Manage packages and versions

Browse package contents

1. Open a repository.
2. Select its PyPI, npm, or Maven tab.
3. Select a package.
4. Select a version to inspect its artifacts and metadata.

Packages belong to one ecosystem. Browser downloads use temporary links; package managers use the repository URL and a token.

Browse Container and Helm content

Select Container or Helm, then browse:

OCI repository path → tags and immutable digests → manifest/index → configs, layers, and referrers

Tags are mutable references, not versions. Manifest digests are immutable identities. A multi-platform image index can point to several platform manifests, and an attachment points back to its subject through the OCI referrers graph.

Use the typed tag or manifest actions shown by Ravenstash. Removing a tag does not necessarily remove its manifest or shared blobs; unreferenced content follows the OCI garbage-collection lifecycle.

Package actions

Action	Effect
Yank version	Discourages normal resolver selection without deleting files. Exact-version behavior depends on the client.
Delete version	Removes the version from Ravenstash metadata and resolution. Existing client caches are unaffected.
Delete package	Removes the package and all its versions.

Cached upstream packages

Deleting cached upstream content does not block it. A later eligible request may fetch it again.

Content security

Ravenstash scans private packages and mirrored dependencies for malware and known security risks. Confirmed malicious packages are blocked, and findings remain visible with the affected version and files. Minimum package age adds another layer of protection for dependencies fetched from public registries.

Container and Helm attachments such as signatures, attestations, SBOMs, and provenance remain discoverable alongside their subject. Keep the verification controls required by your deployment policy.