Formats and running it
Artifacts, SBOMs, properties and lifecycle stages
The cache is not a pile of files. It is an inventory, and it answers questions.
Every cached file, of every package type, is stored once under its SHA-256 and gets a row on the Artifacts page: package, version, filename, digest, size, which registry it came from, when it was first seen and how often it has been downloaded. Two packages shipping the identical file share one blob. Check the bytes rehashes a blob on demand.
SBOMs come out in CycloneDX 1.5 JSON or SPDX 2.3 JSON, for one file with its direct dependencies pinned to what is cached, or for a whole application from the versions it actually downloaded. Nothing is fetched to write one, and the serial number is worked out from the file, so the same file always gets the same one. SBOMs are for npm packages, Python files and images for now. The newer types are in the blob store and on the Artifacts page, but not yet written into SBOMs correctly.
Properties are searchable name=value notes on a version or a package: owner=security, criticality=high. Lifecycle stages say where a version stands: quarantine, development, test, approved, production or blocked. With enforcement on, a production token only gets versions promoted to production. A stage can only take away an allow, never add one.
In short
- Content addressed blob store, deduplicated by SHA-256
- CycloneDX 1.5 and SPDX 2.3, per file or per application
- Searchable properties on packages and versions
- Lifecycle stages with optional enforcement for production
- API access for all of it
In the documentation
- Cache, storage and retention Administrator Guide
- Consumers and SBOMs Administrator Guide
Goes well with
- Who has it Search a package, a hash or a CVE and see the applications, environments and pipelines that pulled it.
- S3 and Azure storage Keep the cache in a bucket. Every upload checked by hash, and a local copy cap on the disk.
- Provenance verification npm SLSA provenance and PyPI PEP 740 attestations checked against Sigstore, offline, on the box.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.