The official registry

Published only by OpenEng

• Only OpenEng publishes to the official registry. There are no accounts and no uploads: you cannot publish your own packages there. You build and host your own packages yourself; see Private packages.
• Every version is signed by OpenEng, and your tools check the signature before they use anything.
• A published version never changes. A package name and version always mean the same package file, so a lock file that names it is never given a different file.
• The official registry never hosts or lists private packages.

Every official package is written in AEL and ships as compiled, verified AEL, with no bundled native code and no install scripts, like every other AEL package.

A static signed registry

The registry is static: signed index files that list each package and its versions, and the package files themselves, served as plain files. You do not need an account to use it. Your tools decide what to accept by checking signatures and fingerprints on your own machine, not by trusting the server that sent them.

Using an official package

An official package is declared with a registry source and the publisher openeng:

{ name = "server/http"; version = "^1.2.0"; kind = "runtime";
  source = { kind = "registry"; };
  features = []; targets = []; capabilities = ["net.listen"];
  publisher = "openeng"; }

The source's optional origin defaults to https://pack.ael.openeng.ai, so an official dependency never needs to name it. ael pack add server/http writes this entry for you, resolves the version and installs it. The Package catalog lists the package families of AEL 1.0.0.

What your tools check

Before a package from the registry is installed, AEL checks, and refuses the package if any check fails:

1. The signature. That the index entry for the package and version is signed by OpenEng. Anything signed by another key, or not signed at all, is refused.
2. The fingerprint. That the package file matches the fingerprint in the signed index, and then the fingerprint in your lock file.
3. The contents. That the file holds compiled AEL only, every compiled component matches its description, and the name inside is the name you asked for.
4. How it was built. That the package's build record ties it to the AEL source and the toolchain that built it.

The whole file is checked before anything is written into your project, and nothing in a package runs while it is checked or installed. Once a package is installed, your lock file pins it: builds repeat, even offline, and nothing downloads when an app starts. Security and provenance describes every check in detail.

Official means official

AEL never treats an external package as an official one, even if its name matches. A package is official only when it comes from the official registry, published and signed by OpenEng.

• A private package with the same name as an official one is always a different package, and it never carries the publisher openeng.
• If a private package cannot be reached, AEL never falls back to the official registry.
• An unknown name is an error. AEL never guesses at a misspelled name or picks a package whose name merely looks similar.