The backends
Thirteen ecosystems, one endpoint
A package manager will only talk to something that answers exactly the way its registry does. So each of these is a real implementation of somebody else’s protocol rather than a generic file cache with a prefix — which is why the change on your side is a URL, and why each one has its own rules about what may be kept and what has to be asked again.
What they all share
The differences are per-backend and live on each page. Everything below is true of every one of them.
- One blob store
- Artifacts go to S3-compatible object storage, or to local disk when you have not configured any. A backend does not get to choose.
- One catalog
- Every stored artifact gets a Postgres row — package, version, size, hashes, when it arrived, and when it was last pulled.
- One retention policy
- The same garbage collector reconciles catalog and blob store together, and the same pin protects a crate and a container image.
- One control plane
- Prefetch, pin, repull, delete, and audit are the same verbs whatever the artifact is, and they are token-gated the same way.
- Anonymous pulls
- The routes your builds use need no credential, by design. A mirror that a build cannot read is not a mirror.
- Verified upstream TLS
- Every upstream fetch verifies peer and host explicitly, with a custom CA bundle where your trust store is your own.