Verentis

Documentation

The .vpkg format

What's inside a Verentis package, how references resolve, and how signing works.

A .vpkg is a gzip tarball with four content areas:

manifest.yaml

The extension manifest (app or engine).

files/**

The payload — schemas, code, assets referenced by the manifest.

catalog/**

Optional plaintext marketplace presentation content generated from the manifest's top-level marketplace block.

.verentis/

Package metadata: package.yaml, SHA-256 digests, and DSSE signatures.

Reference resolution

Manifest references like ./schemas/x.json resolve against files/ in the package — and, after installation, against the children of the installed manifest node.

Packing behaviour

  • File selection — an explicit packaging.files list selects the complete payload and overrides automatic selection. Without it, the packer derives files from manifest-relative schema source values and spec.install[].from globs.
  • Catalog — marketplace logo, hero, gallery, README, changelog, and declared assets are selected independently of packaging.files and written to content-addressed catalog/** entries.
  • Integrity — digests cover the manifest, every payload entry, and every catalog entry; the registry rejects tampered packages.
  • Signing — with a configured signing key the digests document is DSSE-signed (Ed25519). Publishers with registered keys must sign uploads.
  • Encryption — pack --encrypt seals only files/** (AES-256-GCM, X25519 key wrapping per recipient). The CLI adds the platform recipient when its public sealing key is configured; manifest.yaml, catalog/**, and .verentis/** remain plaintext.

Full specification

This is the CLI's-eye view. The complete .vpkg specification lives in the platform docs under marketplace/packaging.