The backends
Thirteen ecosystems, one endpoint
A package manager will only talk to something that answers exactly the way its registry does. So each of these is a real implementation of somebody else’s protocol rather than a generic file cache with a prefix — which is why the change on your side is a URL, and why each one has its own rules about what may be kept and what has to be asked again.
What they all share
The differences are per-backend and live on each page. Everything below is true of every one of them, and git is named where it is the exception.
- One blob store
- Artifacts go to S3-compatible object storage, or to local disk when you have not configured any. A backend does not get to choose. Git stores no blob at all: a mirrored repository is its own storage.
- One catalog
- Every stored artifact gets a Postgres row — package, version, size, hashes, when it arrived, and when it was last pulled. A git mirror gets one row per repository.
- One retention policy
- The same garbage collector reconciles catalog and blob store together, and the same pin protects a crate and a container image. A git mirror is never collected — it is owned, not cached.
- One control plane
-
Prefetch, pin, repull, delete, and audit are the same verbs whatever
the artifact is, and they are token-gated the same way. Git refreshes
a mirror with
world git syncinstead of a repull: a fetch adds to a repository rather than replacing it. - Anonymous pulls
- The routes your builds use need no credential, by design. A mirror that a build cannot read is not a mirror.
- Verified upstream TLS
- Every upstream fetch verifies peer and host explicitly, with a custom CA bundle where your trust store is your own.