Source provenance
Normal publication requires the declared VCS tag for the package version to point at the released commit. The tag and commit are recorded with package metadata and lock state.
Verify identity before convenience.
Package transport crosses repositories, registries, object storage, CI, and developer machines. Zed makes those boundaries explicit: immutable content identity, opt-in code execution, separated public and authenticated origins, and constrained fallback sources.
Core guarantees in the package path
Content identity
Artifacts carry a SHA-256 and byte size. Installation checks the archive before materialization, and frozen restore remains pinned to the recorded digest rather than trusting a mutable filename.
Immutable versions
A published version may be retried only when the bytes are identical. A same-version, different-digest publish is refused rather than silently replacing consumers' dependency history.
Package-authored code is not implicit
Fetching a dependency and executing its scripts are separate security decisions. Zed keeps high-impact behavior off until the caller grants the corresponding permission.
| Capability | Default | Explicit permission |
|---|---|---|
| Dependency build commands | Off | --allow-build |
| Native package-manager prerequisites | Off | --allow-native-deps and an optional pinned manager |
| Pre-install and post-install hooks | Off | --allow-install-hooks |
| Mirror metadata used for fresh range resolution | Not trusted automatically | Signed metadata plus the caller's mirror-metadata trust policy |
Public fallback must prove it is public
Metadata checks
- Repository identity and public visibility must match the requested coordinates.
- Sidecar organization, package, version, SHA-256, size, and download URL are validated.
- Only approved HTTPS GitHub Release or content-addressed CDN download shapes are accepted.
- Fallback responses identify their source instead of impersonating the primary origin.
Artifact checks
- Every upstream redirect is validated against an allowlist.
- Credentials, custom ports, and ambiguous hostnames are rejected.
- A bounded positive content length is required before public proxying.
- Artifact responses receive immutable caching and restrictive security headers.
Private stays private
A failed authenticated origin is not permission to probe private objects through a public worker. Fallback applies only where an independently public source satisfies the same coordinate and content constraints.
Authentication and static content are separated
Public site
zpkg.net is static content with a restrictive Content
Security Policy. It does not store access or refresh tokens in
browser storage and uses the account origin only for a bounded
credentialed session-status request.
Product and API origins
Account UI terminates at app.zpkg.net; authenticated
state changes terminate at the write API. Public registry and CDN
hosts remain read-oriented and cannot manufacture write authority.
For CI and release automation
- Pin exact source and harness commits when a test makes a production-readiness claim.
- Use repository-scoped workflow tokens only for resources owned by that repository.
- Never print credentials, embed them in sidecars, or upload token-bearing diagnostics.
- Run
zed validate, local round-trip tests, and frozen restore before publication. - Treat a green helper-level API test as complementary evidence, not a substitute for the real CLI path.