# Bitchat Project Dependencies: Complete Swift Package Guide (2024)

> Discover Bitchat project dependencies managed by Swift Package Manager. Explore Arti, BitFoundation, BitLogger, swift-secp256k1, and arti.xcframework for Tor networking.

- Repository: [permissionlesstech/bitchat](https://github.com/permissionlesstech/bitchat)
- Tags: getting-started
- Published: 2026-08-06

---

**Bitchat's dependencies are managed entirely through Swift Package Manager, with four top-level dependencies declared in [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift): three local packages (`Arti`, `BitFoundation`, `BitLogger`) and one remote package (`swift-secp256k1`), plus a pre-compiled Rust binary framework (`arti.xcframework`) for Tor networking.**

Bitchat is an iOS and macOS application for anonymous peer-to-peer messaging. Understanding its dependency structure is essential for contributors, security auditors, and developers building similar Swift Package Manager-based projects. This guide breaks down every dependency, its source, and how it's used throughout the codebase.

## Top-Level Dependencies in Package.swift

The root [[`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift)](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift) defines the complete dependency graph at lines 18-23. Bitchat uses **no CocoaPods or Carthage** — everything flows through Swift Package Manager.

| Dependency | Source | Version | Purpose |
|------------|--------|---------|---------|
| **Arti** | Local (`localPackages/Arti`) | — | Tor anonymity network integration |
| **BitFoundation** | Local (`localPackages/BitFoundation`) | — | Core utilities and data structures |
| **BitLogger** | Local (`localPackages/BitLogger`) | — | Structured logging infrastructure |
| **swift-secp256k1** | Remote | exact 0.21.1 | Elliptic curve cryptography (`P256K`) |

These dependencies support **iOS 16+** and **macOS 13+**, declared at the top of the root [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift).

## Local Package Structure

Bitchat organizes shared code into three **path-based local packages** under `localPackages/`. This approach keeps the codebase modular while avoiding external repository dependencies for core functionality.

### BitLogger: Zero-Dependency Logging

[[`localPackages/BitLogger/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitLogger/Package.swift)](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitLogger/Package.swift) exports a pure-Swift logging library with no external dependencies:

```swift
import BitLogger

let logger = Logger(category: "Network")
logger.info("Connection established")
logger.debug("Received payload: \(bytes.count) bytes")

```

BitLogger serves as the **foundational dependency** for the other local packages.

### BitFoundation: Building on BitLogger

[[`localPackages/BitFoundation/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitFoundation/Package.swift)](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitFoundation/Package.swift) provides reusable utilities:

```swift
import BitFoundation

let uuid = UUIDGenerator.random()
let base58 = Base58Encoder.encode(data)

```

This package declares `BitLogger` as its only dependency, creating a clean layering pattern.

### Arti (Tor): Binary Framework Integration

[[`localPackages/Arti/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/Arti/Package.swift)](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/Arti/Package.swift) is the most complex local package. It exports the `Tor` library used for anonymous networking:

```swift
import Tor

let session = TorURLSession()
let request = URLRequest(url: URL(string: "https://example.onion")!)
session.dataTask(with: request) { data, response, error in
    // Response routed through Tor network
}.resume()

```

The Tor package depends on:
- `BitLogger` for operational logging
- A **binary target** `arti.xcframework` (Rust-compiled static library)

The binary target definition appears at lines 40-45 of Arti's [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift):

```swift
.binaryTarget(
    name: "arti",
    path: "arti.xcframework"
)

```

This demonstrates how Swift Package Manager handles **pre-compiled native dependencies** alongside pure Swift code.

## External Cryptography: swift-secp256k1

The sole **remote dependency** is [`21-DOT-DEV/swift-secp256k1`](https://github.com/21-DOT-DEV/swift-secp256k1), pinned to **exact version 0.21.1** for supply chain security:

```swift
import P256K  // Product from swift-secp256k1 package

// Generate secp256k1 keypair for Bitcoin-compatible cryptography
let privateKey = try P256K.Signing.PrivateKey()
let publicKey = privateKey.publicKey.compactRepresentation

// Sign a message
let message = Data("chat message".utf8)
let signature = try privateKey.signature(for: message)
let derSignature = signature.derRepresentation

```

This dependency provides the **secp256k1 elliptic curve implementation** required for cryptographic identity and message signing in Bitchat's protocol.

## Dependency Graph Visualization

```

Bitchat App Target
├── Tor (from Arti local package)
│   ├── arti.xcframework (binary)
│   └── BitLogger
├── BitFoundation
│   └── BitLogger
├── BitLogger (direct)
└── P256K (from swift-secp256k1 0.21.1)

```

The graph shows **BitLogger as the common foundation**, with `Arti` and `BitFoundation` building upward, and cryptographic primitives coming from the single external repository.

## Platform Requirements and Constraints

All dependencies respect the platform minimums declared in the root [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift):

- **iOS 16.0+**
- **macOS 13.0+**

These constraints propagate automatically to every local package target, ensuring consistent availability of Swift concurrency features and system frameworks.

## Key Files for Dependency Analysis

| File | Lines | Content |
|------|-------|---------|
| [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift) | 1-30 | Platform targets, product definition, dependency declarations |
| [`localPackages/BitLogger/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitLogger/Package.swift) | full | Pure Swift logging library, zero dependencies |
| [`localPackages/BitFoundation/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitFoundation/Package.swift) | full | Core utilities, depends on BitLogger |
| [`localPackages/Arti/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/Arti/Package.swift) | 40-45 | Binary target definition for `arti.xcframework` |

## Summary

- **Four top-level dependencies**: three local packages plus one pinned remote package
- **Zero CocoaPods/Carthage**: Pure Swift Package Manager workflow
- **Binary framework integration**: Rust-compiled `arti.xcframework` for Tor networking
- **Hierarchical local packages**: BitLogger → BitFoundation/Arti → App
- **Exact version pinning**: `swift-secp256k1` locked to 0.21.1 for reproducible builds

## Frequently Asked Questions

### Does Bitchat use CocoaPods or Carthage?

No. Bitchat uses **Swift Package Manager exclusively**. All dependencies are declared in [`Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift) files, with local packages referenced via path dependencies and the cryptography library pulled from a remote GitHub repository.

### What is the `arti.xcframework` binary target?

The `arti.xcframework` is a **pre-compiled Rust static library** that provides the core Tor anonymity network implementation. It's defined as a `binaryTarget` in [`localPackages/Arti/Package.swift`](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/Arti/Package.swift) and wrapped by Swift code that exposes the `Tor` product to the main application.

### Why does Bitchat pin `swift-secp256k1` to an exact version?

Exact version pinning (`exact: 0.21.1`) prevents **supply chain attacks** and ensures **reproducible builds**. Cryptographic libraries require careful auditing; automatic updates could introduce breaking changes or compromised code without review.