New – Add Your Swift Packages to AWS CodeArtifact

Starting at the moment, Swift builders who write code for Apple platforms (iOS, iPadOS, macOS, tvOS, watchOS, or visionOS) or for Swift applications working on the server aspect can use AWS CodeArtifact to securely retailer and retrieve their package deal dependencies. CodeArtifact integrates with normal developer instruments equivalent to Xcode, xcodebuild, and the Swift Package Manager (the swift package deal command).

Simple functions routinely embrace dozens of packages. Large enterprise functions may need tons of of dependencies. These packages assist builders velocity up the event and testing course of by offering code that solves widespread programming challenges equivalent to community entry, cryptographic capabilities, or information format manipulation. Developers additionally embed SDKs–such because the AWS SDKs–to entry distant providers. These packages is perhaps produced by different groups in your group or maintained by third-parties, equivalent to open-source initiatives. Managing packages and their dependencies is an integral a part of the software program improvement course of. Modern programming languages embrace instruments to obtain and resolve dependencies: Maven in Java, NuGet in C#, npm or yarn in JavaScript, and pip in Python simply to say a couple of. Developers for Apple platforms use CocoaPods or the Swift Package Manager (SwiftPM).

Downloading and integrating packages is a routine operation for software builders. However, it presents not less than two vital challenges for organizations.

The first problem is authorized. Organizations should be certain that licenses for third-party packages are suitable with the anticipated use of licenses on your particular venture and that the package deal doesn’t violate another person’s mental property (IP). The second problem is safety. Organizations should be certain that the included code is protected to make use of and doesn’t embrace again doorways or intentional vulnerabilities designed to introduce safety flaws in your app. Injecting vulnerabilities in common open-source initiatives is called a provide chain assault and has change into more and more common lately.

To handle these challenges, organizations sometimes set up personal package deal servers on premises or within the cloud. Developers can solely use packages vetted by their group’s safety and authorized groups and made obtainable by personal repositories.

AWS CodeArtifact is a managed service that permits you to safely distribute packages to your inside groups of builders. There is not any want to put in, handle, or scale the underlying infrastructure. We handle that for you, providing you with extra time to work in your apps as an alternative of the software program improvement infrastructure.

I’m excited to announce that CodeArtifact now helps native Swift packages, along with npm, PyPI, Maven, NuGet, and generic package deal codecs. Swift packages are a well-liked technique to package deal and distribute reusable Swift code parts. To discover ways to create your individual Swift package deal, you may comply with this tutorial. The group has additionally created greater than 6,000 Swift packages that you need to use in your Swift functions.

You can now publish and obtain your Swift package deal dependencies out of your CodeArtifact repository within the AWS Cloud. CodeArtifact SwiftPM works with present developer instruments equivalent to Xcode, VSCode, and the Swift Package Manager command line software. After your packages are saved in CodeArtifact, you may reference them in your venture’s Package.swift file or in your Xcode venture, in an analogous method you utilize Git endpoints to entry public Swift packages.

After the configuration is full, your network-jailed construct system will obtain the packages from the CodeArtifact repository, making certain that solely permitted and managed packages are used throughout your software’s construct course of.

How To Get Started
As ordinary on this weblog, I’ll present you the way it works. Imagine I’m engaged on an iOS software that makes use of Amazon DynamoDB as a database. My software embeds the AWS SDK for Swift as a dependency. To adjust to my group insurance policies, the appliance should use a selected model of the AWS SDK for Swift, compiled in-house and permitted by my group’s authorized and safety groups. In this demo, I present you ways I put together my setting, add the package deal to the repository, and use this particular package deal construct as a dependency for my venture.

For this demo, I deal with the steps particular to Swift packages. You can learn the tutorial written by my colleague Steven to get began with CodeArtifact.

I take advantage of an AWS account that has a package deal repository (MySwiftRepo) and area (stormacq-test) already configured.

To let SwiftPM acess my CodeArtifact repository, I begin by gathering an authentication token from CodeArtifact.

export CODEARTIFACT_AUTH_TOKEN=`aws codeartifact get-authorization-token 
                                     --domain stormacq-test              
                                     --domain-owner 012345678912         
                                     --query authorizationToken          
                                     --output textual content`

Note that the authentication token expires after 12 hours. I need to repeat this command after 12 hours to acquire a recent token.

Then, I request the repository endpoint. I go the area identify and area proprietor (the AWS account ID). Notice the --format swift possibility.

export CODEARTIFACT_REPO=`aws codeartifact get-repository-endpoint  
                               --domain stormacq-test               
                               --domain-owner 012345678912          
                               --format swift                       
                               --repository MySwiftRepo             
                               --query repositoryEndpoint           
                               --output textual content`

Now that I’ve the repository endpoint and an authentication token, I take advantage of the AWS Command Line Interface (AWS CLI) to configure SwiftPM on my machine.

SwiftPM can retailer the repository configurations at consumer degree (within the file ~/.swiftpm/configurations) or at venture degree (within the file <your venture>/.swiftpm/configurations). By default, the CodeArtifact login command creates a project-level configuration to can help you use completely different CodeArtifact repositories for various initiatives.

I take advantage of the AWS CLI to configure SwiftPM on my construct machine.

aws codeartifact login          
    --tool swift                
    --domain stormacq-test      
    --repository MySwiftRepo    
    --namespace aws             
    --domain-owner 012345678912

The command invokes swift package-registry login with the proper choices, which in flip, creates the required SwiftPM configuration recordsdata with the given repository identify (MySwiftRepo) and scope identify (aws).

Now that my construct machine is prepared, I put together my group’s permitted model of the AWS SDK for Swift package deal after which I add it to the repository.

git clone https://github.com/awslabs/aws-sdk-swift.git
pushd aws-sdk-swift
swift package deal archive-source
mv aws-sdk-swift.zip ../aws-sdk-swift-0.24.0.zip
popd

Finally, I add this package deal model to the repository.

When utilizing Swift 5.9 or more moderen, I can add my package deal to my personal repository utilizing the SwiftPM command:

swift package-registry publish           
                       aws.aws-sdk-swift 
                       0.24.0            
                       --verbose

The variations of Swift earlier than 5.9 don’t present a swift package-registry publish command. So, I take advantage of the curl command as an alternative.

curl  -X PUT 
      --user "aws:$CODEARTIFACT_AUTH_TOKEN"               
      -H "Accept: software/vnd.swift.registry.v1+json" 
      -F source-archive="@aws-sdk-swift-0.24.0.zip"       
      "${CODEARTIFACT_REPO}aws/aws-sdk-swift/0.24.0"

Notice the format of the package deal identify after the URI of the repository: <scope>/<package deal identify>/<package deal model>. The package deal model should comply with the semantic versioning scheme.

I can use the CLI or the console to confirm that the package deal is accessible within the repository.

aws codeartifact list-package-versions      
                  --domain stormacq-test    
                  --repository MySwiftRepo  
                  --format swift            
                  --namespace aws           
                  --package aws-sdk-swift
{
    "variations": [
        {
            "version": "0.24.0",
            "revision": "6XB5O65J8J3jkTDZd8RMLyqz7XbxIg9IXpTudP7THbU=",
            "status": "Published",
            "origin": {
                "domainEntryPoint": {
                    "repositoryName": "MySwiftRepo"
                },
                "originType": "INTERNAL"
            }
        }
    ],
    "defaultDisplayVersion": "0.24.0",
    "format": "swift",
    "package deal": "aws-sdk-swift",
    "namespace": "aws"
}

Now that the package deal is accessible, I can use it in my initiatives as ordinary.

Xcode makes use of SwiftPM instruments and configuration recordsdata I simply created. To add a package deal to my Xcode venture, I choose the venture identify on the left pane, after which I choose the Package Dependencies tab. I can see the packages which might be already a part of my venture. To add a non-public package deal, I select the + signal underneath Packages.

On the highest proper search subject, I enter aws.aws-sdk-swift (that is <scope identify>.<package deal identify>). After a second or two, the package deal identify seems on the checklist. On the highest proper aspect, you may confirm the supply repository (subsequent to the Registry label). Before choosing the Add Package button, choose the model of the package deal, identical to you do for publicly obtainable packages.

Alternatively, for my server-side or command-line functions, I add the dependency within the Package.swift file. I additionally use the format (<scope>.<package deal identify>) as the primary parameter of .package deal(id:from:)perform.

    dependencies: [
        .package(id: "aws.aws-sdk-swift", from: "0.24.0")
    ],

When I kind swift package deal replace, SwiftPM downloads the package deal from the CodeArtifact repository.

Things to Know
There are some issues to remember earlier than importing your first Swift packages.

• Be certain to replace to the newest model of the CLI earlier than making an attempt any command proven within the previous directions.
• You have to make use of Swift model 5.8 or newer to make use of CodeArtifact with the swift package deal command. On macOS, the Swift toolchain comes with Xcode. Swift 5.8 is accessible on macOS 13 (Ventura) and Xcode 14. On Linux and Windows, you may obtain the Swift toolchain from swift.org.
• You have to make use of Xcode 15 on your iOS, iPadOS, tvOS, or watchOS functions. I examined this with Xcode 15 beta8.
• The swift package-registry publish command is accessible with Swift 5.9 or newer. When you utilize Swift 5.8, you need to use curlto add your package deal, as I confirmed within the demo (or use any HTTP shopper of your alternative).
• Swift packages have the idea of scope. A scope gives a namespace for associated packages inside a package deal repository. Scopes are mapped to CodeArtifact namespaces.
• The authentication token expires after 12 hours. We counsel writing a script to automate its renewal or utilizing a scheduled AWS Lambda perform and securely storing the token in AWS Secrets Manager (for instance).

Troubleshooting
If Xcode cannot discover your personal package deal, double-check the registry configuration in ~/.swiftpm/configurations/registries.json. In explicit, examine if the scope identify is current. Also confirm that the authentication token is current within the keychain. The identify of the entry is the URL of your repository. You can confirm the entries within the keychain with the /Application/Utilities/Keychain Access.app software or utilizing the safety command line software.

safety find-internet-password                                                  
          -s "stormacq-test-012345678912.d.codeartifact.us-west-2.amazonaws.com" 
          -g

Here is the SwiftPM configuration on my machine.

cat ~/.swiftpm/configuration/registries.json

{
  "authentication" : {
    "stormacq-test-012345678912.d.codeartifact.us-west-2.amazonaws.com" : {
      "loginAPIPath" : "/swift/MySwiftRepo/login",
      "kind" : "token"
    }
  },
  "registries" : {
    "aws" : { // <-- that is the scope identify!
      "url" : "https://stormacq-test-012345678912.d.codeartifact.us-west-2.amazonaws.com/swift/MySwiftRepo/"
    }
  },
  "model" : 1
}

Pricing and Availability
CodeArtifact prices for Swift packages are the identical as for the opposite package deal codecs already supported. CodeArtifact billing relies on three metrics: the storage (measured in GB per thirty days), the variety of requests, and the info switch out to the web or to different AWS Regions. Data switch to AWS providers in the identical Region isn’t charged, that means you may run your CICD jobs on Amazon EC2 Mac cases, for instance, with out incurring a cost for the CodeArtifact information switch. As ordinary, the pricing web page has the small print.

CodeArtifact for Swift packages is accessible in all 13 Regions the place CodeArtifact is accessible.

Now go construct your Swift functions and add your personal packages to CodeArtifact!

— seb

PS : Do you already know you may write Lambda capabilities within the Swift programming language? Check the short begin information or comply with this 35-minute tutorial.