Skip to content
Craftifact

Package format notes

Stable behavior notes for the currently supported package ecosystems and repository types.

Support at a glance

Craftifact currently supports these repository families:

  • Maven
  • Python
  • npm
  • OCI
  • Go beta

For each of them, the config model supports hosted, proxy, and group repositories.

General rules:

  • hosted repositories are the normal writable target
  • proxy repositories are effectively read-only
  • group repositories are effectively read-only and depend on member repositories

Maven

version_policy is the main Maven-specific behavior knob.

Supported values are:

  • Release
  • Snapshot
  • Mixed

Current behavior:

  • default normalization is Mixed
  • changing an existing Maven repository to a stricter target policy is blocked if current artifacts would violate that target
  • metadata files and checksum/signature sidecars are not treated as policy violations

OCI

OCI has two grace-related behaviors worth knowing.

Untag grace

If you remove the last tag that references a manifest, the manifest closure is not deleted immediately. It enters an untag grace window of 5 minutes first.

Namespace delete grace

Namespace deletion in the UI uses a 1 hour grace period. That gives you a restore window before final cleanup.

Garbage collection

OCI garbage collection runs on a schedule. By default, the config layer uses a 10 minute interval for OCI GC scheduling. Unreferenced uploaded OCI content older than the grace period is eligible for deletion.

Go

Go repositories follow the same hosted, proxy, and group model as the other families. The hosted variant is still in development.

Python and npm

Python and npm currently behave like the other repository families at the repository-type level:

  • hosted, proxy, and group repositories are supported
  • no special policy knob like Maven version_policy exists today

Current Nexus import coverage includes:

  • Maven
  • Python
  • OCI
  • npm

Proxy repository definitions can be imported, but proxy cache contents are not imported.