chore(ios): Address itaybre review comments

- sentry_utils.rb: replace system('curl',…) with URI.open from stdlib
  open-uri. Same net behavior, no shell escaping to worry about, pure Ruby.

- sentry_utils.rb + RNSentry.podspec: drop the runtime slice-enumeration
  helpers. Sentry.xcframework's layout has been stable across releases,
  so hardcode the slice → SDK map into a frozen constant
  (SENTRY_XCFRAMEWORK_SLICES_BY_SDK) and iterate it directly in the
  podspec. Less code, no filesystem scan on every pod install. If
  sentry-cocoa ever ships a new platform slice, add a line to the
  constant.

- scripts/update-cocoa.sh: extend set-version to also refresh the
  Sentry.xcframework.zip SHA256 checksum in sentry_utils.rb. Before
  this, bumping sentry-cocoa required editing the checksum by hand — a
  silent recipe for typos that would break every user's pod install
  with a checksum-mismatch error. Now the script downloads the new
  archive, computes SHA256, and rewrites both the version key and the
  Sentry value in place with a sanity-check.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: alwx

packages/core/RNSentry.podspec

@@ -110,8 +110,12 @@ Pod::Spec.new do |s|
     # SDK selector so `#import <Sentry/…>` resolves against exactly one
     # slice per build. An unconditional search-path list would let Xcode's
     # Swift module precompiler stumble into a slice for a different arch
-    # and fail with "unsupported Swift architecture". New slices in future
-    # sentry-cocoa releases are picked up automatically at pod-install.
+    # and fail with "unsupported Swift architecture".
+    #
+    # We hardcode the slice → SDK map in `SENTRY_XCFRAMEWORK_SLICES_BY_SDK`
+    # (see `sentry_utils.rb`) rather than scanning the extracted bundle —
+    # sentry-cocoa's `Sentry.xcframework` layout is stable across releases.
+    # Add a slice there if a future release ships one.
     #
     # Point the search paths at the pod-install-time absolute path to the
     # xcframework. `${PODS_TARGET_SRCROOT}` is only defined in per-pod
@@ -121,13 +125,9 @@ Pod::Spec.new do |s|
     # different depth from RNSentryCocoaTester). Using the absolute path
     # avoids the layout-detection dance — the path is regenerated on
     # every `pod install`, so it's not something anyone commits.
-    xcframework_search_paths = {}
-    sentry_xcframework_slices_by_sdk(sentry_xcframework_dir).each do |sdk, slice_ids|
-      paths = slice_ids.map do |slice|
-        %("#{File.join(sentry_xcframework_dir, slice)}")
-      end
-      xcframework_search_paths["FRAMEWORK_SEARCH_PATHS[sdk=#{sdk}*]"] =
-        (['$(inherited)'] + paths).join(' ')
+    xcframework_search_paths = SENTRY_XCFRAMEWORK_SLICES_BY_SDK.each_with_object({}) do |(sdk, slice_ids), acc|
+      paths = slice_ids.map { |slice| %("#{File.join(sentry_xcframework_dir, slice)}") }
+      acc["FRAMEWORK_SEARCH_PATHS[sdk=#{sdk}*]"] = (['$(inherited)'] + paths).join(' ')
     end
 
     pod_target_xcconfig.merge!(xcframework_search_paths)

packages/core/scripts/sentry_utils.rb

@@ -43,23 +43,46 @@ def is_new_hermes_runtime(rn_version)
 
 require 'digest'
 require 'fileutils'
+require 'open-uri'
 
 # SHA256 checksums of `<product>.xcframework.zip` assets published in
 # sentry-cocoa GitHub releases (same value as the SPM binary target checksum
 # in sentry-cocoa's `Package.swift`). Register the checksum for each
 # sentry-cocoa version we ship a prebuilt xcframework for.
+#
+# Kept in sync with `sentry_cocoa_version` in `RNSentry.podspec` by
+# `scripts/update-cocoa.sh set-version <new>`, which downloads the new
+# release archive, computes its SHA256, and rewrites the entry below.
 SENTRY_COCOA_XCFRAMEWORK_CHECKSUMS = {
+  # `Sentry.xcframework.zip` — the static product. Its enclosing xcframework
+  # name matches the framework name inside (both `Sentry`), which CocoaPods
+  # requires to generate `-framework Sentry` correctly and to resolve the
+  # `Sentry` module. `Sentry-Dynamic.xcframework` would ship the same
+  # `Sentry.framework` inside but under a mismatched enclosing name, so
+  # CocoaPods generates `-framework Sentry-Dynamic` and fails at link.
   '9.19.1' => {
-    # `Sentry.xcframework.zip` — the static product. Its enclosing xcframework
-    # name matches the framework name inside (both `Sentry`), which CocoaPods
-    # requires to generate `-framework Sentry` correctly and to resolve the
-    # `Sentry` module. `Sentry-Dynamic.xcframework` would ship the same
-    # `Sentry.framework` inside but under a mismatched enclosing name, so
-    # CocoaPods generates `-framework Sentry-Dynamic` and fails at link.
     'Sentry' => 'd6d545af17e49851cda2747b0f45cde78ce08ea37709dde5a956c6b4671224e8',
   },
 }.freeze
 
+# Static map from xcframework slice directory name to the Xcode SDK selector
+# it should be attached to. `sentry-cocoa`'s `Sentry.xcframework` layout is
+# stable across releases — same slice names come out of every build — so we
+# hardcode the mapping rather than scanning the extracted bundle. Add a
+# new entry here if `sentry-cocoa` ever ships a new platform slice.
+SENTRY_XCFRAMEWORK_SLICES_BY_SDK = {
+  'iphoneos'         => %w[ios-arm64_arm64e],
+  'iphonesimulator'  => %w[ios-arm64_x86_64-simulator],
+  'maccatalyst'      => %w[ios-arm64_arm64e_x86_64-maccatalyst],
+  'macosx'           => %w[macos-arm64_arm64e_x86_64],
+  'appletvos'        => %w[tvos-arm64_arm64e],
+  'appletvsimulator' => %w[tvos-arm64_x86_64-simulator],
+  'watchos'          => %w[watchos-arm64_arm64_32_arm64e_armv7k],
+  'watchsimulator'   => %w[watchos-arm64_x86_64-simulator],
+  'xros'             => %w[xros-arm64_arm64e],
+  'xrsimulator'      => %w[xros-arm64_x86_64-simulator],
+}.freeze
+
 # Ensures `<sdk_root>/ios/Vendor/<product>.xcframework` exists.
 #
 # On first invocation, downloads the prebuilt xcframework zip from
@@ -96,8 +119,13 @@ def ensure_sentry_xcframework(version, product = 'Sentry')
         "#{version}/#{product}.xcframework.zip"
 
   Pod::UI.puts "[Sentry] Downloading #{product} #{version} from GitHub Releases…" if defined?(Pod::UI)
-  unless system('curl', '-sSfL', '-o', zip_path, url)
-    raise "Failed to download #{url}"
+  begin
+    URI.open(url, redirect: true) do |remote|
+      File.open(zip_path, 'wb') { |f| IO.copy_stream(remote, f) }
+    end
+  rescue OpenURI::HTTPError, SocketError, StandardError => e
+    FileUtils.rm_f(zip_path)
+    raise "Failed to download #{url}: #{e.class}: #{e.message}"
   end
 
   actual_checksum = Digest::SHA256.file(zip_path).hexdigest
@@ -125,50 +153,3 @@ def ensure_sentry_xcframework(version, product = 'Sentry')
   target_dir
 end
 
-# Returns a hash of `<xcconfig SDK name> => [slice_id, ...]` for the slice
-# directories inside an xcframework bundle.
-#
-# Xcode's `-F <dir>` does not descend into an `.xcframework` bundle at
-# search-path lookup time — it only sees `Sentry.xcframework` as a directory
-# and doesn't find `Sentry.framework` inside. Callers use these groupings
-# to emit SDK-conditional `FRAMEWORK_SEARCH_PATHS[sdk=…*]` xcconfig entries
-# so each SDK build only sees its own slice — putting all slices under a
-# single unconditional search path lets Xcode's Swift module precompiler
-# stumble into an incompatible slice and fail with
-# "unsupported Swift architecture".
-#
-# Slice-name convention is stable across the xcframeworks Apple has ever
-# published:
-#   ios-*-simulator      -> iphonesimulator
-#   ios-*-maccatalyst    -> maccatalyst
-#   ios-…                -> iphoneos
-#   tvos-*-simulator     -> appletvsimulator
-#   tvos-…               -> appletvos
-#   watchos-*-simulator  -> watchsimulator
-#   watchos-…            -> watchos
-#   xros-*-simulator     -> xrsimulator
-#   xros-…               -> xros
-#   macos-…              -> macosx
-def sentry_xcframework_slices_by_sdk(xcframework_dir)
-  slice_ids = Dir.children(xcframework_dir).select do |name|
-    File.directory?(File.join(xcframework_dir, name)) && name != '_CodeSignature'
-  end.sort
-
-  slice_ids.each_with_object({}) do |slice, groups|
-    sdk = _sentry_sdk_for_slice(slice)
-    next unless sdk # unknown platform prefix — skip rather than mis-attach
-    (groups[sdk] ||= []) << slice
-  end
-end
-
-def _sentry_sdk_for_slice(slice_id)
-  return 'maccatalyst' if slice_id.include?('-maccatalyst')
-  simulator = slice_id.end_with?('-simulator')
-  case
-  when slice_id.start_with?('ios-')     then simulator ? 'iphonesimulator' : 'iphoneos'
-  when slice_id.start_with?('tvos-')    then simulator ? 'appletvsimulator' : 'appletvos'
-  when slice_id.start_with?('watchos-') then simulator ? 'watchsimulator' : 'watchos'
-  when slice_id.start_with?('xros-')    then simulator ? 'xrsimulator' : 'xros'
-  when slice_id.start_with?('macos-')   then 'macosx'
-  end
-end

scripts/update-cocoa.sh

@@ -1,24 +1,60 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-file="$(dirname "$0")/../packages/core/RNSentry.podspec"
-content=$(cat $file)
+script_dir="$(cd "$(dirname "$0")" && pwd)"
+podspec="$script_dir/../packages/core/RNSentry.podspec"
+utils="$script_dir/../packages/core/scripts/sentry_utils.rb"
+
+content=$(cat "$podspec")
 regex="(sentry_cocoa_version *= *)'([0-9\.]+)'"
 if ! [[ $content =~ $regex ]]; then
-    echo "Failed to find the plugin version in $file"
+    echo "Failed to find the plugin version in $podspec"
     exit 1
 fi
 
 case $1 in
 get-version)
-    echo ${BASH_REMATCH[2]}
+    echo "${BASH_REMATCH[2]}"
     ;;
 get-repo)
     echo "https://github.com/getsentry/sentry-cocoa.git"
     ;;
 set-version)
-    newValue="${BASH_REMATCH[1]}'$2'"
-    echo "${content/${BASH_REMATCH[0]}/$newValue}" >$file
+    new_version="$2"
+
+    # 1. Update `sentry_cocoa_version` in the podspec.
+    newValue="${BASH_REMATCH[1]}'$new_version'"
+    printf '%s\n' "${content/${BASH_REMATCH[0]}/$newValue}" >"$podspec"
+
+    # 2. Refresh the `Sentry.xcframework.zip` SHA256 checksum in
+    #    `sentry_utils.rb`. The checksum table has a single version key
+    #    that we rewrite in place — download the new archive, compute
+    #    its SHA256, then patch the version key and the `'Sentry'` line.
+    #    `pod install` verifies against this checksum on every fresh
+    #    install so a stale value here breaks every user's build with a
+    #    loud mismatch error rather than a silent corruption.
+    zip_url="https://github.com/getsentry/sentry-cocoa/releases/download/${new_version}/Sentry.xcframework.zip"
+    tmp_dir=$(mktemp -d)
+    trap 'rm -rf "$tmp_dir"' EXIT
+    echo "Fetching ${zip_url}..."
+    curl -fsSL --retry 3 -o "$tmp_dir/Sentry.xcframework.zip" "$zip_url"
+    new_sha=$(shasum -a 256 "$tmp_dir/Sentry.xcframework.zip" | awk '{print $1}')
+    echo "Sentry.xcframework.zip SHA256: ${new_sha}"
+
+    # Update the version key (any semver-shaped key opening the hash).
+    perl -i -pe "s|'\\d+\\.\\d+\\.\\d+' => \\{|'${new_version}' => {|" "$utils"
+    # Update the `Sentry` checksum (a 64-char lowercase hex string).
+    perl -i -pe "s|'Sentry' => '[a-f0-9]{64}'|'Sentry' => '${new_sha}'|" "$utils"
+
+    # Sanity-check: both lines got rewritten with the new values.
+    if ! grep -q "'${new_version}' =>" "$utils"; then
+        echo "Failed to rewrite the checksum version key in $utils"
+        exit 1
+    fi
+    if ! grep -q "'Sentry' => '${new_sha}'" "$utils"; then
+        echo "Failed to rewrite the Sentry checksum in $utils"
+        exit 1
+    fi
     ;;
 *)
     echo "Unknown argument $1"