Install packages by the DID of the publisher

didpkg is a package manager with the DID (Decentralized Identifier) of the publisher as the root of trust. The publisher signs each release with a key from its DID document. You install with plain npm, pnpm or bun.

didpkg is experimental. Do not use it for production packages.

How it works

1. Sign. The publisher signs a release record with a key from its DID document. The record holds the SHA-512 digest of the tarball.
2. Store. The DWN (Decentralized Web Node) of the publisher is the registry. Static HTTPS mirrors hold the same signed bytes. If the DWN stops, npm installs from a mirror.
3. Verify. A local shim resolves the DID, then checks the proof and the digest. Then it gives the package to npm. If a check fails, npm gets an HTTP error.

How didpkg works gives the trust model and the limits.

Install

On Linux or macOS, the install script gets a standalone binary:

curl -fsSL https://didpkg.dev/install | sh

On each OS with Node 22 or later (also Windows), use npm:

npm install --global didpkg

Install didpkg shows how to read the script before you run it, check a manual download, upgrade and uninstall.

Note: didpkg@0.1.0, the release v0.1.0 and this install script are not live yet. Until then, build the CLI from a clone (quickstart, step 1).

Install a package by DID

Start the shim. It runs until you push Ctrl+C.

didpkg shim start

In a second terminal, in your project folder, add 1 line to .npmrc and install:

echo '@didpkg:registry=http://127.0.0.1:2092/' >> .npmrc
npm install @didpkg/hello_web_bnonni.github.io_didpkg-demo

The install name holds the package name, the DID method and the DID. @didpkg/hello_web_bnonni.github.io_didpkg-demo is the package hello of did:web:bnonni.github.io:didpkg-demo. The quickstart gives each step and the HTTP errors.

Publish

Make a publisher DID (did:dht or did:web). Then sign a package and write it to a DWN and to a static mirror with didpkg publish. Publish a package gives each step and the key safety rules.

Documentation

• Quickstart: install the CLI, start the shim and install a package by DID.
• How didpkg works: the checks at install, the trust model and the limits.
• Publish a package: make a publisher DID, sign a package and write it to a DWN and a mirror.
• CLI reference: each command, with its options, its output and its exit code.
• Install names: the install-name grammar, the shim routes and the test vectors.
• Release records: the release record, the index, the digests, the proofs and the storage layouts.
• All documents: the docs index, with the runbook and the ADRs.