Verified on the way in
Every cached file is checked against the hash its registry published before it's stored. Tampered downloads are rejected, concurrent requests share one fetch, and cached files keep serving when upstream is down.
Self-hosted · v0.1.5
Artifact Repository
Host your own packages and cache the public ones, on your own servers. Connect a hextrap firewall and a bad package never gets cached in the first place.
Quick start ↓$ ./hextrap-artifacts -version hextrap-artifacts 0.1.5 (self-hosted) $ ./hextrap-artifacts -config config.yaml INFO serving artifact repository version=0.1.5 listen=:8080 $ npm publish --registry http://internal-registry.local/npm/internal/ + @acme/billing@2.4.0 $ pip install --index-url http://internal-registry.local/pypi/python/simple/ requests Successfully installed requests-2.32.3 $ pip install reqeusts ERROR: HTTP error 403: blocked by the hextrap firewall
01 — How it fits
One URL for every install
Builds talk only to your repository. What happens behind it is up to you.
Your builds
npmpipuvmvncargogodocker
Artifact Repository
Hosted your packages
Proxy cached copies
hextrap firewall
malware · typosquats
soak time · allow/deny
no policy
Public registries
pypi.orgnpmjsMaven Centralcrates.ioproxy.golang.orgDocker Hub
Free. Proxy repositories cache straight from the public registries, unchecked, and the UI marks them No policy. Nothing is sent to hextrap.
With hextrap. Downloads go through your firewall first. Malware, typosquats, too-new releases and denied packages are blocked before they're cached, cached packages are rechecked, and every install shows in your dashboard.
02 — Formats
Six ecosystems, the clients you already use
| Format | Publish with | Proxies | Firewall policy |
|---|---|---|---|
| npm | npm publish | registry.npmjs.org | Yes |
| PyPI | twine upload, uv publish | pypi.org | Yes |
| Cargo | cargo publish | index.crates.io | Yes |
| Go modules | Proxy only | proxy.golang.org | Yes |
| Maven | mvn deploy, Gradle | Maven Central | Not yet |
| Container images | docker push | Docker Hub | Not yet |
03 — Built in
What a repository should do, without the plugins
Immutable versions
A version can't be overwritten, and a deleted version number is never reused.
Delete without regret
- YankHidden from resolution; pinned installs still work.
- DeleteGone from indexes, restorable for 30 days.
- PurgePermanent. Type
pkg@versionto confirm.
Access from your identity provider
Sign in with OIDC (Okta, Entra ID, Keycloak, Authentik, Dex) or a local users list. Grant roles to IdP groups, give CI repository-scoped tokens, and every change lands in the audit log.
Your storage
AWS S3MinIOCloudflare R2Postgres
Package files go to your S3-compatible bucket (SSE-S3 or SSE-KMS), metadata to your Postgres. Run one replica or several.
Talks only to what you configure
- your identity provider
- your bucket and database
- the upstream registries you allow
- hextrap, only if you connect a firewall
No telemetry, no license server, no phoning home. It's Apache 2.0, so you can check.
04 — Download
Running in five minutes
v0.1.5
Latest release
Linux x64 .tar.gz
hextrap-artifacts_0.1.5_linux_amd64.tar.gz
hextrap-artifacts_0.1.5/
├── hextrap-artifacts
├── config.example.yaml
├── config.full.example.yaml
├── README.md
├── LICENSE Apache 2.0
├── NOTICE
└── THIRD_PARTY_NOTICES
-
1
Unpack
tar xzf hextrap-artifacts_0.1.5_linux_amd64.tar.gz cd hextrap-artifacts_0.1.5 -
2
Set an admin password
cp config.example.yaml config.yaml printf '%s' 'a long password' | ./hextrap-artifacts hash-passwordPaste the hash into
config.yaml. -
3
Start it
./hextrap-artifacts -config config.yamlOpen
http://localhost:8080, sign in asadminand create a token. Each repository's Setup tab shows the client configuration.
Free
Repository
- Hosted and proxy repositories
- SSO, roles, tokens and audit log
- Your storage, no telemetry
hextrap plan
Repository + Firewall
- Everything in Repository
- Malware, typosquat and soak-time blocking
- Allow and deny lists, custom policies
- Every install in your hextrap dashboard