Summary

  • draft-ietf-netmod-yang-packages-09 defines a versioned hierarchy whose includes, exclusions, explicit modules, features and mounts resolve into an effective package schema. It also lets a server bind packages to a datastore through YANG Library or publish them as .ypkg instance data.
  • A valid, complete and successfully resolved package proves a composition result under stated inputs. It does not by itself prove the retrieved bytes, the process that loaded them, the schema held by the other endpoint, representative instance behaviour or the safety of a mixed-version deployment.

The deployment review began with what looked like the strongest possible receipt. The package name and version were unique. The JSON validated. The include graph had no cycle. Every location answered. The resolver reported complete: true and emitted a coherent list of implemented modules, import-only modules, enabled features, deviations and mount points.

Yet the server process had never recorded the digest it loaded. A controller held an older cached package under the same name and version. Both sides could truthfully say “package resolved” while compiling different effective schemas.

That hypothetical failure is not an objection to YANG packages. It explains why the mechanism matters. Revision 09, dated 6 July 2026, replaces an implicit bundle with a versioned, hierarchical object that tooling can resolve and compare. The IETF Datatracker lists it as an active NETMOD working-group Internet-Draft, intended for the Standards Track and expiring on 7 January 2027. It remains work in progress, and its strongest claims should be read at the level the draft actually defines.

A package is a recipe with ordered powers

The package has more authority than a manifest of filenames. Its includes container can add packages, implemented modules, import-only modules and mandatory features. Its excludes container can remove inherited modules, import-only revisions and features. depends-on can identify context needed by an incomplete package without importing that context into the package’s own resolved schema. A mount entry can inherit a mounted schema, add packages and features, or discard the inherited mounted package set and define a replacement.

Resolution therefore has order and consequence. First, every included package is recursively resolved. Then the child schemas are merged with local entries. Implemented modules are unioned, conflicts are resolved, explicit local modules overwrite inherited choices, and exclusions filter the result. Import-only modules follow a related rule but may retain multiple revisions. Features are unioned and then locally added or removed. Excluding a module also removes its features. Location lists preserve the first occurrence while appending new alternatives in include order.

The mount rule deserves particular attention. When inheritance remains enabled, packages, features and parent references accumulate at a matching mount path. When inherit-packages is false, the inherited mounted package set is discarded. A one-bit choice can therefore alter a whole subordinate schema while the top-level package name remains familiar.

The result is a resolved package schema: one implemented version of each module, any import-only versions, features, deviations and mounted schemas. It is not merely the package file after validation.

Deterministic conflict resolution can still surprise its owner

When included packages bring different implemented versions of one module, revision 09 chooses a winner. If both versions follow YANG Semver, the resolver compares numeric major, minor and patch components while ignoring compatibility modifiers, prerelease information and build metadata. A conforming semantic-version label beats a nonconforming version label; if neither qualifies, the newer revision date wins. A local module entry can explicitly override the inherited result.

Those rules are deterministic, not telepathic. They cannot know which version a client generated bindings against or which branch an operator intended. A newer numeric version can be selected even when its full label communicates a compatibility complication. An older version requires an explicit refining package rather than a passive preference. The audit object is therefore not “the resolver succeeded” but the candidate set, comparison rule, winner, overwritten entries, exclusions and warnings.

This article does not repeat the companion schema-comparison work. Classification of a difference can enrich a decision. It does not identify the bytes actually retrieved, prove that the chosen dependency graph was the intended one, or execute a client against the result.

complete is about imports, not the whole supply chain

The draft uses a precise definition of referential completeness. A package is complete when all import statements in all directly or indirectly included modules can be resolved to module versions within the definition. An incomplete hot-fix or logical grouping can name supporting packages in depends-on; those dependencies help a client construct context but do not become part of the package’s own resolved schema.

That boundary is useful and narrow. complete: true does not say that every URI returned the same bytes as yesterday, that an issuer authenticated those bytes, that an implementation verified every listed submodule, or that the resulting schema accepted operational data. Submodules make the distinction sharper: packages list them largely to provide ordered retrieval locations, while resolution compares the containing module version and may assume tied submodule information is equivalent. The operator still needs the actual submodule content and closure record.

Name/version uniqueness is similarly a governance requirement, not a digest. The draft says multiple references to the same package or module version are expected to carry equivalent content and metadata; differing locations are merged. If two mirrors drift, the expectation does not tell a client which bytes are authoritative. Record the issuer, exact content hash, URI, retrieval time, cache provenance and verification result.

A catalogue entry is not a datastore binding

The server model deliberately separates “known” from “active”. Its top-level package list may advertise multiple versions, including packages not implemented or active for any datastore. The binding that matters appears in the YANG Library augmentation: package name/version pairs and additional features associated with a specific datastore schema.

When that augmentation is populated, the listed packages must resolve to a referentially complete schema that exactly matches the YANG Library module set. This is a strong consistency requirement. It still operates at the reporting layer. The server supplies both representations; a client needs to compare them, timestamp the observation and retain the relevant YANG Library content-id. Because content-id is server-generated, it is a change indicator for that server, not a universal content digest shared between systems.

The .ypkg path offers portability. Package instance files use JSON, the YANG instance-data framework, a package-name/version filename and the application/ypkg media type. A client can use the server copy, fetch an advertised location or reuse a cached file for the same name and version. Schema validation proves that the file fits the declared structure. It does not prove authorship, freshness, byte continuity, correct recursive choice or process activation.

RFC 9195 provides the right restraint: instance data is not an alternative protocol for manipulating live configuration or state. Files outside NETCONF or RESTCONF security controls also need their own access and custody protections.

Conformance is a schema claim, not a service outcome

Package conformance asks whether an implementation faithfully implements the full resolved schema. A server that varies from an industry package can publish a server-specific package that includes and refines it—selecting other module versions, adding deviations, excluding unsupported modules or removing features. That is honest reporting, and it can make a client’s comparison cheaper.

It does not make “conforms to package X” self-executing. The comparison must name which recursively included package version is being assessed and what modifications survived resolution. Multiple versions of an included package may remain visible even though each implemented module has only one winning version. A conformity statement can be accurate at the schema level while a controller still fails on an unknown identity, changed default, deviation, access-control interaction or mounted context.

The evidence chain should therefore keep separate receipts: package identity and source; retrieved bytes; structural validity; recursive edge trace; conflict choice; import and submodule closure; the final resolved schema; YANG Library datastore binding; process load; client/server schema agreement; representative configuration, state, RPC and notification tests; rollout order and rollback; observed runtime state; and external service result.

Each receipt answers a different question. None becomes stronger by borrowing the name of the next.

Primary sources

The primary record is YANG Packages revision 09 and its Datatracker status/history, read with RFC 7950, RFC 8525, RFC 9195, RFC 8528, RFC 8342, YANG Module Versioning revision 17, YANG Semantic Versioning revision 28 and the IETF 122 NETMOD minutes: https://datatracker.ietf.org/doc/html/draft-ietf-netmod-yang-packages-09; https://datatracker.ietf.org/doc/draft-ietf-netmod-yang-packages/; https://datatracker.ietf.org/doc/draft-ietf-netmod-yang-packages/history/; https://www.rfc-editor.org/rfc/rfc7950.html; https://www.rfc-editor.org/rfc/rfc8525.html; https://www.rfc-editor.org/rfc/rfc9195.html; https://www.rfc-editor.org/rfc/rfc8528.html; https://www.rfc-editor.org/rfc/rfc8342.html; https://datatracker.ietf.org/doc/html/draft-ietf-netmod-yang-module-versioning-17; https://datatracker.ietf.org/doc/html/draft-ietf-netmod-yang-semver-28; https://datatracker.ietf.org/doc/minutes-122-netmod-202503190600/00/.