file
/file/<source>/<path> The loose tarballs a Makefile curls, from hosts you name
How it works
-
Every build has dependencies that are neither a package nor a git repo — the tarball a Makefile fetches with plain curl, and which nothing else on this page would ever catch. Nine of our own projects do exactly that, which is why this backend exists.
-
You DECLARE which hosts it may fetch from; it will not take an arbitrary URL. A requested URL is matched against a declared base AT A PATH BOUNDARY, so naming
https://github.comdoes not accidentally authorisehttps://github.com.evil.com. -
Every fetch is hashed and the sha256 recorded. A caller may assert one with
?sha256=; an operator may PIN one, which a request cannot override. -
Prefetch takes a full URL, so you can paste the line straight out of the Makefile that needs it.
Things that have cost real time
Written down because they were paid for once already.
Declared-sources-only is a security boundary, not a convenience. An arbitrary-URL fetcher is an open relay and an SSRF pivot into the mirror host's own loopback services.
Content is treated as IMMUTABLE and never revalidated. That is the point — the build still resolves after upstream prunes the file — and it is also the cost: a moving …/latest.tar.gz pins to whatever was seen first. world repull is the escape hatch.
Content-encoding negotiation is deliberately disabled here, unlike the registry backends: the body IS the artifact, and a transparently decompressed .tar.gz would serve bytes whose checksum no longer matches upstream.