Swift Package Manager doesn't check for unsafe flags when the dependency uses `revision`

Hello All!

I'm currently developing a reverse-engineering toolkit here:

As I have chosen the approach to split my code into multiple targets, and since multi-target documentation isn't officially supported yet, I worked out a modified version of the method described in this blog post to work around this:

In a Swift Package Manager context, this currently requires the use of unsafe flags, which will cause SPM to block your package from being used as a dependency. I realized this was the case, and commented out the flags while looking for a solution. I thought I found one by limiting the unsafe flags to the debug configuration only, as I tested that with revision. Only now do I realize that it's revision that was actually causing SPM not to complain.

In short:

Using this as a dependency will trigger SPM's anti-unsafe-flags requirement:

.package(url: "https://github.com/nmggithub/Kass", exact: "1.0.1-withflags")

Using this as a dependency won't do so (despite it pointing to the same exact commit):

.package(url: "https://github.com/nmggithub/Kass", revision: "49eeeb20a76e130ef65cf599e2181d84398f1838")

I would assume this has something to do with the idea that revision is meant to be used for testing, but I don't know if this behavior is documented anywhere. And it actually honestly leads to more confusion, as you won't be made aware that your package can't actually be a dependency until you put out an actual release. There might also be security concerns, but I'm not sure if this anti-unsafe-flags requirement was meant to be a security feature or not.

1 Like

It's intentional that only versioned-based dependencies prohibit unsafe flags, but it seems like you're right that this isn't really documented anywhere.

As for the confusion, something like RFC: swift package publish-precheck was supposed to solve that, but unfortunately that hasn't materialized so far.

1 Like

Thanks for the note. I'll keep this in mind in the future.