You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: proposals/0391-package-registry-publish.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@
24
24
25
25
A package registry makes packages available to consumers. Starting with Swift 5.7,
26
26
SwiftPM supports dependency resolution and package download using any registry that
27
-
implements the [service specification](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md) proposed alongside with [SE-0292](https://github.com/apple/swift-evolution/blob/main/proposals/0292-package-registry-service.md).
27
+
implements the [service specification](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md) proposed alongside with [SE-0292](https://github.com/apple/swift-evolution/blob/main/proposals/0292-package-registry-service.md).
28
28
SwiftPM does not yet provide any tooling for publishing packages, so package authors
29
29
must manually prepare the contents (e.g., source archive) and interact
30
30
with the registry on their own to publish a package release. This proposal
@@ -38,7 +38,7 @@ Publishing package release to a Swift package registry generally involves these
38
38
1. Prepare package source archive by using the [`swift package archive-source` subcommand](https://github.com/apple/swift-evolution/blob/main/proposals/0292-package-registry-service.md#archive-source-subcommand).
39
39
1. Sign the metadata and archive (if needed).
40
40
1.[Authenticate](https://github.com/apple/swift-evolution/blob/main/proposals/0378-package-registry-auth.md) (if required by the registry).
41
-
1. Send the archive and metadata (and their signatures if any) by calling the ["create a package release" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-6).
41
+
1. Send the archive and metadata (and their signatures if any) by calling the ["create a package release" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-6).
42
42
1. Check registry server response to determine if publication has succeeded or failed (if the registry processes request synchronously), or is pending (if the registry processes request asynchronously).
43
43
44
44
SwiftPM can streamline the workflow by combining all of these steps into a single
@@ -58,8 +58,8 @@ Typically a package release has metadata associated with it, such as URL of the
58
58
code repository, license, etc. In general, metadata gets set when a package release is
59
59
being published, but a registry service may allow modifications of the metadata afterwards.
60
60
61
-
The current [registry service specification](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md) states that:
62
-
- A client (e.g., package author, publishing tool) may provide metadata for a package release by including it in the ["create a package release" request](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#462-package-release-metadata). The registry server will store the metadata and include it in the ["fetch information about a package release" response](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-2).
61
+
The current [registry service specification](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md) states that:
62
+
- A client (e.g., package author, publishing tool) may provide metadata for a package release by including it in the ["create a package release" request](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#462-package-release-metadata). The registry server will store the metadata and include it in the ["fetch information about a package release" response](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-2).
63
63
- If a client does not include metadata, the registry server may populate it unless the client specifies otherwise (i.e., by sending an empty JSON object `{}` in the "create a package release" request).
64
64
65
65
It does not, however, define any requirements or server-client API contract on the
@@ -84,7 +84,7 @@ Package release metadata submitted to a registry must be a JSON object of type
@@ -167,7 +167,7 @@ Package release metadata submitted to a registry must be a JSON object of type
167
167
|`description`| String | A description of the package release. ||
168
168
|`licenseURL`| String | URL of the package release's license document. ||
169
169
|`readmeURL`| String | URL of the README specifically for the package release or broadly for the package. ||
170
-
|`repositoryURLs`| Array | Code repository URL(s) of the package. It is recommended to include all URL variations (e.g., SSH, HTTPS) for the same repository. This can be an empty array if the package does not have source control representation.<br/>Setting this property is one way through which a registry can obtain repository URL to package identifier mappings for the ["lookup package identifiers registered for a URL" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#45-lookup-package-identifiers-registered-for-a-url). A registry may choose other mechanism(s) for package authors to specify such mappings. ||
170
+
|`repositoryURLs`| Array | Code repository URL(s) of the package. It is recommended to include all URL variations (e.g., SSH, HTTPS) for the same repository. This can be an empty array if the package does not have source control representation.<br/>Setting this property is one way through which a registry can obtain repository URL to package identifier mappings for the ["lookup package identifiers registered for a URL" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#45-lookup-package-identifiers-registered-for-a-url). A registry may choose other mechanism(s) for package authors to specify such mappings. ||
171
171
172
172
##### `Author` type
173
173
@@ -370,7 +370,7 @@ or `signing.trustedRootCertificatesPath` for package `mona.LinkedList`:
370
370
##### Local TOFU
371
371
372
372
When SwiftPM downloads a package release from registry via the
373
-
["download source archive" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-4), it will:
373
+
["download source archive" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-4), it will:
374
374
1. Search local fingerprints storage, which by default is located at `~/.swiftpm/security/fingerprints/`, to see if the package release has been downloaded before and its recorded checksum. The checksum of the downloaded source archive must match the previous value or else [trust on first use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) check would fail.
375
375
1. Fetch package release metadata from the registry to get:
376
376
<ul>
@@ -445,13 +445,13 @@ Using these inputs, SwiftPM will:
445
445
446
446
Prerequisites:
447
447
- Run [`swift package-registry login`](https://github.com/apple/swift-evolution/blob/main/proposals/0378-package-registry-auth.md#new-login-subcommand) to authenticate registry user if needed.
448
-
- The user has the necessary permissions to call the ["create a package release" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-6) for the package identifier.
448
+
- The user has the necessary permissions to call the ["create a package release" API](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-6) for the package identifier.
449
449
450
450
### Changes to the registry service specification
451
451
452
452
#### Create package release API
453
453
454
-
A registry must update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-6) to handle package release
454
+
A registry must update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-6) to handle package release
455
455
metadata as described in a [previous section](#package-release-metadata) of this document.
456
456
457
457
If the package being published is signed, the client must identify the signature format
A registry may update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-2) for the [metadata changes](#package-release-metadata)
508
+
A registry may update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-2) for the [metadata changes](#package-release-metadata)
509
509
described in this document.
510
510
511
511
If the package release is signed, the registry must include a `signing` JSON
@@ -532,7 +532,7 @@ object in the response:
532
532
533
533
#### Download package source archive API
534
534
535
-
If a registry supports signing, it must update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/Registry.md#endpoint-4)
535
+
If a registry supports signing, it must update [this existing endpoint](https://github.com/apple/swift-package-manager/blob/main/Documentation/PackageRegistry/Registry.md#endpoint-4)
536
536
to include the `X-Swift-Package-Signature-Format` and `X-Swift-Package-Signature` headers in
537
537
the HTTP response for a signed package source archive.
0 commit comments