Verifying packages

Usage

ael pack verify
ael pack verify --json

What it checks

It will check:

• The lock file. That pack.lock still belongs to its manifest and to the project: it matches pack.ael as written and the project's metadata.ael.
• Every package. That each installed package is the one the lock file names: the same name, version, origin and publisher.
• Every file. That each installed compiled file matches the fingerprint the lock file records for it.

Every mismatch will be reported with the package and the file it concerns. When everything matches, the command will end with a success status; otherwise with a failure status.

What it never does

ael pack verify will change nothing, use no network and run no package code. It will never repair what it finds: to put the installed packages back in line with the lock file, run ael pack install --locked, and to finish an interrupted change, ael pack repair.

When to use it

• In an automated build, after ael pack install --locked, as a final check before building.
• When you suspect that installed files were changed by hand or damaged on disk.
• Before you copy a project, with its installed packages, to a machine without network access.

What a check will prove

• A fingerprint will prove a file is unchanged. Your project will record the address and fingerprint of every private package file, and AEL will refuse the file if it ever changes.
• A signature will prove who published it. Only OpenEng will publish to the official registry, and every version will be signed. A fingerprint alone will not say who made a file.
• Neither will grant a permission. A verified package will still receive only the capabilities your deployment allows.

Related

• The official registry: signatures and what your tools check.
• Recovering an interrupted change: recovery and an integrity check.