Shelf · astro

Pulling artifacts

Three ways in, depending on whether you are feeding a package manager, a shell script or a browser. All of them want a pinned version.

1. As a registry for your package manager

This is what most people want. Point the scope at the shelf and your lockfile keeps working unchanged — we answer the same metadata shape the upstream registry does, with tarball URLs rewritten to our paths.

# .npmrc
astro:registry=https://astro.assetflux.org/reg/
//astro.assetflux.org/reg/:_authToken=

The empty token is not a mistake: the shelf is read-only and open, and some clients sulk if the key is missing entirely. There is no account to create and nothing to log into.

2. Straight at the tarball

curl -fL -O https://astro.assetflux.org/r/5.14.2/astro-5.14.2.tgz
curl -fsSL https://astro.assetflux.org/r/5.14.2/SHA512SUMS | shasum -a 512 -c -

The digest file lists one line per artifact under that version, in the usual shasum format, so the check above works with no extra parsing. Do run it. A mirror you have not verified is just somebody else’s hard drive.

3. In a page, with SRI

Two entry points are extracted from each tarball for direct browser loading. They are copied out of the archive as-is — we do not bundle, transpile or minify them.

<script type="module"
  src="https://astro.assetflux.org/r/5.14.2/b/config.browser.mjs"
  integrity="sha384-fzMZWLUnxeK3o/fmagtuvRHbHbf6DTW0oAmVpGB5qDTuMOwWMvtVCkUA45A94Kgo"
  crossorigin="anonymous"></script>

Each version has its own hash — copying one across a version bump will simply stop the file from loading, which is the correct behaviour. The full set is on the integrity ledger.

Cache behaviour

Versioned paths

Cache-Control: public, max-age=31536000, immutable. They can never change, so cache them forever.

Registry metadata

public, max-age=600, stale-while-revalidate=3600. Ten minutes is roughly our sync interval.

Digest files

Same immutable policy as the artifacts they describe.

Range requests

Supported on artifacts. Resumable downloads work; partial reads of a tarball work if you like living dangerously.

CORS

Access-Control-Allow-Origin: * on everything under /r/. Required for SRI to be meaningful.

Compression

Text responses are compressed. Tarballs are not — they are already gzip, and recompressing them would only cost you CPU.

If something 404s

Nine times in ten it is a version that was never published, or a typo in the file name. Check the spelling against the release list. If the version definitely exists upstream and we do not have it, the fetcher missed it and it will usually appear at the next sync; our service policy says how to tell us if it does not.