Verifying packages

Usage

ael pack verify
ael pack verify --json

What it checks

It checks:

• The lock file. That pack.lock still belongs to its manifest and to the project: it matches pack.ael as written and the project's metadata.ael.
• Every package. That each installed package is the one the lock file names: the same name, version, origin and publisher.
• Every file. That each installed compiled file matches the fingerprint the lock file records for it.

Every mismatch is reported with the package and the file it concerns. When everything matches, the command ends with a success status; otherwise with a failure status.

What it never does

ael pack verify changes nothing, uses no network and runs no package code. It never repairs what it finds: to put the installed packages back in line with the lock file, run ael pack install --locked, and to finish an interrupted change, ael pack repair.

When to use it

• In an automated build, after ael pack install --locked, as a final check before building.
• When you suspect that installed files were changed by hand or damaged on disk.
• Before you copy a project, with its installed packages, to a machine without network access.

What a check proves

• A fingerprint proves a file is unchanged. Your project records the address and fingerprint of every private package file, and AEL refuses the file if it ever changes.
• A signature proves who published it. Only OpenEng publishes to the official registry, and every version is signed. A fingerprint alone does not say who made a file.
• Neither grants a permission. A verified package still receives only the capabilities your deployment allows.

Related

• The official registry: signatures and what your tools check.
• Recovering an interrupted change: recovery and an integrity check.