pip
/pip/simple/ Python wheels and sdists, and the index that lists them
How it works
-
Every artifact is checked against the
#sha256=fragment PyPI publishes for it on the index page, before the bytes are stored. pip checks the same fragment on its side; doing it here is what stops a bad wheel being CACHED and re-served to everyone afterwards. -
All pip really wants is a page of download links per project, and it does not care who serves that page. LibWorld serves the PEP 503 simple index with every artifact link rewritten to point back at itself, so pip follows them into the mirror instead of out to PyPI's CDN.
-
Wheels and sdists never change once uploaded, so an artifact is stored on first fetch and served from cache forever after.
-
The index page itself IS revalidated, because a project gains releases over time and a stale index is how you fail to see a version that exists.
Things that have cost real time
Written down because they were paid for once already.
pip refuses a plain-http index unless the host is ALSO in --trusted-host, and it does not error when you forget: it silently drops the index and reports "no matching distribution found for X" for a package the mirror serves perfectly. The failure names the PACKAGE, never the configuration. npm, gradle, and go have no trusted-host notion, which is why this bites pip alone.