Bump SDK to 2.6.0-alpha.6; ship deps as a real link input

Bumps the vendored ZcashLightClientKit to 2.6.0-alpha.6 (the first hardfork-era prerelease: new Voting/PIR module, expanded libzcashlc FFI, updated checkpoints). The bridge needs no changes - the SDK's bridge-facing API surface is source-compatible with 2.5.2, and the dependency graph pins are identical.

Packaging fix: the previous pod_target_xcconfig OTHER_LDFLAGS -force_load flags never reached any link step (a static-framework pod's Libtool step ignores OTHER_LDFLAGS, and pod-target settings don't propagate to the app link). Builds only succeeded because react-native-piratechain's gRPC-Swift 1.8 pods happened to satisfy zcash's grpc/NIO references at the app link - a silent version mix (compiled against 1.27 modules, linked against 1.8 definitions) that Release-mode optimization finally exposed via DequeModule internals. The deps now ship as ios/vendored/libZcashDeps.xcframework via vendored_frameworks, which CocoaPods places on the app link line as a real input. Validated in isolation: with piratechain's iOS pods removed from the host app, a Release build links with zero undefined symbols and the app binary carries the 1.27 GRPC/NIO/Deque definitions and the alpha.6 voting FFI.

Also: buildVendoredDeps cleans DerivedData per run (stale precompiled modules of the libzcashlc header poison version bumps), builds Release config, and the pod floor returns to iOS 13.0 (the SDK's own minimum) so the package works on Edge develop (15.6) and the RN 0.85 branch (16.4) alike.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: peachbits

react-native-zcash.podspec

@@ -44,7 +44,7 @@ Pod::Spec.new do |s|
   s.license      = package['license']
   s.authors      = package['author']
 
-  s.platform     = :ios, "16.0"
+  s.platform     = :ios, "13.0"
   s.source = {
     :git => "https://github.com/EdgeApp/react-native-zcash.git",
     :tag => "v#{s.version}"
@@ -67,8 +67,13 @@ Pod::Spec.new do |s|
   s.dependency "MnemonicSwift", "~> 2.2"
   s.dependency "React-Core"
 
-  # The Rust core (a binaryTarget on the SDK's GitHub release):
-  s.vendored_frameworks = "ios/libzcashlc.xcframework"
+  # The Rust core (a binaryTarget on the SDK's GitHub release) plus the
+  # pre-built SwiftPM deps (see below). Vendored frameworks are real link
+  # inputs: CocoaPods adds them to the app link, where the linker pulls
+  # members on demand to satisfy the in-pod SDK source's references.
+  s.vendored_frameworks =
+    "ios/libzcashlc.xcframework",
+    "ios/vendored/libZcashDeps.xcframework"
 
   # ---------------------------------------------------------------------------
   # The SDK's SwiftPM-only dependencies (grpc-swift, SwiftNIO, SwiftProtobuf,
@@ -92,12 +97,6 @@ Pod::Spec.new do |s|
   s.preserve_paths = "ios/vendored/**/*"
   s.pod_target_xcconfig = {
     "SWIFT_INCLUDE_PATHS" => "\"$(PODS_TARGET_SRCROOT)/ios/vendored/modules\"",
-    "OTHER_SWIFT_FLAGS" => cmodule_flags,
-    # force_load the matching slice so the deps' Swift type metadata / protocol
-    # conformances (referenced by the SDK source) aren't dead-stripped:
-    "OTHER_LDFLAGS[sdk=iphoneos*]" =>
-      "-force_load \"$(PODS_TARGET_SRCROOT)/ios/vendored/libZcashDeps-ios-arm64.a\"",
-    "OTHER_LDFLAGS[sdk=iphonesimulator*]" =>
-      "-force_load \"$(PODS_TARGET_SRCROOT)/ios/vendored/libZcashDeps-ios-arm64-simulator.a\""
+    "OTHER_SWIFT_FLAGS" => cmodule_flags
   }
 end

scripts/buildVendoredDeps.ts

@@ -91,6 +91,11 @@ export function buildVendoredDeps(): void {
   for (const platform of PLATFORMS) {
     console.log(`  Compiling deps for ${platform.dir}...`)
     const dd = join(tmp, `deps-dd-${platform.dir}`)
+    // Always start from clean DerivedData: reusing it across SDK version bumps
+    // poisons the build with stale precompiled modules of the libzcashlc
+    // binary-target header ("zcashlc.h has been modified since the module file
+    // was built"), surfacing as bogus cannot-find-FFI-symbol errors.
+    rm(dd)
     loud(wrapper, [
       'xcodebuild',
       '-scheme',
@@ -115,6 +120,38 @@ export function buildVendoredDeps(): void {
     harvestModules(dd)
   }
 
+  // Package the per-platform archives as ONE xcframework: vendored_frameworks
+  // is a real link input (CocoaPods puts it on the app link line, unlike
+  // pod_target_xcconfig OTHER_LDFLAGS, which a static-framework pod's Libtool
+  // step silently ignores).
+  console.log('  Creating libZcashDeps.xcframework...')
+  const xcframework = join(vendored, 'libZcashDeps.xcframework')
+  rm(xcframework)
+  const libArgs: string[] = []
+  for (const platform of PLATFORMS) {
+    // CocoaPods requires a UNIFORM library basename across xcframework slices
+    // (mirroring libzcashlc.xcframework); stage each platform's lib under the
+    // same name in its own directory:
+    const stage = join(tmp, `xcfw-${platform.dir}`)
+    rm(stage)
+    mkdirSync(stage, { recursive: true })
+    cp(
+      join(vendored, `libZcashDeps-${platform.dir}.a`),
+      join(stage, 'libZcashDeps.a')
+    )
+    libArgs.push('-library', join(stage, 'libZcashDeps.a'))
+  }
+  loud(tmp, [
+    'xcodebuild',
+    '-create-xcframework',
+    ...libArgs,
+    '-output',
+    xcframework
+  ])
+  for (const platform of PLATFORMS) {
+    rm(join(vendored, `libZcashDeps-${platform.dir}.a`))
+  }
+
   writeCompilerStamp()
   assertHarvestComplete()
   console.log('Vendored deps built.')
@@ -133,7 +170,9 @@ function writeWrapperPackage(): void {
 import PackageDescription
 let package = Package(
   name: "ZcashDepsWrapper",
-  platforms: [.iOS(.v16)],
+  // Match the SDK's own floor (iOS 13) so the prebuilt deps import cleanly
+  // from any host at or above it (Edge develop pins 15.6):
+  platforms: [.iOS(.v13)],
   products: [.library(name: "ZcashDepsWrapper", type: .static, targets: ["ZcashDepsWrapper"])],
   dependencies: [.package(path: ${JSON.stringify(sdkClone)})],
   targets: [.target(name: "ZcashDepsWrapper", dependencies: [
@@ -288,9 +327,9 @@ function assertHarvestComplete(): void {
     name.endsWith('.swiftmodule')
   ).length
   const cmoduleCount = readdirSync(join(vendored, 'cmodules')).length
-  for (const platform of PLATFORMS) {
-    const lib = join(vendored, `libZcashDeps-${platform.dir}.a`)
-    if (!existsSync(lib)) throw new Error(`Missing ${lib}`)
+  const xcframework = join(vendored, 'libZcashDeps.xcframework')
+  if (!existsSync(join(xcframework, 'Info.plist'))) {
+    throw new Error(`Missing or incomplete ${xcframework}`)
   }
   if (moduleCount < 10 || cmoduleCount < 5) {
     throw new Error(

scripts/updateSources.ts

@@ -29,22 +29,23 @@ async function main(): Promise<void> {
 
 // The Swift SDK version to vendor. The matching libzcashlc.xcframework is
 // downloaded from this release's assets (see rebuildXcframework).
-const ZCASH_SWIFT_SDK_VERSION = '2.5.2'
+const ZCASH_SWIFT_SDK_VERSION = '2.6.0-alpha.6'
 
 // SHA-256 of the libzcashlc.xcframework.zip release asset for the version
 // above. The download is verified against this pin before it is unpacked, so a
 // tampered or swapped upstream asset fails the build instead of injecting
 // attacker-controlled native code. Update this whenever the SDK version bumps:
 //   curl -fL https://github.com/zcash/zcash-swift-wallet-sdk/releases/download/<ver>/libzcashlc.xcframework.zip | shasum -a 256
+// (matches the `checksum:` in the SDK tag's own Package.swift binaryTarget)
 const LIBZCASHLC_XCFRAMEWORK_SHA256 =
-  '27089796e15eacd0e5a90e7ea01884ea5c40806cf25a6fa9a6aca933dad65813'
+  'c58c1714440f8fd40bed33eefa3be325896e58eb568ed8747c05a27dae3a74b2'
 
 function downloadSources(): void {
   getRepo(
     'ZcashLightClientKit',
     'https://github.com/zcash/zcash-swift-wallet-sdk.git',
-    // 2.5.2:
-    'e725a2482dced83afda91bcebe881bd0791aa359'
+    // 2.6.0-alpha.6:
+    '4303068e9282bb8b03bd94807b7d8ad268de75bf'
   )
   // libzcashlc is no longer a separate package as of SDK 2.5.x — it ships as a
   // binaryTarget zip on the SDK's GitHub release, downloaded in rebuildXcframework().