Private package mirrors

A Ravenstash private mirror places one PyPI, npm, or Maven source behind an authenticated package URL. Use an official public registry or connect another package source, including one that requires authentication.

The mirror protects the path from public dependency to build:

• Security scanning checks requested packages for malware and known risks.
• Minimum package age can hold back brand-new releases during the period when a supply-chain attack is most likely to spread unnoticed.
• Approved dependencies stay ready for fast, repeatable developer and CI installs.
• Developers and CI use rvs instead of storing registry tokens in package-manager configuration.

Use the private mirror in either of these ways:

• Use it directly as a read-only private mirror.
• Connect it to a matching private repository so private and mirrored dependencies resolve through one Ravenstash target.

Install directly from a private mirror

You do not need a private repository to use a mirror. For example, install PyTorch directly through Ravenstash’s private PyPI mirror:

rvs art mirror select pypiorg
rvs pip install torch

The same approach works for other approved public dependencies and official mirrors.

Why teams use private mirrors

• Keep public dependencies behind Ravenstash authentication.
• Scan packages for malware and known security risks.
• Delay brand-new releases during the period when supply-chain attacks spread fastest.
• Give developers and CI one consistent rvs workflow.
• Avoid operating and paying for separate mirror and security systems.

Minimum package age

A minimum package age delays newly released upstream packages. It gives the ecosystem time to identify a compromised maintainer account, malicious release, dependency-confusion attempt, or poisoned update before your next build adopts it.

Connect a mirror to a repository

1. Open the private repository in the Ravenstash app.
2. Open Upstreams.
3. Select PyPI, npm, or Maven.
4. Add a mirror for the same registry.
5. Choose its order and minimum package age.
6. Save the change.

Inspect mirrored packages

Open Package caches in the Ravenstash app. From a mirror page you can:

• See which private repositories use the source.
• Browse mirrored packages, versions, files, and security findings.
• Review access recency, download counts, and bandwidth.
• Remove cached packages or versions.
• Download cached package files through an authenticated browser flow.

Detailed guides

• Configure official package upstreams
• Connect a custom package source
• Minimum package age
• Manage a package cache