Package registry

RunMat Server can distribute versioned packages to authorized projects and clients. A published package version is immutable: corrections require a new version so dependency resolution remains reproducible.

Publishers authenticate, submit package metadata and content, and receive a version identity after validation. Consumers resolve declared dependencies under organization and registry access policy. Keep signing, provenance, content hashes, and audit records available for incident response.

Administrators should restrict publishing rights, define namespace ownership, scan or review executable content, and establish retention rules that preserve versions referenced by existing lock states. Revocation blocks new resolution; incident response must also account for code already present in caches or artifacts.

Package authors should use the Runtime guides for Publishing packages and Package security.

Namespaces and versions

A package coordinate consists of its namespace, name, and semantic version. Namespace ownership controls who can publish. The registry stores the manifest, dependency metadata, content identity, publisher, and publication time. Once published, that coordinate always resolves to the same content.

Projects declare version constraints and resolve a concrete graph. Commit the lock state used by Desktop, CLI, CI, and remote workers. A worker restores that graph before execution, independent of newer registry releases.

Publishing controls

Limit publish permission to service identities or maintainers responsible for the namespace. Validate the archive before accepting it: normalized paths, allowed size, manifest schema, name/version match, dependency constraints, and content hash. Scan executable content according to organization policy and write an audit record containing publisher and package identity.

Use a new version for every correction. After blocking future resolution of a compromised version, identify affected projects, downloaded caches, build artifacts, and old project locks. Rotate any credential that entered the package.

Operating the registry

Track publish failures, resolution latency, cache hit rate, storage use, denied namespaces, and integrity mismatches. Back up registry metadata and content together. Define retention so locked projects remain restorable. Mirrored or air-gapped registries need an explicit import process that preserves original content hashes and provenance.

Resolution errors usually come from authentication, namespace policy, an unsatisfied version constraint, a missing locked version, or an integrity mismatch. Report the package coordinate and expected hash without including registry credentials.