Authenticated package delivery

Ravenstash serves private PyPI, npm, and Maven downloads through an authenticated content delivery network spanning 300+ geographic locations.

Storage location and delivery location are separate. The selected storage target defines where package files are kept at rest. It does not restrict the delivery locations available to developers or CI runners.

Eligible metadata and package files are cached according to real download usage. An uncached request may read from the at-rest origin; later requests can be served closer to demand for low-latency, high-speed downloads. Ravenstash does not pre-replicate every package to every location, and does not guarantee a specific point of presence or latency for an individual request.

What developers configure

Nothing extra. Use the same Ravenstash repository URL and credentials from every location:

• pip, uv, and other Python package tools
• npm, Yarn, pnpm, and Bun
• Maven and Gradle

Private by default

Content delivery does not make repositories public. Ravenstash checks package access before returning private content.

Ravenstash-managed objects can stream through the Edge storage binding. Customer-owned Cloudflare R2 or AWS S3 targets use short-lived, target-bound access and may stream or redirect when the target and request are eligible. Reusable provider credentials are not sent to the download service.

First and repeat downloads

When eligible package content is cached near active users, Ravenstash can serve it without another origin read. Otherwise it retrieves the object from its assigned at-rest storage target; later requests may become cache hits while the entry remains valid.