A CocoaPods CDN mirror

Put the box at the top of the Podfile in place of the default source, and give pod the login in ~/.netrc:

source 'https://packages.example.com/cocoapods/'
platform :ios, '15.0'

target 'App' do
  pod 'Alamofire', '~> 5.9'
end

machine packages.example.com login your-user-name password <your token>

The shards pod reads list only the pods and versions the rules allow. Rules take names like Alamofire or Firebase* and requirements like ~> 5.9.

The CDN only describes pods. Their code usually lives in a git tag on GitHub, so a podspec is handed out with its source pointed at the box. The box fetches the code itself, as the tag's archive from GitHub or GitLab or the http archive the podspec names, checks it against any checksum the podspec gives, keeps and scans it, and serves that copy. pod never goes to GitHub for it.

What applies, and what does not

Rules, the kill switch, quarantine, malware scanning, license policy from the podspec, requests and auto approve all apply.

Honest limits: OSV has no CocoaPods feed, so pods get no advisories, no safe version resolution and no known malicious check. The CDN gives no publish times, so cooling off follows the A version with no publish time setting, which lets them through by default. A source that cannot be fetched as a fixed archive (a branch, a commit, submodules or svn) is refused with the reason, and a source on an internal address is never fetched. Pods are not published here. Typosquat checks, provenance checks and the tree walk are not offered for pods.