v1.7.1

Fixes from a code review: Maven metadata after deletes, faster large deletes, and safer package uploads.

Fixed

• Deleting Maven versions (cleanup policies, bulk delete, deleting a component or version, promotion with "move")
  left maven-metadata.xml listing them, so builds resolving LATEST, RELEASE or version ranges got 404s. The
  metadata is now rewritten, and removed with the last version.
• Large deletes and cleanups no longer make proxy requests and the repository list wait until they finish, and they
  commit in one transaction instead of one disk write per artifact. Content files are removed only after the delete
  is committed.
• A crafted Alpine package could make the server decompress it entirely into memory; packages are now read as a
  stream.
• Debian and RPM packages whose name, version or architecture contain / or other characters outside their format's
  rules are refused instead of being stored under stray paths that the generated indexes then pointed to.
• Importing a configuration with a group whose members are other groups failed unless the file happened to list
  them in the right order.
• After a proxy's remote URL changes, or a repository is deleted and recreated under the same name, cached
  "not found" answers and the upstream health of the old remote are forgotten.
• Cargo and npm publishes with a version or name that is not a clean path are refused; Docker cross-repository
  mounts check the digest format.
• Audit CSV exports also neutralise cells that start with a tab or carriage return (spreadsheet formula injection).

Security

• Built with Go 1.26.10, which no longer trusts compromised intermediate certificates (GO-2026-6809). This
  affects HTTPS connections to upstreams, SSO providers, webhooks and notification servers.

Install

Linux and macOS, one line (verifies the checksum, installs the service; run it again to upgrade):

curl -fsSL https://github.com/anand34577/repoman/releases/download/v1.7.1/get.sh | sudo sh

Or download an archive:

Platform	Download
Linux x86-64	repoman_1.7.1_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.7.1_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.7.1_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.7.1_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.7.1_macos_arm64.tar.gz
macOS Intel	repoman_1.7.1_macos_amd64.tar.gz
Windows x86-64	repoman_1.7.1_windows_amd64.zip
Windows ARM 64-bit	repoman_1.7.1_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.7.1 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: v1.7.0...v1.7.1

v1.7.0

Five more formats, and a dashboard that is easier to read and no longer counts groups twice.

Upgrade notes

• The first start adds an index on the daily download counters, for the dashboard's 30-day chart. On a large database
  this takes a moment.
• The new formats need no configuration; create repositories for them in the wizard.

Added

• Formats: Rust / Cargo (sparse registry), Dart / Flutter (pub), Hugging Face, Git LFS and Alpine (apk).

Changed

• The dashboard is grouped into overview, health and activity, storage and artifacts. New: the repository mix by type,
  status counts, downloads over the last 30 days, and how much storage is your own artifacts versus proxy caches.
  Formats that are set up but still empty no longer fill the storage list with empty bars.

Fixed

• The dashboard counted a group's artifacts and bytes on top of its members', so a group of a 100 MB proxy and a
  50 MB hosted repository added 150 MB again. Groups are now left out of the totals and the per-format sizes.

Install

Linux and macOS, one line (verifies the checksum, installs the service; run it again to upgrade):

curl -fsSL https://github.com/anand34577/repoman/releases/download/v1.7.0/get.sh | sudo sh

Or download an archive:

Platform	Download
Linux x86-64	repoman_1.7.0_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.7.0_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.7.0_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.7.0_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.7.0_macos_arm64.tar.gz
macOS Intel	repoman_1.7.0_macos_amd64.tar.gz
Windows x86-64	repoman_1.7.0_windows_amd64.zip
Windows ARM 64-bit	repoman_1.7.0_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.7.0 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: v1.6.0...v1.7.0

v1.6.0

Groups show what their members hold, packages get a page of their own, and Linux and macOS get a one-line installer
with safe upgrades, rollback and migration.

Upgrade notes

• The first start adds a few small tables and indexes dependency metadata in the background (the "Index package
  dependencies" task); the Dependents lists fill in as it finishes. Nothing needs to be done by hand.
• On Linux and macOS the installer now backs up the database before an upgrade and refuses to downgrade; see
  Rolling back in docs/installation.md.

Fixed

• A group repository showed nothing. Browsing a group, its Components tab, its artifact count and size, and
  searching with the group selected all looked only for artifacts stored in the group itself, and a group stores
  none. They now show what its member repositories hold.
• Signing in no longer drops the query string of the page you were opening, so a link to a package page or a
  filtered search survives the sign-in screen.
• The Delete buttons no longer appear on a group's components, where they could not delete anything.

Added

• One-line install for Linux and macOS: curl -fsSL https://raw.githubusercontent.com/anand34577/repoman/main/scripts/get.sh | sudo sh
  picks the right build for the machine, verifies its checksum and installs the service; running it again
  upgrades. check, rollback, uninstall [--purge], migrate-from, --version and --no-service are
  built in, and RM_BASE_URL points it at a mirror for air-gapped sites.
• Safer upgrades (Linux and macOS installers): the database is backed up before a version change, the
  previous program is kept, downgrades are refused, and --rollback restores both.
• Migration: --migrate-from <directory | host:/path> adopts a data directory from a hand-run copy, a
  Docker volume, a backup or another server (over ssh), keeping whatever was there aside.
• Usage instructions for every package, like Maven Central's: Maven, Gradle, sbt and Ivy snippets (with
  <classifier> and <type> taken from the file you are looking at), npm/Yarn/pnpm, pip/Poetry/uv, Docker,
  Go, conda, apt and dnf. They can use the newest version instead of the one shown, and fill in your API token.
• Package page per component: description, licence and links read from the pom / packument / go.mod, usage
  tabs, every file with MD5, SHA-1, SHA-256, SHA-512 and signature state plus a copyable verify command, all
  versions, dependencies, the packages that depend on it, and a 30-day downloads chart.
  Artifact details also show checksums and downloads per day.
• Groups: Browse names the member that serves each file and lists a path held by several members once;
  Setup shows the order members are searched in.
• Search understands version:, repo:, format:, uploader: and sha256:, can be limited to a group,
  and keeps saved searches per user. The command palette (Ctrl/Cmd+K) now also finds packages.
• Promote versions from one hosted repository to another (staging → releases) as a copy or a move; Maven
  version metadata is regenerated in the target.
• Bulk actions: tick files, folders or packages in Browse and Components to delete or promote them together.
• Storage page: size per repository, growth over time from a daily sample, space saved by sharing identical
  files, and a scan for unused content files. New scheduled tasks record usage daily and index package dependencies.
• End-to-end browser tests (npm --prefix frontend run e2e), run in CI.

Install

Linux and macOS, one line (verifies the checksum, installs the service; run it again to upgrade):

curl -fsSL https://github.com/anand34577/repoman/releases/download/v1.6.0/get.sh | sudo sh

Or download an archive:

Platform	Download
Linux x86-64	repoman_1.6.0_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.6.0_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.6.0_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.6.0_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.6.0_macos_arm64.tar.gz
macOS Intel	repoman_1.6.0_macos_amd64.tar.gz
Windows x86-64	repoman_1.6.0_windows_amd64.zip
Windows ARM 64-bit	repoman_1.6.0_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.6.0 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: v1.5.1...v1.6.0

v1.5.1

An audit of the server and the web UI: faster on large installations, several fixes, and a smoother interface.
This is the first published release of the 1.5 series: 1.5.0 was tagged but never published, because its
totals cache could answer with a count that was a few microseconds out of date right after an upload.

Performance

• The dashboard, the repository list, the Components tab and folder sizes in Browse are read from covering
  indexes and short-lived caches instead of visiting every artifact. Measured on a test database of 600,000
  artifacts: dashboard 1.8 s → 0.6 s on first load and instant afterwards, Components 1.3 s → 0.05 s,
  browsing a folder with 86,000 artifacts below it 1 s → 0.17 s.
• Search uses a substring index. Searching for part of a name took 0.6–1.3 s on that database and now takes
  0.01–0.25 s; it finds the same artifacts as before (any part of a path or component, in any case). Every
  sort order of the search page (updated, name, size, downloads) is served by an index too.
• Downloads no longer wait for a database write each: download counters are kept in memory and written every
  two seconds (and on shutdown), so many clients pulling at once are not queued behind one another.
• A token's "last used" time is written at most once a minute instead of being checked with a write statement on
  every request.
• Uploading several .deb or .rpm files in the browser rebuilds the signed index once, not once per file.
• The web UI shows a page you have opened before immediately and refreshes it in the background, and shares one
  request between parts of the page that need the same data.
• Search and the audit log skip the separate counting query when the last page is reached.

Fixed

• A malformed npm package document (a version that is not an object) could crash the whole server when the hosted
  indexes were rebuilt. Such publishes are now rejected, existing documents are read defensively, and a failing
  maintenance task can no longer take the server down.
• Docker: finishing a blob upload without a valid digest stored the layer under an empty name; it is now refused.
• /metrics listed the name, size and download count of repositories the caller is not allowed to read.
• Run now for a task that does not exist answered "started"; it now answers 404.
• Importing a configuration with an invalid access level, an invalid base URL or null entries is reported per
  entry instead of being stored or aborting the import.
• A project name is escaped on PyPI index pages, and RPM headers with a negative entry count are rejected.
• UI assets requested with a byte range were compressed after the range was cut; fonts and images are no longer
  compressed a second time.
• Invalidate cache on a proxy reset the "updated" date of every cached file to 1970, which broke
  Last-Modified, sorting by date, and could let the cleanup policy delete files that were never downloaded
  through the UI. It now only marks index data as stale.
• Unexpected server errors no longer send the database's error text to the client; the response carries a
  reference to look up in the server log.
• Updating or deleting a webhook that does not exist answers 404 instead of success.

Changed

• Importing a configuration asks first. Choosing a file shows what it contains; nothing is applied until you
  confirm. Files that are not a RepoMan export are refused with an explanation.
• Forms validate inline, in the same style everywhere, instead of with the browser's own pop-up messages.
• Phones: repositories are listed as cards, tab bars scroll instead of wrapping, page actions use the full width,
  and long repository names and URLs wrap instead of running off the screen.
• If a page fails to render, or the server was upgraded while the UI was open, a message with a Reload button
  replaces the blank page. When a session ends you are told why you are back at the sign-in form.
• The dashboard puts Needs attention first, and cards no longer stretch to the height of their neighbours.
• Exact dates are available on hover or keyboard focus for every relative time ("3 hours ago").
• Webhooks can subscribe to task.run, webhook.* and notifier.* events from the picker.

Added

• Audit log period. Filter by Today, the last 7, 30 or 90 days, or a custom range picked from a calendar;
  the CSV export follows it. REST API: from and to (Unix seconds) on GET /audit and GET /audit/export.
• Unsaved changes are protected. Leaving repository configuration or access, server settings, single
  sign-on settings or the repository wizard with edits you have not saved asks first. (Closing or reloading
  the browser tab is not intercepted.)

Security

• react-router is updated from 6 to 7.18, which fixes an open redirect in links and navigation
  (GHSA-wrjc-x8rr-h8h6). npm audit reports no known vulnerabilities.

Upgrade notes

• New database indexes, including the search index, are built on the first start: about 40 seconds per
  million artifacts, during which the server does not answer yet. The database grows by about half
  (349 MB → 523 MB with 600,000 artifacts); the artifacts themselves are not touched.
• The web UI has one new bundled dependency, Mantine's date picker (with dayjs). Nothing is loaded from the
  network.
• Download counts and "last downloaded" times reach the database (and so the UI, the API and /metrics) up to
  two seconds after the download.

Install

Platform	Download
Linux x86-64	repoman_1.5.1_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.5.1_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.5.1_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.5.1_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.5.1_macos_arm64.tar.gz
macOS Intel	repoman_1.5.1_macos_amd64.tar.gz
Windows x86-64	repoman_1.5.1_windows_amd64.zip
Windows ARM 64-bit	repoman_1.5.1_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.5.1 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: v1.5.0...v1.5.1

v1.4.0

Makes the web UI usable with hundreds of thousands of artifacts.

Added

• Pagination everywhere a list can grow large: search, the audit log, folder browsing and components are paged
  on the server; repositories, users and per-repository access are paged in the browser. Page and page size
  are kept in the URL, so a page can be shared or reloaded. Search and components can be sorted; repositories
  too.
• Folder filtering in Browse now searches the whole folder, not just the loaded entries. Links to an artifact
  (for example from search) open it even when it is on a later page.
• The audit log export contains every matching event (streamed by the server), not only the rows on screen.
• Browser uploads show progress and can be cancelled.
• The Access tab can filter users and show only those with an override; unsaved changes are kept across pages.
• REST API: offset/limit and the X-Total-Count header on browse, components, search and audit;
  GET /repositories/{name}/asset, GET /audit/export. Responses are still plain arrays.

Fixed

• Browsing a folder no longer loads every artifact below it into memory, and folders with non-ASCII names list
  correctly.
• On short screens, the admin sidebar no longer runs off the bottom of the window, and scrolling it no
  longer scrolls the page too.
• Lists ignore responses that arrive out of order, so fast typing in a filter can't show stale results.

Performance

• New database indexes for search ordering, per-repository totals and the dashboard. They are created on the
  first start after upgrading, which can take a minute on very large databases.

Install

Platform	Download
Linux x86-64	repoman_1.4.0_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.4.0_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.4.0_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.4.0_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.4.0_macos_arm64.tar.gz
macOS Intel	repoman_1.4.0_macos_amd64.tar.gz
Windows x86-64	repoman_1.4.0_windows_amd64.zip
Windows ARM 64-bit	repoman_1.4.0_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.4.0 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: v1.3.0...v1.4.0

v1.3.0

Adds Conda repositories and is the first release published from this repository.

Added

• Conda repositories (conda, mamba, micromamba, pixi). Hosted channels accept .conda and .tar.bz2
  uploads (curl, HTTP PUT/POST, or drag and drop) and generate repodata.json for each subdir.
  Proxy channels cache conda-forge, bioconda or Anaconda; cached content stays available while the upstream is
  down. Conda repositories can't be grouped; list several channels in .condarc. New audit, webhook and
  notification event: conda.upload. See Conda.
• Screenshots of the web UI in the README.

Security

• Built with Go 1.26.9, which fixes vulnerabilities in the HTTP server and client, header parsing and TLS of
  the Go standard library (GO-2026-6603, -6605, -6607 to -6613 and -6617). Upgrading is recommended.

Upgrade notes

• New installations get conda-hosted and conda-forge (proxy) starter repositories. Existing servers are
  not changed; create conda repositories from Repositories → New.
• Notification channels that use the Problems + releases preset now also receive conda.upload. Channels
  saved before the upgrade keep their old event list and show as Custom; pick the preset again to include
  conda uploads.

Install

Platform	Download
Linux x86-64	repoman_1.3.0_linux_amd64.tar.gz
Linux ARM 64-bit (Raspberry Pi 4/5, Graviton)	repoman_1.3.0_linux_arm64.tar.gz
Linux ARM 32-bit (Raspberry Pi 2/3, armv7)	repoman_1.3.0_linux_armv7.tar.gz
Linux ARM 32-bit (Raspberry Pi 1/Zero, armv6)	repoman_1.3.0_linux_armv6.tar.gz
macOS Apple silicon	repoman_1.3.0_macos_arm64.tar.gz
macOS Intel	repoman_1.3.0_macos_amd64.tar.gz
Windows x86-64	repoman_1.3.0_windows_amd64.zip
Windows ARM 64-bit	repoman_1.3.0_windows_arm64.zip

Each archive holds the single repoman binary, a service installer for that platform and the documentation.
Container image: docker pull ghcr.io/anand34577/repoman:1.3.0 (amd64, arm64, arm/v7).

Verify a download: sha256sum -c SHA256SUMS --ignore-missing, and its origin:
gh attestation verify <file> --repo anand34577/repoman.

First run, upgrade and service setup: see docs/installation.md.

Full Changelog: https://github.com/anand34577/repoman/commits/v1.3.0