Packages

This page lists the release a pipeline manifest names. The mirror also answers the logview builds that release's tooling pin records: the package's own install step fetches the pinned build for the current platform from this registry and stages it in a host-local tooling cache. Those builds are artefacts of the install step rather than separately installable packages, so they are not listed above; the pin that names them is recorded in the release's lib/toolchain.json. Every other application dependency resolves from the registry the project is configured with.

The tooling package is also published to the public registry at the same version, so a host with outbound access resolves it without pointing at this mirror. The mirror exists for hosts inside the network boundary. The build this mirror serves is the one the release was qualified against, so a host that takes the release from here has the exact bytes the pin names, and the release's install step checks them against the pin before it stages anything. For the release listed above, the SHA-512 in that row is its digest: both this mirror and the public registry serve byte-for-byte the same tarball for 1.0.1, so that one value reconciles against either source. The per-platform logview builds are not listed above and carry no digest here; the release's install step verifies each one against the value recorded in lib/toolchain.json before staging it. A package resolved from the public registry under a different version is on the upstream publisher's copy, which may have been repacked; it is a valid install, but its integrity record is that registry's own.