#Swift Package Registry configuration

OSA Proxy supports scanning Swift Package Registry release lists and ZIP archives.

#OSA Proxy configuration

swift:
  enabled: true
  repository:
    - name: swift
      registry: https://artifactory.example.com/artifactory/api/swift/swift-remote
      scan-manifest: true
      scan-package: true
      remove-blocked-versions: false
      work-mode: strict_wait

The scan-manifest parameter enables package release list scanning, while scan-package enables scanning the ZIP archive of a specific release before download.

#Connecting SwiftPM

The following example assumes that the OSA Proxy route is available at https://osa-proxy.example.com/swift:

swift package-registry set --global \
  https://osa-proxy.example.com/swift

With --global, the setting applies to all projects for the user and is stored in ~/.swiftpm/configuration/registries.json. To keep the setting in the project and share it through Git, run the command without --global and commit .swiftpm/configuration/registries.json.

By default, SwiftPM uses a registry only for dependencies declared by package identity. Dependencies declared as .package(url: ...) continue to be downloaded from Git and bypass OSA Proxy. To replace available SCM dependencies with registry packages during resolution, use:

swift package resolve --replace-scm-with-registry

SwiftPM cannot replace a Git dependency when the package is absent from the upstream registry. To guarantee registry use, declare the dependency with .package(id: "scope.package-name", ...).

SwiftPM accepts an HTTPS URL in the setup command. For a local HTTP endpoint, use --allow-insecure-http; do not edit registries.json manually:

swift package-registry set --global --allow-insecure-http \
  http://localhost:8080/swift

After configuration, use the regular SwiftPM commands to resolve or add dependencies.

#remove-blocked-versions: false mode

With the default remove-blocked-versions: true, OSA Proxy removes a blocked version from the release list.

With false, the version remains in the list but receives a standard Swift Package Registry problem field with status 410. The problem description contains the blocking CodeScoring policy name. SwiftPM treats the release as unavailable, excludes it from resolution, and selects the next matching version. Unlike Hex, this does not require a separate client-side policy.

The Package.swift file for a selected version passes through OSA Proxy without a separate CodeScoring request. The release contents are checked when the ZIP archive is requested if scan-package is enabled.