Raw repositories

Raw repositories hold any file at any path: build outputs, installers, firmware, documents, archives. Use them for anything that has no package format of its own.

1. Upload and download

curl -u "me:$DEPOTEX_TOKEN" --upload-file app.zip https://depotex.example.com/repository/my-space/files/tools/app.zip
curl -fO -u "me:$DEPOTEX_TOKEN" https://depotex.example.com/repository/my-space/files/tools/app.zip
curl -fs https://depotex.example.com/repository/my-space/files/tools/app.zip.sha256

• Publishing (PUT) needs Publish permission for a new path and Overwrite for an existing one; the repository's publishing setting, size limit and the space's upload rules and quota apply. Send the file's length (curl does). To have the upload checked, send X-Checksum-Sha256, X-Checksum-Sha1 or X-Checksum-Md5.
• People with Publish permission can also upload from the web app: Upload on the repository's page, or Upload files in its Browse tab for the folder you're looking at (see Uploading files with one form).
• Downloads support resuming (byte ranges, also with If-Range naming the ETag or the Last-Modified date, as wget -c and browsers send), caching (ETag) and checksum files: add .sha256, .sha1, .md5 or .sha512 to a file's path.
• A path ending in / lists that folder (JSON). DELETE removes a file (Delete permission).

2. Versions

Raw files have no versions: each file is one item, named by its path. Cleanup, quotas, quarantine and the block list act on files, and their name patterns match the path (for example tools/1.4/*).

A raw group answers downloads from the first member that has the file, lists the folders of every member, and sends uploads to the repository its rules choose by path; with it as the space's default, https://depotex.example.com/repository/my-space/raw/ is one address for all of them.

3. Proxy repositories

A raw proxy repository fetches files from any HTTP server, path for path, and keeps them: for example a vendor's download site or another artifact server. A proxy can also reach a raw repository of another Depotex (Depotex link).

Files a raw proxy keeps are re-checked after the artifact max age, since most never change. For files the upstream changes in place, list their paths under Metadata paths in the repository's Settings (one pattern per line, such as dist/channel-*): those are re-checked at the metadata max age instead.

4. Rust toolchains

rustup can install and update Rust through a raw repository, so machines never reach static.rust-lang.org themselves:

1. Add an upstream with the Rust toolchains (rustup) preset (https://static.rust-lang.org), allow it for the space, and create a raw proxy repository with it.
2. In the repository's Settings, click Set up for Rust toolchains: packages are kept for good, and channel manifests and rustup's release file are re-checked hourly. Then Save in the bar at the bottom.
3. Point rustup at the repository (its Usage tab shows the lines with your address):

export RUSTUP_DIST_SERVER=https://depotex.example.com/repository/my-space/rust
export RUSTUP_UPDATE_ROOT=$RUSTUP_DIST_SERVER/rustup
rustup toolchain install stable
rustup self update

Toolchains already fetched keep installing while static.rust-lang.org is unreachable.

Without internet access, copy a channel with the rust-dist-mirror tool (built from the Depotex source, apps/depotex/backend/cmd/rust-dist-mirror) on a machine that has it, carry the folder over, and upload it to a hosted raw repository; then point rustup at that repository as above. Every file is checked against the channel's SHA-256 checksums, and a download that stops resumes where it left off when you run the command again. A download that receives nothing for a minute fails rather than hanging:

rust-dist-mirror download -channel stable -hosts x86_64-unknown-linux-gnu \
  -profile minimal -components clippy,rustfmt -rustup -out ./rust-dist
DEPOTEX_TOKEN=dpt_… rust-dist-mirror upload -dir ./rust-dist \
  -to https://depotex.example.com/repository/my-space/rust

5. In the artifact browser

Raw repositories show as folders and files, with each file's content type, checksums and a Download button. SBOM files (.spdx.json, -cyclonedx.json, bom.xml) and signatures stored next to a file show under Security.