A Swift package registry is an HTTPS server that hosts Swift packages and lets SwiftPM find, resolve and download them by a scope and name identifier. Clients must verify each download against a SHA-256 checksum, and registries can also carry signatures. Both prove integrity, not safety.
Definition
Instead of resolving a package from a git repository URL, a registry gives each package an identifier such as scope.package-name and each release a SemVer version. The registry specification in the Swift Package Manager repository says a registry must answer six endpoints: list releases, fetch release metadata, fetch the manifest, download the source archive, look up identifiers by repository URL, and create a release.
Transport must use TLS over HTTPS. Authentication is optional for servers, with OAuth 2.0 recommended.
How verification works
| Mechanism | What the spec says | What it proves |
|---|---|---|
| Checksum | Metadata lists a SHA-256 for the source archive, and clients MUST verify downloads against it | The file matches what the registry published |
| Digest header | Responses may include one as an extra check | Same, at transfer time |
| Signature | A signed resource carries a signature and format such as cms-1.0.0, and clients MUST validate it per their configuration | The publisher signed that archive |
Servers should compute checksums with swift package compute-checksum.
What verification does not prove
A matching checksum says the bytes you got are the bytes that were published. If the publisher was compromised, a malicious release would still carry a valid checksum. A valid signature shows who signed, not that the code is free of vulnerabilities.
So registries improve the chain of custody, but you still need to know which versions you use and whether they have known issues.
Questions to ask before adopting one
- Who runs the registry, and how do publishers authenticate? The spec recommends considering multi factor authentication.
- Does it require signed packages, or are signatures optional?
- How do you configure the client so it checks signatures?
- Can you list every package and version that came from it?
- What is the process when a release must be withdrawn?
Try it yourself
Click through it at your own pace, or open it full screen. See how a dependency you already verified can still be flagged later when a new advisory appears.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Is a registry required to use SwiftPM?
No. SwiftPM resolves packages from git repositories by URL. A registry is an alternative way to host and identify them.
Does a signed package mean it is safe?
No. A signature identifies the signer and shows the archive was not altered. It does not assess the code.
Sources
Last reviewed: 19 October 2026.
