RxDataSources icon indicating copy to clipboard operation
RxDataSources copied to clipboard

Add prebuilt carthage framework

Open gotev opened this issue 6 years ago • 3 comments

Description

Add a prebuilt carthage framework to every RxDataSources release to speed up build times when using it in apps.

Motivation and Context

I'm using carthage as dependency manager for my projects and I use RxDataSources extensively, thank you for the awesome work! Carthage builds all the dependencies from source every time, unless they have a prebuilt framework attached to the github release. By attaching it, the client simply downloads the framework and build times are much faster.

I saw you attached a zip to the latest release, but if it's not called RxDataSources.framework.zip it's not recognized by carthage. Currently that is called RxDataSources.zip. Automating releases can solve the issue forever.

Proposed Solution

## do this only the first time on your mac or CI
## https://github.com/github/hub
brew install hub

## to create a release, from the project's root
carthage build --archive
hub release create -a RxDataSources.framework.zip -m "tag comment" "tag version"

And you will get a release like this (taken from RxSwift) Schermata 2019-05-10 alle 11 44 06

gotev avatar May 10 '19 10:05 gotev

I don't think we should do this.

RxSwift has a fairly limited number of people with access to attaching binaries. There are 200 people in the RxSwiftCommunity and attaching binaries provides serious security risk IMHO.

I've removed the attached zip in the latest release.

kzaher avatar May 10 '19 12:05 kzaher

@kzaher if that is your scenario, then I agree with you is a serious security risk. One way I managed to resolve this is letting only the CI create releases. Solutions vary depending by many factors. It could not be the one which solves your scenario.

gotev avatar May 10 '19 12:05 gotev

The problem isn't who creates releases, but how do you verify somebody hasn't replaced the binary with a malformed one.

I don't think we can solve this in a satisfying way.

kzaher avatar May 10 '19 12:05 kzaher