Cloudsmith

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build the package registry I actually need instead of a hosted one — and start with the reason, because it is usually not distribution.

**It is the proxy cache.** A public registry having a bad day, or a package being unpublished, stops every build you have. A caching proxy in front of the public registries fixes that, and it is the cheapest half of this product.

STACK
- Verdaccio for npm, or a registry that speaks the formats you actually use. Do not implement a registry protocol
- A container registry — the reference implementation is open and small
- Node 20+ with Fastify only for the pieces around them
- Caddy in front, on a private network

START WITH THE PROXY, NOT THE REGISTRY
- Configure each public registry as an upstream, cache every artefact you fetch, and serve from the cache thereafter
- **Never expire an artefact you have cached.** A version is immutable by convention; if it disappears upstream, your copy is the reason the build still runs
- That single change removes an entire class of outage, and it is a configuration file

PUBLISHING YOUR OWN
- Scoped or namespaced so a private package cannot be confused with a public one
- **Dependency confusion is the attack to design against**: if your internal package name also exists publicly and the client prefers the public one, somebody else's code runs in your build. Scope every internal package, and configure the client so the internal scope resolves only to your registry
- Immutable versions. Republishing a version that has already been consumed is how a build becomes unreproducible, and the registry should refuse it rather than trusting discipline

STORAGE, WHICH IS THE BILL
- Artefacts accumulate forever and nobody notices until the disk is full
- A retention policy per repository — keep every released version, keep the last N pre-releases, keep nothing untagged beyond a window
- Container images are the worst of it: measure layers rather than images, since the same base is shared
- A disk watchdog and a report of what is growing, monthly

ACCESS AND AUDIT
- Read and write tokens separately, scoped per repository, revocable, with a last-used date
- Every publish recorded with who, what version and when, append-only. That log is what an auditor asks for and it cannot be reconstructed
- A build token is not a person's token. Machine identities with their own scopes, expiring

SIGNING, WHICH IS WORTH THE AFTERNOON
- Sign what you publish and verify on install. A registry that only serves bytes proves nothing about who produced them
- Record a provenance attestation from CI if your ecosystem supports one, so an artefact can be traced back to the commit that built it

OPERATIONS
- .env: STORAGE_PATH, UPSTREAM registries, tokens
- Backups cover your own published artefacts. The cached public ones are re-fetchable, and saying which is which is part of the design
- Health endpoint that resolves one package through the proxy

WHAT MATTERS MOST
The caching proxy and scoping against dependency confusion. The first stops other people's outages being yours; the second stops somebody else's package being yours.