{"record":{"id":"1960b5ad50c28ed4","repo":"BoundaryML/baml","slug":"sdk-swift-must-record-the-verified-xcframework-package","errorCode":null,"errorMessage":"sdk swift must record the verified XCFramework package digest","messagePattern":"sdk swift must record the verified XCFramework package digest","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_release/src/manifest.rs","lineNumber":181,"sourceCode":"    }\n    if let Some(digest) = &package.verified_package_sha256 {\n        validate_sha256(digest)\n            .map_err(|error| anyhow::anyhow!(\"sdk {language} package digest: {error}\"))?;\n    }\n    if language == \"csharp\" {\n        if package.registry != \"nuget\" || package.package != \"baml-bridge\" {\n            anyhow::bail!(\"sdk csharp must identify nuget/baml-bridge\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk csharp must record the verified NuGet package digest\");\n        }\n    }\n    if language == \"swift\" {\n        if package.registry != \"swiftpm\" || package.package != \"BoundaryML/baml-swift\" {\n            anyhow::bail!(\"sdk swift must identify swiftpm/BoundaryML/baml-swift\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk swift must record the verified XCFramework package digest\");\n        }\n    }\n    Ok(())\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    fn full_target_artifacts() -> BTreeMap<String, Artifact> {\n        SUPPORTED_RELEASE_TARGETS\n            .iter()\n            .map(|target| {\n                (\n                    (*target).to_string(),\n                    Artifact {\n                        url: format!(\"https://example.com/{target}.tar.gz\"),\n                        sha256: \"a\".repeat(64),","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_release/src/manifest.rs#L163-L199","documentation":"For the pinned Swift SDK (swiftpm/BoundaryML/baml-swift), the manifest must also include verified_package_sha256 — the digest of the verified XCFramework. A swift entry lacking this digest is rejected as unverifiable.","triggerScenarios":"validate_sdk() sees language == \"swift\" with correct swiftpm/BoundaryML/baml-swift fields but verified_package_sha256 is None.","commonSituations":"Adding the swift SDK entry without computing the XCFramework digest; a manifest generator leaving the optional field null; removing the field during cleanup.","solutions":["Compute the SHA-256 of the released XCFramework and set verified_package_sha256","Verify the digest against the checksum published with the baml-swift release","Regenerate the manifest with the release tooling to populate the digest"],"exampleFix":"// before\n[sdk.swift]\nregistry = \"swiftpm\"\npackage = \"BoundaryML/baml-swift\"\n\n// after\n[sdk.swift]\nregistry = \"swiftpm\"\npackage = \"BoundaryML/baml-swift\"\nverified_package_sha256 = \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"","handlingStrategy":"validation","validationCode":"fn swift_digest_present(p: &SdkPackage) -> bool {\n    p.verified_package_sha256.as_deref().map_or(false, |d| !d.is_empty())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Hash the released XCFramework and store it in the manifest at release time","Cross-check against the checksum published with the baml-swift release","Treat verified_package_sha256 as required for swift, not optional"],"tags":["manifest","sdk","supply-chain","swift"],"backgroundTag":"missing-required-config-field","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}