lpm swift-registry

lpm swift-registry              # one-shot setup; idempotent
lpm swift-registry --force      # re-download the signing certificate

Wires swift (the SPM CLI) to talk to LPM.dev Registry's SE-0292 Swift Package Registry. Run once per machine; after that, swift package resolve and lpm install <swift-pkg> both pull from LPM.dev Registry natively — no fork-as-git-dep, no shim.

lpm install auto-runs the same setup the first time it encounters a Swift package in an unconfigured project, so most users never have to invoke lpm swift-registry directly. Sign in with lpm login before resolving a Swift package: LPM.dev Registry requires a valid token for every Swift package request. Reach for this command explicitly when setting up a fresh machine or rotating the signing certificate.

What it does

Four setup steps. Scope, certificate, and signing-trust failures abort the run. Authentication setup warns instead when no token is available or SPM rejects the login:

1. Set the registry for the lpmdev scope. Runs swift package-registry set --scope lpmdev <registry-url>/api/swift-registry. Adds --allow-insecure-http only for http:// registry URLs (local dev); the hosted LPM.dev Registry endpoint is HTTPS-only.
2. Log in. Resolves the LPM.dev Registry bearer token through the standard LPM CLI session manager (env var → keychain → OIDC) and calls swift package-registry login --token <token> --no-confirm. HTTPS only — SPM refuses to send auth over HTTP. If no token is found, this step warns and is skipped; setup can finish, but every Swift package request returns 401 until you run lpm login.
3. Install the signing certificate. Downloads the CMS signing cert (DER) from <registry-url>/api/swift-registry/certificate and writes it to ~/.swiftpm/security/trusted-root-certs/lpm.der. The DER body is size-checked before being written — an empty / truncated / HTML-error response aborts instead of leaving a broken cert on disk.
4. Configure the SPM signing trust policy. Writes ~/.swiftpm/configuration/registries.json with a default signing.onUnsigned = "warn" + signing.onUntrustedCertificate = "warn" policy and a scope-specific override pinning lpmdev to signing.onUntrustedCertificate = "silentAllow". See Trust model for the rationale.

Idempotent — already-configured paths short-circuit silently, so re-running is safe.

The existing ~/.swiftpm/configuration/registries.json file has a 16 MiB limit enforced before JSON parsing. Missing retains the setup command's normal create behavior; an oversized file fails with its path and byte limit instead of being treated as absent or overwritten. See local configuration size limits.

--force

lpm swift-registry --force

Re-downloads the signing certificate even when a valid one is on disk. Use after a documented cert rotation. A failed --force re-download is fatal even if a stale cert is still on disk — silently keeping the stale cert would defeat the explicit rotation the user asked for.

JSON output

lpm swift-registry --json

Emits a structured envelope describing what was configured:

Flags

Plus the global flags — --json is documented above; --registry <URL> redirects the configured base URL.

Prerequisites

• swift on PATH (steps 1 and 2 spawn it). Without Swift installed, lpm swift-registry errors with Is Swift installed? and exits.
• An LPM CLI session (lpm login). LPM.dev Registry requires a valid token for all Swift package resolution, including packages that would otherwise be public.

See also

• Swift Package Registry (SE-0292) — design overview, identity mapping, trust model, wire format
• Using LPM CLI with Swift — end-to-end setup + publish walkthrough
• lpm install — the right command for Swift dependencies (auto-runs this setup on first encounter)
• lpm publish — publishes Swift packages with CMS signatures