Skip to content

fix(ios): make Podfile.lock SPEC CHECKSUMS deterministic across machines#56994

Open
IsaacIsrael wants to merge 1 commit into
facebook:mainfrom
IsaacIsrael:fix/podfile-lock-determinism
Open

fix(ios): make Podfile.lock SPEC CHECKSUMS deterministic across machines#56994
IsaacIsrael wants to merge 1 commit into
facebook:mainfrom
IsaacIsrael:fix/podfile-lock-determinism

Conversation

@IsaacIsrael
Copy link
Copy Markdown

Summary

Two sources of non-determinism cause Podfile.lock SPEC CHECKSUMS to differ between machines, breaking pod install --deployment in CI and creating unnecessary churn in PRs.

Fix 1: Sort Dir.glob results in Yoga.podspec

Dir.glob returns files in filesystem-dependent order (varies across macOS APFS volumes, case sensitivity settings, and Linux ext4/xfs). Since CocoaPods evaluates the podspec at install time, the resulting array order differs between machines, producing different spec checksums.

# Before
spec.private_header_files = Dir.glob(all_header_files) - Dir.glob(public_header_files)

# After
spec.private_header_files = Dir.glob(all_header_files).sort - Dir.glob(public_header_files).sort

Fix 2: Use a Pods-relative path in hermes-engine.podspec

require.resolve with __dir__ resolves to an absolute path containing the developer's home directory (e.g., /Users/alice/project/node_modules/...). This absolute path gets baked into user_target_xcconfig, which differs per machine.

Instead of hardcoding a relative path (which assumes a specific project layout), we dynamically compute the relative path from Pod::Config.instance.sandbox.root to the resolved hermes-compiler location. This supports any project layout (standard apps, monorepos, RNTester, etc.) while keeping the xcconfig deterministic.

# Before — absolute path baked in
spec.user_target_xcconfig = {
  'HERMES_CLI_PATH' => "#{hermes_compiler_path}/hermesc/osx-bin/hermesc"
}

# After — dynamic relative path via $(PODS_ROOT)
pods_root = Pod::Config.instance.sandbox.root
relative_hermesc = Pathname.new(hermesc_path).relative_path_from(pods_root)

spec.user_target_xcconfig = {
  'HERMES_CLI_PATH' => "$(PODS_ROOT)/#{relative_hermesc}"
}

Changelog:

[IOS] [FIXED] - Make Podfile.lock SPEC CHECKSUMS deterministic across machines by sorting Dir.glob results in Yoga.podspec and using a dynamically computed Pods-relative path in hermes-engine.podspec

Test Plan

  1. Run pod install on machine A, record Podfile.lock
  2. Run pod install on machine B (different username/home directory)
  3. Verify SPEC CHECKSUMS are identical between both runs

We have verified this fix in our production app — after patching, running pod install consecutively produces zero diff in Podfile.lock.

Supersedes #56977 (closed due to force-push history issue).
Fixes #56975

Made with Cursor

Two sources of non-determinism cause Podfile.lock to differ between
machines, breaking `pod install --deployment` in CI:

1. Yoga.podspec: Dir.glob returns files in filesystem-dependent order.
   Add .sort to ensure consistent ordering regardless of OS/filesystem.

2. hermes-engine.podspec: require.resolve with __dir__ produces an
   absolute path containing the user's home directory. Compute a relative
   path from Pod::Config sandbox root and use $(PODS_ROOT) so the xcconfig
   is deterministic while supporting any project layout.

Fixes facebook#56975

Co-authored-by: Cursor <cursoragent@cursor.com>
@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label May 29, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label May 29, 2026
@cortinico cortinico requested a review from cipolleschi May 29, 2026 10:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Podfile.lock SPEC CHECKSUMS are non-deterministic across machines (Dir.glob ordering + absolute paths from __dir__)

1 participant