Three weeks after we announced it, an update on
scua-pkg, because it crossed a real line this week: every
verb in the spec's table is now implemented, along with the trust
machinery and the documentation.
The day-to-day flow works end to end. publish writes a
package into a registry, which is still just a directory.
add resolves it with minimal version selection and writes
the lockfile. vendor materializes the dependency tree into
your project, verify re-checks every hash in the store and
the vendored tree, and run runs your app against it. Around
that sit the explain verbs, why, diff,
sbom, search, because a resolver is only
honest if it can show its work, and the trust pair, trust
and audit, which compute verdicts on your machine from
evidence you chose to import rather than asking you to believe a
badge.
The rules from the announcement held through implementation. No code
runs at install or resolve time. Identity is a recomputable content
hash. Scopes are sealed, so @acme resolves in acme's
registry and nowhere else, and dependency confusion becomes a
configuration error you are told about. Versions are immutable and
yank tombstones rather than deletes, so history cannot be
quietly rewritten.
What it is not yet: launched. There is no public registry today; the plan for that is deliberately modest, a static CDN-served index and a signed transparency log that exists from the first public publish, because first-seen history cannot be retrofitted later. Until then the tool is exercised against directory registries, which, since a directory is a registry, is most of the product anyway.