3.0.4

Image: globalartltd/astrum-repository:3.0.4 (also latest). Documentation: https://astrum.globalart.dev.

New

• Web interface: the header has a link to the project on GitHub with the number of its stars, right before the help menu. It is left out on a phone.
  The number is fetched by the server, not by the browser: GET /service/rest/internal/ui/github asks api.github.com through the HTTP settings and the SSRF protection, keeps the answer for six hours and, after a failed attempt, tries again in thirty minutes while showing the last known number. Where the server cannot reach GitHub, the link shows without a number.

Upgrading

No steps of its own and no database changes. See the upgrade notes.

3.0.3

Image: globalartltd/astrum-repository:3.0.3 (also latest). Documentation: https://astrum.globalart.dev.

New

• Repositories: the list under Settings → Repositories has an Anonymous Access column that says Yes or No, and it can be filtered and sorted by it. Yes means a client without credentials can download from the repository: anonymous access is on, the anonymous user may read the repository through its roles (a privilege for it, a wider one, or a content selector), and, for Docker, Force Basic Authentication is off. See repositories.

Changed

• System Information: the report and the support ZIP no longer carry an edition. There is a single edition, and it is open source.

Fixed

• Web interface: on narrow screens the repository URL in the header of a repository profile wraps instead of pushing the page one pixel wider than the screen.

Upgrading

No steps of its own and no database changes. A script that reads astrum-status.edition from /service/rest/atlas/system-information gets nothing there now. See the upgrade notes.

Astrum Repository 3.0.2

Image: globalartltd/astrum-repository:3.0.2 (also latest). Documentation: https://astrum.globalart.dev.

New

• Formats: Chromium extensions (CRX3, with the update protocol that Chrome, Edge and other Chromium browsers read through the ExtensionSettings policy) and Firefox add-ons (XPI, with updates.json, latest.xpi and an update service for extensions.update.url), each as hosted, proxy (Chrome Web Store, addons.mozilla.org) and group repositories. 39 formats in all.
• Task notifications: a task with a Notification Email now sends email after its runs, on failure only or after every run as its Send Notification setting says. Sending never holds up or fails the task.
• Web interface: files can be previewed in Browse (text, Markdown, images up to 8 MiB); the API page shows the REST API in Swagger UI; small text is at least 13 px.
• MCP: roles and users can be managed from MCP.
• Documentation: published as a site at https://astrum.globalart.dev, with one page per format and new pages on repositories, cleanup policies, routing rules, outbound HTTP, SSL certificates, capabilities, tasks, nodes, the REST API and the web interface. The help links of the web interface lead there.

Fixed

• Several servers on one database: changes to users, roles, privileges, realms, LDAP, OpenID Connect and blob stores made on one server reach the others within about two seconds instead of at their next start. A user created or a password changed on one server can sign in through another at once, and web sessions are no longer ended by a server that had not seen the change yet.
• Truststore for LDAP and OpenID Connect: with their truststore option on, LDAP (LDAPS and StartTLS) and the OpenID Connect provider trust the certificates under Settings → Security → SSL Certificates as well as the system ones; adding or removing a certificate applies without a restart. View Certificate on the OpenID Connect page shows the provider's certificate.
• Cleanup policies: the form accepts the same 1 to 36500 days as the server, and its hints say so.
• Proxy repositories: the hints of Maximum Component Age and Maximum Metadata Age now say that -1 keeps cached content until the cache is invalidated.
• Web interface: placeholder tabs and settings for features this server does not have are gone: the Security tab of the component page, the Instance Settings tab of the repository profile and the Proprietary Components checkbox.

Upgrading

The server adds one table to its database when it starts; nothing else is needed. Settings that were saved before but had no effect now work: tasks with a notification address start sending email once an email server is set up, and LDAP servers and the OpenID Connect provider with the truststore option on start trusting the stored certificates. See the upgrade notes.

Astrum Repository 3.0.1

The first versioned release of the Astrum Repository server, written in Rust.

Image: globalartltd/astrum-repository:3.0.1 (also latest). Documentation: docs/.

Formats

37 formats. Hosted, proxy and group repositories for Alpine, Ansible Galaxy, APT, Bazel, Cargo, Chef Supermarket, CocoaPods, Composer, Conan, Conda, Docker and other OCI artifacts, Go, Helm, Hex, Hugging Face, JetBrains plugins, Maven, Nix, npm, NuGet, Open VSX, P2, pacman, pub, Puppet Forge, PyPI, R, RubyGems, Swift, Terraform, Vagrant, Yum and raw files; hosted repositories for Git LFS, Protobuf modules (a Buf Schema Registry) and the remote caches of Turborepo and Nx.

New since the switch to the Rust server

• Formats: Open VSX, pacman, Vagrant, the Nix binary cache, Hex, Puppet Forge, Chef Supermarket, a Bazel module registry, a JetBrains plugin repository, a Buf Schema Registry for Protobuf modules, and remote caches for Turborepo and Nx.
• Blob stores: a store can keep its blobs on another server through astrum-blob-agent, and a store that repositories use can be turned into a group to grow onto more space.
• Agents: an MCP endpoint at /mcp with OAuth 2.1 sign-in for agents, rate limits, and changes marked as made over MCP in the audit log.
• Domains: a repository can answer on a domain of its own, as a whole domain or a path on a shared one.
• Monitoring: Prometheus metrics, and alerts about free space, quotas and reachability of blob stores.
• Web interface: twelve languages kept in Ownlate; a first-run setup that creates the usual hosted repositories; an Access tab that edits the roles, users and anonymous access of a repository; a boot screen on first load; search in a dialog over the page; image sizes for Docker; an HTML index of every repository.
• Tools: tools/demo-data/seed.py fills a test or demo server with repositories and packages.

Upgrading

The server brings its database schema up to date when it starts; nothing else is needed. Deployments that follow the build tags (YYYYMMDDHHMMSS-commit) can move to 3.0.1.