A Swift package can ship a precompiled SDK as a binary target. You give it a URL to an archive and a checksum of that archive. The checksum applies to the archive file, not to the binary inside it. It helps you detect that the file changed, but it says nothing about whether the code is safe.
What the documentation says
Swift's package description reference says a binary target provides the URL to a pre-built binary artifact. The URL must point to an archive file that contains a binary artifact in its root directory. The checksum is the checksum of the archive file. Binary targets are available only on Apple platforms.
A manifest entry looks like this, with placeholders:
.binaryTarget(
name: "ExampleSDK",
url: "https://example.com/releases/ExampleSDK.xcframework.zip",
checksum: "<checksum of the archive>"
)
Apple's third-party SDK requirements add a related rule: when a listed SDK is used as a binary dependency, signatures are required, and Xcode validates that a new version was signed by the same developer.
What a checksum gives you
| It helps with | It does not help with |
|---|---|
| Noticing that the archive at a URL changed | Telling you the archive is free of vulnerabilities |
| Making builds repeatable for that version | Showing what open source code is inside |
| Catching an accidental or silent swap | Showing who built it, beyond Apple's signature checks |
Treat it as an integrity check on a file, not a trust decision on a vendor.
Source SDK or binary SDK
| Question | Source package | Binary package |
|---|---|---|
| Can you read the code? | Yes | No |
| Does a scanner see inner dependencies? | Often, through manifests | Only if the vendor tells you |
| Can you rebuild it? | Yes | No |
| Update path | Version bump | New archive and checksum |
If you have a choice, a source package is easier to inventory and to audit. If you must use a binary, ask more of the vendor.
What to ask a binary SDK vendor
- What open source components are bundled, with versions? Ask for an SBOM.
- How do you handle and announce security issues?
- How do you sign releases?
- What data does the SDK collect, and is there a privacy manifest?
- How long will you support each version?
Steps for your team
- Record each binary dependency with vendor, version and the checksum you pinned.
- Review checksum changes in code review, as you would a version bump.
- Keep vendor answers with the release record.
- Re-ask on major updates.
For general Swift pinning behavior, see Swift Package Manager dependency resolution and pinning.
Quick check
Does a matching checksum mean the SDK is safe?
No. It means the file matches the checksum you recorded.
Can a scanner see inside a binary SDK?
Manifest scanning cannot. You depend on the vendor's SBOM or on a binary analysis tool.
Safeguard scans dependency manifests and SBOMs, so a vendor SBOM for a binary SDK is something it can work from. It does not analyze compiled mobile binaries. See the free scan.
Sources
Last reviewed: 19 October 2026.
