Swift Package Registry

LPM.dev Registry implements the SE-0292 Swift Package Registry API. Swift Package Manager (SPM) resolves Registry-hosted packages natively, including versions, manifests, archives, checksums, and signatures.

Install a Swift package

Use LPM CLI as the normal entry point:

lpm login
lpm install @lpm.dev/acme.swift-logger

LPM.dev Registry requires authentication for every Swift package request, including packages available through Pool or Marketplace.

When the machine is not configured for the Registry, lpm install starts the Swift registry setup automatically. It then resolves the package and updates the project according to its structure.

Projects with Package.swift

For a Swift package or executable that already has Package.swift, LPM CLI:

  1. Resolves the requested LPM.dev Registry package and product.
  2. Adds the SE-0292 package identity to dependencies.
  3. Adds the product to the selected target.
  4. Runs swift package resolve.
// swift-tools-version: 5.9
import PackageDescription

let package = Package(
    name: "MyApp",
    dependencies: [
        .package(id: "lpmdev.acme_swift-logger", from: "1.0.0"),
    ],
    targets: [
        .target(
            name: "MyApp",
            dependencies: [
                .product(
                    name: "SwiftLogger",
                    package: "lpmdev.acme_swift-logger"
                ),
            ]
        ),
    ]
)

When a manifest has multiple compatible targets, LPM CLI asks which target should receive the product. --yes does not choose a target automatically.

Xcode-only projects

If the project has an .xcodeproj but no root Package.swift, LPM CLI creates a local dependency host at Packages/LPMDependencies, links it into the Xcode project, adds the Registry package, and resolves it with SPM.

This keeps Registry dependencies managed by SPM without requiring the application itself to become a standalone Swift package.

See the LPM CLI install reference for the complete project-detection and manifest-editing behavior.

Explicit setup and repair

Most users can begin with lpm install. Run the dedicated setup command when preparing a machine explicitly:

lpm swift-registry

Use --force when a documented certificate rotation requires a fresh certificate:

lpm swift-registry --force

The setup path:

  1. Points the SPM lpmdev scope to https://lpm.dev/api/swift-registry.
  2. Passes the current LPM.dev Registry token to SPM.
  3. Downloads the Registry CMS signing certificate.
  4. Writes the scope-specific SPM signing trust policy.

Scope, certificate, and trust-policy failures stop setup. If no token is available or SPM rejects the login, setup warns instead; package resolution will continue returning 401 until the user completes lpm login.

For flags, JSON output, certificate rotation, and local configuration paths, see the LPM CLI swift-registry reference.

Package identity

LPM.dev Registry names map to SE-0292 identities:

LPM.dev Registry nameSE-0292 identity
@lpm.dev/acme.swift-loggerlpmdev.acme_swift-logger
@lpm.dev/design-team.tokenslpmdev.design-team_tokens

The mapping has three parts:

  • The @lpm.dev/ scope becomes lpmdev.
  • The dot between the owner and package becomes an underscore.
  • Hyphens inside the owner or package name stay unchanged.

LPM CLI performs this translation automatically.

Package signing

LPM.dev Registry signs Swift source archives with a CMS detached signature using ECDSA P-256 and SHA-256. SPM verifies the signature against the downloaded archive.

The current trust model provides:

  • Archive integrity. Changing the signed archive causes verification to fail.
  • HTTPS transport authenticity. The HTTPS connection to LPM.dev Registry authenticates the origin that serves the certificate and package.

The Registry certificate is self-signed and is not chained to a system certificate authority. Setup writes a silentAllow rule limited to the lpmdev scope so SPM accepts that signer while continuing to perform the CMS integrity check.

The signer represents LPM.dev Registry, not the individual package author. The signature therefore attests that the archive came from the Registry; it does not provide per-author cryptographic attribution.

Transitive dependencies

Swift packages can depend on other LPM.dev Registry packages and on Git-hosted Swift packages. SPM resolves both in the same dependency graph:

MyApp
└── @lpm.dev/acme.swift-network
    ├── @lpm.dev/acme.swift-logger
    └── swift-nio

Use lpm install for Swift library dependencies. lpm add is source delivery and is not the recommended Swift dependency workflow.

Publish a Swift package

Swift publishing requires package.json for the LPM.dev Registry identity and version, plus a root Package.swift for the Swift manifest:

{
  "name": "@lpm.dev/acme.swift-logger",
  "version": "1.0.0"
}
lpm publish --check
lpm publish

LPM CLI detects Package.swift automatically and reads its products, targets, platforms, dependencies, and tools version. Authors do not need to set lpm.config.json > ecosystem.

LPM.dev Registry creates the SE-0292 source archive, records its checksum, and signs it for SPM clients. See Publishing Packages for the private and reviewed public release paths.

See also