Skip to content
ShieldedStackShieldedStackShieldedStack Docs
Swift is supported through CI scanning only. The proxy does not serve Swift packages, and package filters do not apply to them.

Swift

Swift support covers inventory, advisories, and SBOM export. It does not include enforcement. The package scanner reads Package.resolved in CI and uploads each pinned dependency. ShieldedStack then checks those packages against OSV and GitHub advisories and includes them in SBOM exports.

Why there is no Swift proxy

Section titled “Why there is no Swift proxy”

Most SwiftPM dependencies are declared as Git URLs, such as .package(url: "https://github.com/apple/swift-nio.git", from: "2.0.0"). SwiftPM clones these straight from the Git host, so they never reach a package registry and no registry proxy can see or block them. The Swift package registry protocol covers only the small share of packages published to a registry.

This means ShieldedStack can tell you a vulnerable Swift package is in use, but it cannot stop a build from fetching it. If you need enforcement, apply it where the Git traffic goes: restrict which hosts and repositories builds may clone from, and review Package.resolved changes in code review.

Scan in CI

Section titled “Scan in CI”

Commit Package.resolved and run the scanner after swift package resolve, so the scan sees the versions the build actually uses:

Terminal window
export SHIELDEDSTACK_API_KEY=your_api_key
export SHIELDEDSTACK_PROXY_URL=<proxy-url>
swift package resolve
package-scanner .

Set SHIELDEDSTACK_API_KEY from the CI platform’s secret store. The scanner reads Package.resolved as JSON. It never evaluates Package.swift, which can contain arbitrary code.

How packages are named

Section titled “How packages are named”

Source-control dependencies are named by repository path, for example github.com/apple/swift-nio. This is the name OSV and GitHub advisories use, so a scanned package matches its advisories. HTTPS, SSH, and git@host:owner/repo URLs all produce the same path.

Registry dependencies keep their registry identity, for example apple.swift-log. Advisory databases do not index registry identities, so these appear in inventory without advisory matches.

What the scanner skips

Section titled “What the scanner skips”
  • Branch and revision pins. A dependency pinned to a branch or commit has no version, so it cannot be matched to an advisory and is left out of the upload.
  • Local and file-system packages. These are part of your own source tree.
  • Binary targets. These are declared in Package.swift and are not recorded in Package.resolved.

Verify

Section titled “Verify”

Scanned packages appear under Packages in the Portal with the Swift ecosystem, attributed to the project name on the API key.