these things! Luckily, I did order one last week when they went on sale in the UK! \ud83d\udcb8<\/p>\n Is this the best VR development environment?<\/a><\/p>\n What an interesting screenshot from James Thomson<\/a>! I can\u2019t imagine the PSVR2 or Meta Quest development environment allowing anything close to this.<\/p>\n Our App Store screenshot nightmare is (almost) over<\/a><\/p>\n This is amazing news! \ud83c\udf89 I had missed this announcement, so thanks to Jesse Squires<\/a> for writing it up.<\/p>\n Software Engineer, iOS @ amo<\/a> \u2013 Amo values speed, creativity, and high performance. Focused on meaningful social apps, they prioritize creation over consumption and simple, fun experiences. The diverse, skilled team uses a modular monorepo tech stack with Rust, Bazel, and RxSwift, leveraging efficient data processing on GCP. \u2013 On-site (France)<\/em><\/p>\n Senior iOS Engineer @ Leica Camera AG<\/a> \u2013 We are looking for an experienced iOS developer to join our team. We are working as a small, fast-moving unit within Leica, so we are looking for team members who can take charge of projects and work independently. It\u2019s a bonus (but not required) if you are passionate about photography! \u2013 Remote (within European timezones) or on-site (Germany)<\/em><\/p>\n Product Engineer (iOS, Full-Stack) @ Emerge Tools<\/a> \u2013 Have a huge impact working with our small, technically elite team (just 8), build tools used some of the biggest & best mobile teams in the world (DoorDash, Square, Spotify, Duolingo, Tinder, Bumble) \u2013 Remote (within US timezones)<\/em><\/p>\n Senior iOS Developer @ Komoot<\/a> \u2013 Your work will contribute to helping millions of people enjoy lovely outdoor experiences and you can work from wherever you want, be it a beach, the mountains, your house, or anywhere else that lies in any time zone between UTC-1 and UTC+3. \u2013 Remote (within European timezones)<\/em><\/p>\n Are you looking for a job? Get yourself over to iOS Dev Jobs<\/a> where even more opportunities await!<\/p>\nNews<\/h2>\n
Code<\/h2>\n
isLoading<\/code> and isPresented<\/code> booleans. Is there a better approach? There is!<\/p>\nBusiness and Marketing<\/h2>\n
Jobs<\/h2>\n
And finally…<\/h2>\n