Supported formats

Every repository has one format, chosen when it's created; the format can't change later. A space lists the formats its repositories may use. This page compares the formats; each has its own page with setup, commands and limits.

1. Client versions

The oldest client of each format that works with Depotex, and why older ones don't. Newer clients always work: Depotex follows each format's current protocol, and answers older clients in the forms they understand where the format allows it.

2. What each format supports

The formats added later, in the same terms:

RubyGems, Conda and Conan, added after those, in the same terms:

3. What every format has in common

• Address: https://<depotex>/repository/<space>/<repository>/, except Docker, which uses <depotex>/<space>/<repository>/<image>. The repository's page shows its address and setup snippets.
• Credentials: an API token (Profile → API tokens) as the password or as the user name with an empty password, or as a Bearer token (NuGet: as the API key; Cargo and gem push: the token alone; Bundler: the user name and token, or the token alone; conda: in ~/.netrc; micromamba and pixi: as a Bearer token in their auth files; Conan: conan remote login with the token as the password; see Use a token). Public spaces need none while anonymous access is on.
• Permissions: Read to download, Publish for new files, Overwrite to replace or change, Delete to remove, set by space roles, repository roles and content selectors (see Spaces).
• Policies: upload rules, cleanup, storage quotas, quarantine and the block list work on every format's versions.
• Storage: each distinct file content is stored once, checked nightly by integrity checks, and counted toward the space's quota.
• Browse: every format's versions show in the artifact browser, with checksums, commands and the format's own metadata.
• Safety: metadata, SBOMs and attestations are read with size, depth and time limits; content that breaks them quarantines its version.

4. Uploading files with one form

In the web app, choose Upload in the sidebar to pick any hosted repository you may publish to, across your spaces (search by name, filter by format), and upload to it on the same page. Or open a hosted repository and choose Upload (shown when you may publish there and its format takes uploads). Drop files or choose them, fill in what the dialog asks for, and Upload: a progress bar shows while the files are sent, then each file's result: stored, replaced, in quarantine, or refused with the reason. In raw and YUM repositories, Upload files in the Browse tab uploads into the folder you're looking at.

Besides each format's own tools, hosted repositories can take files as one form upload, the way the web app uploads them. Depotex reads what it needs from the files and asks only for what they can't say; when a value you give disagrees with the file, the file is refused rather than stored under the wrong name.

Docker, Terraform, Hugging Face and Git LFS repositories keep their own tools.

curl -f -H "Authorization: Bearer $DEPOTEX_TOKEN" \
  -F directory=tools/1.4 -F file=@app.zip -F file=@app.zip.asc \
  https://depotex.example.com/api/uploads/my-space/files

• Send the form's values first, then the files, each in a field named file. GET /api/spaces/<space>/repositories/<repository>/upload-form tells whether you can upload there, which values the format takes, and the size and file-count limits. GET /api/upload-repositories lists the hosted repositories you can upload to, across spaces (q, format, space, and cursor for the next page; a page can hold fewer than limit while hasNext is true).
• The answer lists each file: stored, overwritten, or refused with the reason (for example no permission to overwrite, or a publish-once repository). Files are stored one after another; a refused file doesn't undo the others.
• The same rules apply as for the format's own tools: Publish and Overwrite permissions per path, the repository's publishing setting and size limit, the space's upload rules and quota, quarantine, and the audit log, which records these uploads as made from the web (via: web).
• Hosted repositories only; every licence tier.

While a request runs, its files wait on the server's disk. Settings for the server:

5. Choosing a type

• Hosted for what your teams build and publish.
• Proxy for public packages: builds keep working when the public registry is down or removes a package, and every package passes your quarantine and block list.
• Combine hosted and proxy repositories of a format in a group, so each tool needs one address for both.