Package formats
OrbitalReg supports 40+ package formats across every major language and platform ecosystem. Each format has:
- A native HTTP API matching the upstream tool's expectations (
mvn deploy,npm publish,pip install,docker push, …) - Local + remote + virtual repository modes
- Format-specific scanners hooked into the Detection pipeline
- A retention-policy grammar that understands the format's versioning conventions
The format catalogue covers four ecosystem groups. The Support column follows frontend/src/lib/formats.ts (the source of truth the UI itself reads): GA is full-featured; Experimental ships with a documented, narrower feature set than its peers — see the linked note in Other formats for the specific gap. See docs/PRODUCT-ROADMAP.md item 148 for how this classification was derived. For a single flat table of all 42 adapters + Docker/OCI grouped by implementation-maturity tier instead of ecosystem, see the Support matrix (item 123).
Language ecosystems
| Format | Repository types | Detection adapters | Support | Format reference |
|---|---|---|---|---|
| Maven | local, remote, virtual | Trivy, Grype, OSV, Syft | GA | Maven |
| npm | local, remote, virtual | Trivy, Grype, OSV, Syft | GA | npm |
| PyPI | local, remote, virtual | Trivy, Grype, OSV, Syft | GA | PyPI |
| RubyGems | local, remote | Trivy, Grype, OSV | GA | — |
| Cargo | local, remote | Trivy, OSV | GA | — |
| Go modules | local, remote | OSV, govulncheck | GA | — |
| NuGet | local, remote | Trivy, Grype, OSV | GA (V3 search stub) | — |
| Hex (Elixir) | local, remote | OSV | GA | — |
| Swift | local, remote | OSV | GA | — |
| Dart / pub | local, remote | OSV | GA | — |
| Composer (PHP) | local, remote | OSV | GA | — |
| CRAN (R) | local, remote | — | Experimental | Other formats |
| Deno | local, remote | OSV | GA | — |
| Nimble (Nim) | local | — | Experimental | Other formats |
Container + image + model ecosystems
| Format | Repository types | Detection adapters | Support | Format reference |
|---|---|---|---|---|
| Docker / OCI | local, remote | Trivy, Grype, Syft | GA | Docker / OCI |
| Helm | local, remote | Trivy | GA | — |
| Conda | local, remote | OSV | GA | — |
| Hugging Face | local, remote | Trivy | GA | — |
| Ollama | local, remote | — | GA | — |
| NVIDIA NIM / Skills | local, remote | — | GA | — |
OS / system packages
| Format | Repository types | Detection adapters | Support | Format reference |
|---|---|---|---|---|
| Debian | local, remote | Trivy, Grype | GA | — |
| RPM | local, remote | Trivy, Grype | GA | — |
| Alpine APK | local, remote | Trivy, Grype | GA | — |
| Homebrew | local, remote | — | GA | Other formats |
| Nix | local, remote | — | GA | — |
| OPKG (OpenWrt) | local | Trivy | GA | — |
IaC / build / tools
| Format | Repository types | Detection adapters | Support | Format reference |
|---|---|---|---|---|
| Terraform registry | local, remote | Trivy IaC | GA | — |
| Argo Workflows | local, remote | — | GA | — |
| Kustomize | local, remote | — | GA | — |
| OPA bundles | local, remote | — | GA | — |
| Vagrant | local | — | GA | — |
| Bazel | local | OSV | GA | — |
| Conan | local | OSV | GA | — |
| Cocoapods | local | OSV | GA | — |
| Puppet Forge | local | — | Experimental | Other formats |
| Chef Supermarket | local | — | GA | — |
| Bower | local | — | GA | — |
| JetBrains Marketplace | local | — | GA | — |
| VSIX (VS Code) | local | — | Experimental | Other formats |
| P2 (Eclipse) | local, remote, virtual (composite) | — | GA | Other formats |
VCS proxies
| Format | Support | Notes |
|---|---|---|
| Git LFS | GA | Pass-through, content-addressable |
| Generic VCS | Experimental | Read-through HEAD-probe proxy for go get & co.; no full clone/fetch proxying |
| Generic blob | GA | Content-addressable raw artifact store (/api/v1/artifacts/...) |
Promotion across formats
Promotion is format-aware. A Maven artifact promoted from staging to prod-maven carries its POM, sources jar, and signature blocks together; a Docker image promotion preserves the manifest list. Each format's promotion behaviour is detailed in its format-specific page.
Adding a new format
The format-adapter contract is documented in PACKAGE-FORMATS-ROADMAP.md. A new adapter is roughly 200–800 lines of Go plus an integration-test suite. The integration harness in tests/integration/ covers all shipped formats and runs in CI on every PR that touches the format layer.