Formats and running it
A Swift package registry for SwiftPM
Switch on Swift package registry under Settings, Registries, Package types, add a git host like https://github.com as an upstream, and the box answers /swift/ as a Swift package registry.
Point SwiftPM at it and log in with your token as the password:
swift package-registry set --global https://packages.example.com/swift/
swift package-registry login https://packages.example.com/swift/ --username your-user-name --password "$REPO_TOKEN" --no-confirmDependencies are then named by identity, scope.name: .package(id: "apple.swift-log", from: "1.6.0") is github.com/apple/swift-log. A dependency still written as a GitHub url goes to GitHub, unless you add --replace-scm-with-registry to swift package resolve or swift build.
A package is a repository, and its semver tags are its releases, read from git's own ref listing rather than the host's API, so there is no API rate limit. The box fetches a tag's archive once, keeps and scans it, reads Package.swift out of that copy, and hands SwiftPM the checksum of the copy. A tag moved on the host later changes nothing. The release list holds only allowed versions. Rules take identities like apple.swift-log or apple.* and semver ranges like ^1.5.0.
What applies, and what does not
Rules, the kill switch, quarantine, malware scanning (the OSV known malicious check included), requests, auto approve and safe version resolution all apply. Advisories come from OSV's SwiftURL feed.
Honest limits: publishing is not taken. SwiftPM warns that each source archive is not signed, since ForgeRepo™ does not sign archives, though it still checks each one against the checksum the box gives. Swift packages name no license where the box can read it, so they count as unknown under license policy. Git tags give no publish time, so cooling off follows the A version with no publish time setting, which lets them through by default. Typosquat checks, provenance checks and the tree walk are not offered for Swift.
In short
- SE-0292 package registry for SwiftPM
- Semver tags of GitHub repositories served as releases
- Each archive fetched once, scanned and kept, so moved tags change nothing
- Rules on identities like
apple.swift-log - Advisories from OSV's SwiftURL feed
- No publishing, and archives are not signed
In the documentation
- Set up SwiftPM Developer Guide
- When SwiftPM cannot get a package Developer Guide
- Swift package registry Administrator Guide
Goes well with
- CocoaPods CDN mirror pod install through a CDN that lists only allowed pods, with their code fetched, checked and scanned here.
- Allow lists and block lists Whitelist or blacklist by name, scope, wildcard or version range, for every type. A blocked version is not even listed to the client.
- Vulnerability monitoring OSV, CISA KEV and FIRST EPSS against everything allowed and cached. npm audit answered locally.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.