Air-gapped export

Produce a signed bundle of everything a project needs and import it on a disconnected network.

Checksum enforcement

Artefacts whose checksum does not match the upstream metadata are rejected and the attempt is logged.

Provenance record

Upstream URL, fetch timestamp, checksum and requesting project, queryable through the API and exportable.

Allow and deny lists

Restrict which upstream namespaces may be proxied at all, per project.

Pull-through caching

First request fetches from upstream and stores; every later request is served locally. No pre-seeding step and no sync job to schedule.

Install

Container

docker run -p 8080:8080 registry.pkg-mirror.com/mirror:stable

Point a client at it

npm config set registry https://registry.pkg-mirror.com/npm/

Verify

curl -fsS https://registry.pkg-mirror.com/health

Background

We build a pull-through cache for the public package registries most build pipelines depend on. Packages are fetched once, verified, stored, and served from inside your own network. The point is not speed, although that is a pleasant side effect; the point is knowing which third-party artefacts entered your builds and still having them when upstream deletes a version.

Cachewell

What it does

Install

Background