swiftreg

Documentation

Overview

Package swiftreg verifies SwiftPM Package.resolved pins against the upstream repositories' real tags, fetched anonymously over git smart-HTTP (one GET per repository, no API rate limits — the same channel internal/taglink and internal/actreg use).

SwiftPM has no registry in practice: a Package.resolved pin IS a git repository URL, a version, and the commit the version's tag resolved to. That makes two things checkable against the source of truth:

• the version's tag still exists upstream. Version pins can only ever resolve from tags, so an incoming version with no matching tag today means the tag was deleted or renamed after someone resolved it — the unlisted flag;
• the pinned commit is what the upstream tag points at TODAY. Released tags are supposed to be immutable. A mismatch means the tag has been re-pointed since resolution (how the tj-actions attack shipped) or the lockfile was edited to fetch a different commit while displaying an innocent version — the tag-mismatch flag.

Repositories that cannot be fetched anonymously (private, moved, SSH-only) produce no claims at all.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff) (bool, error)

Variables

var Concurrency = 8

Concurrency bounds parallel ref fetches.

var Enabled = true

Enabled gates the whole layer; the browser (wasm) build sets it to false — git smart-HTTP endpoints send no CORS headers.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff) (bool, error)

Annotate verifies Swift package pins in place. ok reports whether at least one repository's refs were checked.