Software supply chains are too fragile.

LibWorld is an offline-first registry that stands in front of the package ecosystems your builds depend on — apt, pip, npm, git, cargo, go, maven, rubygems, nuget, cocoapods and docker — proxies them, stores everything it fetches, and serves it from inside your network.

The result is builds that don't depend on the public internet being up, fast, or unchanged. Pin what matters, prefetch before you go offline, and keep a queryable record of every artifact you have.

LibWorld is a small set of C++ services, built from vendored dependencies with no system-package requirements:

• The mirror — a Boost.Beast HTTP proxy with a backend per ecosystem, a Postgres catalog of everything mirrored, blob storage in any S3-compatible object store (the S3 client is SigV4 over libcurl, not a vendored SDK) or on local disk, retention/GC, and audit logging.
• The forge — self-hosted git repos served over smart-HTTP: clone anonymously, push with a token, browse over REST, and let a push trigger a build.
• The build service — a coordinator plus runners that poll out to it, so build hosts need no inbound ports. Builds resolve their dependencies through the mirror, which is what makes them hermetic and what gets every dependency catalogued.
• The clients — a world CLI, a React control-plane dashboard, and an Android/iOS app.

It is self-hosted by design: run it on your own box, keep your own copies, owe nothing to anyone's uptime. Deployment is Ansible and systemd — host-native, no Docker required to run it.

All eleven backends mirror end to end, against both local-disk and S3-backed storage. The catalog, prefetch, retention/GC, the artifact lifecycle, the audit log, token auth, the forge, the build service and all three clients are working today.

Two things are not built, and are named here rather than left to be discovered: package signature verification, and snapshots — point-in-time freezes of an entire mirror that you could replay years later. LibWorld stores and serves what you fetched; it does not yet prove upstream signed it, nor let you pin a whole mirror to a date.

It's early software, and open source under the MIT license.