Artifacts

Native registry for containers and packages.

The native registry stores container images (OCI) and npm, Maven, NuGet, RubyGems and PyPI packages, with per-repository visibility (private/internal/public).

• Tags/versions with architecture, digest, size, vulnerability scan (Trivy) and cosign signature.
• Tag inspector — multi-arch manifest, layers, CVEs and push/overwrite/delete history.
• Retention/cleanup policies — keep N versions, expire by age, remove untagged, block push on critical CVE.

Who owns a package#

• A package name belongs to the workspace that published it first. Names are shared across the platform, as on npmjs or nuget.org; publishing a name another workspace owns is refused with 403, before anything is stored.
• A published version never changes. Pushing it again is refused (NuGet and RubyGems answer 409, PyPI 409 "File already exists", npm 403, as their public registries do); publish a new version. dotnet nuget push --skip-duplicate and twine upload --skip-existing treat that answer as "already there". npm deprecate still works.
• NuGet ids are case-insensitive: eQuantic.Auth and equantic.auth are the same package.
• Deleting a package deletes its files. The name is then free, and whoever publishes it next starts from nothing: no earlier version is listed or reachable.
• A private package answers only its own workspace's tokens. A request without credentials gets 401 with a WWW-Authenticate challenge, which is what makes NuGet, Maven and pip send the credentials you configured. Another workspace's token gets 404, the same answer as a package that exists nowhere, so a restore that also queries nuget.org or npmjs moves on.