Bitchat Project Dependencies: Complete Swift Package Guide (2024)

Bitchat's dependencies are managed entirely through Swift Package Manager, with four top-level dependencies declared in Package.swift: three local packages (Arti, BitFoundation, BitLogger) and one remote package (swift-secp256k1), plus a pre-compiled Rust binary framework (arti.xcframework) for Tor networking.

Bitchat is an iOS and macOS application for anonymous peer-to-peer messaging. Understanding its dependency structure is essential for contributors, security auditors, and developers building similar Swift Package Manager-based projects. This guide breaks down every dependency, its source, and how it's used throughout the codebase.

Top-Level Dependencies in Package.swift

The root [Package.swift](https://github.com/permissionlesstech/bitchat/blob/main/Package.swift) defines the complete dependency graph at lines 18-23. Bitchat uses no CocoaPods or Carthage — everything flows through Swift Package Manager.

Dependency	Source	Version	Purpose
Arti	Local (localPackages/Arti)	—	Tor anonymity network integration
BitFoundation	Local (localPackages/BitFoundation)	—	Core utilities and data structures
BitLogger	Local (localPackages/BitLogger)	—	Structured logging infrastructure
swift-secp256k1	Remote	exact 0.21.1	Elliptic curve cryptography (P256K)

These dependencies support iOS 16+ and macOS 13+, declared at the top of the root Package.swift.

Local Package Structure

Bitchat organizes shared code into three path-based local packages under localPackages/. This approach keeps the codebase modular while avoiding external repository dependencies for core functionality.

BitLogger: Zero-Dependency Logging

[localPackages/BitLogger/Package.swift](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitLogger/Package.swift) exports a pure-Swift logging library with no external dependencies:

import BitLogger

let logger = Logger(category: "Network")
logger.info("Connection established")
logger.debug("Received payload: \(bytes.count) bytes")

BitLogger serves as the foundational dependency for the other local packages.

BitFoundation: Building on BitLogger

[localPackages/BitFoundation/Package.swift](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/BitFoundation/Package.swift) provides reusable utilities:

import BitFoundation

let uuid = UUIDGenerator.random()
let base58 = Base58Encoder.encode(data)

This package declares BitLogger as its only dependency, creating a clean layering pattern.

Arti (Tor): Binary Framework Integration

[localPackages/Arti/Package.swift](https://github.com/permissionlesstech/bitchat/blob/main/localPackages/Arti/Package.swift) is the most complex local package. It exports the Tor library used for anonymous networking:

import Tor

let session = TorURLSession()
let request = URLRequest(url: URL(string: "https://example.onion")!)
session.dataTask(with: request) { data, response, error in
    // Response routed through Tor network
}.resume()

The Tor package depends on:

• BitLogger for operational logging
• A binary target arti.xcframework (Rust-compiled static library)

The binary target definition appears at lines 40-45 of Arti's Package.swift:

.binaryTarget(
    name: "arti",
    path: "arti.xcframework"
)

This demonstrates how Swift Package Manager handles pre-compiled native dependencies alongside pure Swift code.

External Cryptography: swift-secp256k1

The sole remote dependency is 21-DOT-DEV/swift-secp256k1, pinned to exact version 0.21.1 for supply chain security:

import P256K  // Product from swift-secp256k1 package

// Generate secp256k1 keypair for Bitcoin-compatible cryptography
let privateKey = try P256K.Signing.PrivateKey()
let publicKey = privateKey.publicKey.compactRepresentation

// Sign a message
let message = Data("chat message".utf8)
let signature = try privateKey.signature(for: message)
let derSignature = signature.derRepresentation

This dependency provides the secp256k1 elliptic curve implementation required for cryptographic identity and message signing in Bitchat's protocol.

Dependency Graph Visualization

Bitchat App Target
├── Tor (from Arti local package)
│   ├── arti.xcframework (binary)
│   └── BitLogger
├── BitFoundation
│   └── BitLogger
├── BitLogger (direct)
└── P256K (from swift-secp256k1 0.21.1)

The graph shows BitLogger as the common foundation, with Arti and BitFoundation building upward, and cryptographic primitives coming from the single external repository.

Platform Requirements and Constraints

All dependencies respect the platform minimums declared in the root Package.swift:

• iOS 16.0+
• macOS 13.0+

These constraints propagate automatically to every local package target, ensuring consistent availability of Swift concurrency features and system frameworks.

Key Files for Dependency Analysis

File	Lines	Content
Package.swift	1-30	Platform targets, product definition, dependency declarations
localPackages/BitLogger/Package.swift	full	Pure Swift logging library, zero dependencies
localPackages/BitFoundation/Package.swift	full	Core utilities, depends on BitLogger
localPackages/Arti/Package.swift	40-45	Binary target definition for arti.xcframework

Summary

• Four top-level dependencies: three local packages plus one pinned remote package
• Zero CocoaPods/Carthage: Pure Swift Package Manager workflow
• Binary framework integration: Rust-compiled arti.xcframework for Tor networking
• Hierarchical local packages: BitLogger → BitFoundation/Arti → App
• Exact version pinning: swift-secp256k1 locked to 0.21.1 for reproducible builds

Frequently Asked Questions

Does Bitchat use CocoaPods or Carthage?

No. Bitchat uses Swift Package Manager exclusively. All dependencies are declared in Package.swift files, with local packages referenced via path dependencies and the cryptography library pulled from a remote GitHub repository.

What is the arti.xcframework binary target?

The arti.xcframework is a pre-compiled Rust static library that provides the core Tor anonymity network implementation. It's defined as a binaryTarget in localPackages/Arti/Package.swift and wrapped by Swift code that exposes the Tor product to the main application.

Why does Bitchat pin swift-secp256k1 to an exact version?

Exact version pinning (exact: 0.21.1) prevents supply chain attacks and ensures reproducible builds. Cryptographic libraries require careful auditing; automatic updates could introduce breaking changes or compromised code without review.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}