Transparent safest relocation

A per-tenant mode that serves the safest sealed version for a plain origin-version request, with no manifest change.

Transparent safest relocation is a per-tenant mode of the Seal Artifact Server. When it is enabled for your tenant, a build that requests a plain origin version is served the safest sealed version of that package instead, with no change to your manifest and no version suffix. The safest version is the latest released sealed version of that origin version (an enabled private version takes precedence within a Seal Project).

This is a tenant-wide setting, not a per-build choice. It is opt-in and off by default. Contact your Seal account team to enable it for your tenant.

This page assumes your package manager is already pointed at the Seal Artifact Server. See Configuring package managers for the basic setup.

What the build sees

With the mode enabled, you do not pin the sealed version and you do not add a suffix. You request the origin version exactly as you always have, and Seal transparently serves the sealed artifact.

If Seal has no sealed version for the requested origin version, the origin version is served unchanged, so the build does not break. A build that requests a version that is already sealed is served that version as-is.

Maven

When Maven asks maven.sealsecurity.io for an origin version's .pom, the server returns a relocation POM that points the build at the safest sealed version. For example, a request for org.apache.commons:commons-text:1.10.0 resolves to 1.10.0+sp3 if that is the safest sealed version, and Maven then fetches that artifact. The relocation POM and its checksum are served from the same bytes, so strict checksum validation (mvn -C) still passes.

npm

When npm asks npm.sealsecurity.io for a package, the entry for each origin version is served with the safest sealed version's tarball and integrity. Running npm install <package>@<origin-version> therefore installs the sealed artifact (for example, 2.7.4-sp1) without pinning a sealed version in package.json.

Relationship to +safest

For Maven, this mode is the tenant-wide counterpart of the build-invoked +safest suffix: +safest is something you write in a single POM dependency to opt that one dependency into safest resolution, while transparent safest relocation applies to every origin-version request for the tenant without editing the manifest at all. npm has no +safest suffix, so transparent safest relocation is the way an npm build receives the safest sealed version automatically.

Related

• Maven-specific server features: the build-invoked +safest and +safest-until-<cutoff> suffixes.

• Configuring package managers: pointing your package manager at the Seal Artifact Server.

• Working with Seal Apps under Artifact Server: the day-to-day rhythm of pinning and resolving sealed versions.