Manage private repositories with rvs

rvs art repo manages private repositories. A repository belongs to one namespace and can support PyPI, npm, Maven, OCI, or a combination of these formats. The OCI format stores both container images and Helm charts.

Create a repository

Repeat --format to enable several kinds:

rvs art repo create packages \
  --format pypi \
  --format npm \
  --format maven

Create dedicated OCI repositories the same way:

rvs art repo create runtime-images --format oci
rvs art repo create deployment-charts --format oci

Repository names start with a letter and can use letters, numbers, and single hyphens. Capitalization is preserved, but names are matched without regard to it.

List and inspect repositories

The list shows repositories in the selected personal account or organization:

rvs art repo list
rvs art repo list --format npm
rvs art repo show packages

The Access column shows the highest repository role your current access reaches: Reader, Publisher, Maintainer, or Admin. In an organization, the list includes only namespaces you belong to, unless you are an organization administrator.

Repository details show the contents and usage for each enabled package format.

Choose an organization by its public handle before creating a repository for it:

rvs account switch AcmeHQ
rvs art repo create packages --format pypi

Select a repository for package work

Use the name-based target formed from the namespace and repository names:

rvs art select platform/packages
rvs art status

The namespace path is looked up in the selected account, so the same platform/packages name can safely exist in a personal account and an organization.

Select the repository before running a package command:

rvs art select platform/packages
rvs pip install internal-sdk

See Choose an account and repository for more examples.

Inspect package metadata

Package information commands apply to PyPI, npm, and Maven. They use the repository chosen with rvs art select. Add --format when that repository has more than one of PyPI, npm, and Maven:

rvs art select platform/packages
rvs art package list --format pypi
rvs art package show internal-sdk --format pypi

package show lists the package summary and its newest 50 versions. Use --limit N (1–100) to list fewer or more, --all-versions to list every version, or --version VERSION to see one version’s files and digests:

rvs art package show internal-sdk --format pypi --version 1.2.3

Add --target NAMESPACE/REPOSITORY to use another repository for one command.

PyPI versions can be yanked and unyanked. Yanking changes resolver selection; the optional reason is shown in package details. These commands always apply to PyPI, so they do not need --format:

rvs art package yank internal-sdk 1.2.3 --reason "Replaced by 1.2.4"
rvs art package unyank internal-sdk 1.2.3

For npm versions, use advisory deprecation messages:

rvs art package deprecate internal-sdk 1.2.3 --message "Use version 1.2.4"
rvs art package undeprecate internal-sdk 1.2.3

Deleting a version moves it to the repository trash for seven days; restore it from Trash in the web app. Delete a version only when you intend to remove its files:

rvs art package delete-version internal-sdk 1.2.2 --format pypi

Deletion names the repository and prompts for confirmation. Use --yes only in deliberately guarded automation. Maven has no yank or deprecation equivalent.

To delete a whole package with all its versions, open the package in the Ravenstash web app and choose Manage > Delete from this repository.

Connect a private mirror

A PyPI, npm, or Maven repository can provide approved public dependencies through a matching private mirror. Connect it in the Ravenstash web app:

1. Open the private repository.
2. Open Upstreams and select the matching package format.
3. Add the mirror, then choose its order and minimum package age.
4. Save the change.

Remove a connection from the same tab. Removing it does not delete the repository or the mirror. To review the sources a repository uses from the command line, list them:

rvs art repo upstream list packages pypi

Use the connection when one private repository should provide both your packages and approved public dependencies. Select the read-only mirror directly when a build only needs packages from that source. See Private mirrors.

To choose which connected sources can supply specific packages, use the repository’s Rules tab in the web app. See Package resolution rules.

OCI repositories do not support public-registry mirrors.

Rename or delete a repository

Rename or delete a repository in the Ravenstash web app: open the repository’s Settings tab and use Rename repository or Delete repository in the Danger zone.

Renaming changes the package address for every enabled format. Deleting affects the whole repository. Review rename, delete, and restore behavior before either operation.

Use commas, repeated flags, or both when enabling several formats:

rvs art repo create packages -f pypi,npm,maven,oci
rvs art repo create packages -f pypi,npm -f maven,oci

The same forms work for rvs art token mint --format. Duplicates are removed; empty and unknown formats are rejected. Single-format commands require one value.

Browse OCI content

Enable oci to store container images and Helm charts in one repository.

rvs art oci list --content-type helm_chart
rvs art oci show charts/api
rvs art oci manifest list charts/api
rvs art oci tag list charts/api

Manifest inspection and deletion use an exact PATH@sha256:DIGEST. Tag creation uses that same exact reference followed by the new tag. OCI lists support --limit and --cursor; JSON output retains the pagination cursor.