The official registry

Package names on this page are preview naming and may change before launch.

Published only by OpenEng

• Only OpenEng will publish to the official registry. There will be no accounts and no uploads: you will not be able to publish your own packages there. You will build and host your own packages yourself; see Private packages.
• Every version will be signed by OpenEng, and your tools will check the signature before they use anything.
• A published version will never change. A package name and version will always mean the same package file, so a lock file that names it will never be given a different file.
• The official registry will never host or list private packages.

Every official package will be written in AEL and ship as compiled, verified AEL, with no bundled native code and no install scripts, like every other AEL package.

A static signed registry

The registry will be static: signed index files that list each package and its versions, and the package files themselves, served as plain files. You will not need an account to use it. Your tools will decide what to accept by checking signatures and fingerprints on your own machine, not by trusting the server that sent them.

Using an official package

An official package will be declared with a registry source and the publisher openeng:

{ name = "server/http"; version = "^1.2.0"; kind = "runtime";
  source = { kind = "registry"; };
  features = []; targets = []; capabilities = ["net.listen"];
  publisher = "openeng"; }

The source's optional origin will default to https://pack.ael.openeng.ai, so an official dependency will never need to name it. ael pack add server/http (command names may change before launch) will write this entry for you, resolve the version and install it. The Package catalog lists the families of official packages planned for the beta.

What your tools will check

Before a package from the registry is installed, AEL will check, and refuse the package if any check fails:

1. The signature. That the index entry for the package and version is signed by OpenEng. Anything signed by another key, or not signed at all, will be refused.
2. The fingerprint. That the package file matches the fingerprint in the signed index, and later the fingerprint in your lock file.
3. The contents. That the file holds compiled AEL only, every compiled component matches its description, and the name inside is the name you asked for.
4. How it was built. That the package's build record ties it to the AEL source and the toolchain that built it.

The whole file will be checked before anything is written into your project, and nothing in a package will run while it is checked or installed. Once a package is installed, your lock file will pin it: builds will repeat, even offline, and nothing will download when an app starts. Security and provenance describes every check in detail.

Official will mean official

AEL will never treat an external package as an official one, even if its name matches. A package will be official only when it comes from the official registry, published and signed by OpenEng.

• A private package with the same name as an official one will always be a different package, and it will never carry the publisher openeng.
• If a private package cannot be reached, AEL will never fall back to the official registry.
• An unknown name will be an error. AEL will never guess at a misspelled name or pick a package whose name merely looks similar.