--- title: Software Heritage Identifiers | daily.dev description: A developer recaps building tooling around Software Heritage Identifiers (SWHIDs) after speaking at the CodeCommons plenary in Paris. The post explains the SWH... canonical: https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Software Heritage Identifiers | daily.dev og:description: A developer recaps building tooling around Software Heritage Identifiers (SWHIDs) after speaking at the CodeCommons plenary in Paris. The post explains the SWH... og:url: https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy og:image: https://api.daily.dev/og/posts/1e2jmTEwY.png og:image:alt: Software Heritage Identifiers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Software Heritage Identifiers **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 9 min read · 4 upvotes · 0 comments ## Summary A developer recaps building tooling around Software Heritage Identifiers (SWHIDs) after speaking at the CodeCommons plenary in Paris. The post explains the SWH archive (a deduplicated Merkle DAG of ~30 billion files from 445 million origins), the SWHID spec (now ISO/IEC 18670), and a suite of tools the author built: a git remote helper (swh-git) for cloning by SWHID or origin URL, SWHID computation libraries in Ruby and Go, a WASM browser tool for hashing packages client-side, an OpenAPI spec and Go client for SWH's API, and a coverage audit of ~9,800 critical packages showing 71.3% of default branches already archived. It closes with plans to map purls to SWHIDs on packages.ecosyste.ms and feed a prioritized crawl queue back to Software Heritage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a SWHID and how is it structured? A SoftWare Hash IDentifier (SWHID) is an intrinsic identifier of the form swh:1::, computed directly from content bytes with no registry or issuing authority. The five object types are cnt (file bytes), dir (directory tree), rev (commit), rel (tag), and snp (snapshot of repository refs). Optional qualifiers after a semicolon can pin an origin URL, visit, path, or line range. Version 1.2 of the spec became ISO/IEC 18670, the first ISO standard for intrinsic software identifiers. _Tracking identifier standards like SWHID alongside package tooling news is easier with daily.dev._ ### How can I clone a git repository from the Software Heritage archive instead of GitHub? Using swh-git, a git remote helper that adds an swh:: transport, you can run git clone swh::github.com/octocat/Hello-World to pull the most recent archived snapshot, or pin an exact one with a SWHID like git clone swh::swh:1:snp:. The helper fetches a git-bare bundle from the Software Heritage Vault, caches it locally, and serves the clone via git upload-pack; push is refused since the archive is append-only. It also works via an HTTP proxy mode for tools expecting a plain URL. _Developers recovering lost repositories can keep tabs on tools like swh-git through daily.dev._ ### How much of the critical open source package ecosystem is already archived in Software Heritage? Across roughly 9,800 critical packages and 7,000-odd source repositories audited on 23 and 24 September, 71.3% had their current default-branch commit already archived, and 89.9% of matched release tags were present as revisions. Among repositories missing their current commit, 95.1% still had an older snapshot once renamed URLs were checked, and the 46 hardest cases still turned up archived content once full clones and tarball tree hashes were checked directly. _Anyone assessing supply chain preservation gaps can follow coverage audits like this via daily.dev._ ## Similar posts on daily.dev - [distributed identity](https://daily.dev/posts/distributed-identity-wzel5obwe) · Lobsters · 0 upvotes · 0 comments - [Who Built This?](https://daily.dev/posts/who-built-this--bc4rx6op2) · Andrew Nesbitt · 0 upvotes · 0 comments - [Shai-Hulud: Whoever controls your package registry controls your pipeline](https://daily.dev/posts/shai-hulud-whoever-controls-your-package-registry-controls-your-pipeline-ei6p8mpz3) · The New Stack · 0 upvotes · 0 comments - [SRE Playbook: A Guide to Discover and Catalog Non-Human Identities \(NHI\)](https://daily.dev/posts/sre-playbook-a-guide-to-discover-and-catalog-non-human-identities-nhi--rilrqdgho) · GitGuardian · 0 upvotes · 0 comments - [Well-architected best practices for software supply chain security](https://daily.dev/posts/well-architected-best-practices-for-software-supply-chain-security-fydsgfmnx) · Tech Lead Digest · 1 upvotes · 0 comments --- Tags: [#git](https://daily.dev/tags/git) [View this post on daily.dev](https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Software Heritage Identifiers","url":"https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy"},"datePublished":"2026-10-01T11:39:09.178Z","dateModified":"2026-10-01T11:39:33.112Z","description":"A developer recaps building tooling around Software Heritage Identifiers (SWHIDs) after speaking at the CodeCommons plenary in Paris. The post explains the SWH...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"git","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"Software Heritage Identifiers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/software-heritage-identifiers-1e2jmtewy#faq","mainEntity":[{"@type":"Question","name":"What is a SWHID and how is it structured?","acceptedAnswer":{"@type":"Answer","text":"A SoftWare Hash IDentifier (SWHID) is an intrinsic identifier of the form swh:1::, computed directly from content bytes with no registry or issuing authority. The five object types are cnt (file bytes), dir (directory tree), rev (commit), rel (tag), and snp (snapshot of repository refs). Optional qualifiers after a semicolon can pin an origin URL, visit, path, or line range. Version 1.2 of the spec became ISO/IEC 18670, the first ISO standard for intrinsic software identifiers. Tracking identifier standards like SWHID alongside package tooling news is easier with daily.dev."}},{"@type":"Question","name":"How can I clone a git repository from the Software Heritage archive instead of GitHub?","acceptedAnswer":{"@type":"Answer","text":"Using swh-git, a git remote helper that adds an swh:: transport, you can run git clone swh::github.com/octocat/Hello-World to pull the most recent archived snapshot, or pin an exact one with a SWHID like git clone swh::swh:1:snp:. The helper fetches a git-bare bundle from the Software Heritage Vault, caches it locally, and serves the clone via git upload-pack; push is refused since the archive is append-only. It also works via an HTTP proxy mode for tools expecting a plain URL. Developers recovering lost repositories can keep tabs on tools like swh-git through daily.dev."}},{"@type":"Question","name":"How much of the critical open source package ecosystem is already archived in Software Heritage?","acceptedAnswer":{"@type":"Answer","text":"Across roughly 9,800 critical packages and 7,000-odd source repositories audited on 23 and 24 September, 71.3% had their current default-branch commit already archived, and 89.9% of matched release tags were present as revisions. Among repositories missing their current commit, 95.1% still had an older snapshot once renamed URLs were checked, and the 46 hardest cases still turned up archived content once full clones and tarball tree hashes were checked directly. Anyone assessing supply chain preservation gaps can follow coverage audits like this via daily.dev."}}]} ```