Other formats

The four flagship formats (Maven, npm, PyPI, Docker / OCI) have their own pages. This page summarises the remaining 38 with endpoint shape, repository modes, and format-specific quirks.

Endpoint convention

Every format uses the same shape:

https://orbitalreg.example.com/<format>/<project-slug>/<repo-slug>/<format-specific-path>

The <format> segment is the canonical name listed below.

Language ecosystems

RubyGems

endpoint: /rubygems/<project>/<repo>/
publish:  gem push --host https://orbitalreg.example.com/rubygems/acme/internal
install:  gem source --add ...

Cargo

endpoint: /cargo/<project>/<repo>/
config:   .cargo/config.toml -> [registries.orbital] index = "..."

Go modules

endpoint: /gomod/<project>/<repo>/
env:      GOPROXY=https://orbitalreg.example.com/gomod/acme/all
          GOSUMDB=sum.golang.org  (or off / OrbitalReg-hosted sumdb)

NuGet

endpoint: /nuget/<project>/<repo>/
config:   nuget.config -> packageSources/add key="orbital" ...

Hex (Elixir)

endpoint: /hex/<project>/<repo>/
config:   mix hex.repo add orbital ... --auth-key ...

Swift

endpoint: /swift/<project>/<repo>/
config:   ~/.swiftpm/configuration/registries.json

Dart / pub

endpoint: /pub/<project>/<repo>/
env:      PUB_HOSTED_URL=https://orbitalreg.example.com/pub/acme/all

Composer (PHP)

endpoint: /composer/<project>/<repo>/
config:   composer.json -> repositories[]: { "type": "composer", "url": "..." }

CRAN (R)

endpoint: /cran/<project>/<repo>/
config:   options(repos = c(orbital = "..."))

Deno

endpoint: /deno/<project>/<repo>/   (deno.land/x-compatible mirror)
import:   import { x } from "https://...example.com/deno/acme/all/x/<mod>@<ver>/mod.ts"
publish:  PUT one file at a time to the same path

Hugging Face

endpoint: /huggingface/<project>/<repo>/
config:   HUGGINGFACE_HUB_ENDPOINT=...

OS package ecosystems

Debian / .deb

endpoint: /debian/<project>/<repo>/
config:   /etc/apt/sources.list.d/orbital.list →
          deb [signed-by=...] https://...example.com/debian/acme/all stable main

RPM

endpoint: /rpm/<project>/<repo>/
config:   /etc/yum.repos.d/orbital.repo with baseurl=...

Alpine APK

endpoint: /alpine/<project>/<repo>/
config:   /etc/apk/repositories  +  /etc/apk/keys/orbital.rsa.pub

Conda

endpoint: /conda/<project>/<repo>/
config:   ~/.condarc → channels: [...]

OPKG (OpenWrt)

endpoint: /opkg/<project>/<repo>/
config:   /etc/opkg/customfeeds.conf -> src/gz orbital ...

Nix binary cache

endpoint: /nix/<project>/<repo>/
config:   nix.conf -> substituters = https://...example.com/nix/acme/all
write:    nix copy --to https://...example.com/nix/acme/all /nix/store/<hash>-<pkg>

Homebrew

endpoint: /homebrew/<project>/<repo>/   (tap mirror)
install:  brew install --formula https://...example.com/homebrew/acme/all/Formula/<name>.rb
offline:  extract /tap.tar.gz into $(brew --repository)/Library/Taps/orbitalreg/<repo>/

Container + image ecosystems

Helm

endpoint: /helm/<project>/<repo>/   (also OCI via /<project>/<repo>/)
config:   helm repo add orbital https://...example.com/helm/acme/all

Ollama

endpoint: /ollama/<project>/<repo>/   (OCI-distribution-shaped model registry)
config:   OLLAMA_HOST=https://...example.com/ollama/acme/all
pull:     ollama pull <model>:<tag>

Vagrant

endpoint: /vagrant/<project>/<repo>/
config:   Vagrantfile -> config.vm.box_url = "..."

IaC / build tools

Terraform registry

endpoint: /terraform/<project>/<repo>/  (registry v1 protocol)
config:   ~/.terraformrc -> credentials "..." { token = "..." }

Argo Workflows

endpoint: /argoworkflow/<project>/<repo>/
index:    /index.yaml (Helm-style) lists WorkflowTemplate/ClusterWorkflowTemplate .tar.gz bundles
consumers: ArgoCD, `argo template lint`

Kustomize

endpoint: /kustomize/<project>/<repo>/  (OCI-distribution, KEP-2299, kustomize >=5.0)
build:    kustomize build oci://...example.com/kustomize/acme/all/<component>:<tag>

OPA bundles

endpoint: /opa/<project>/<repo>/
publish:  PUT /api/bundles  (raw .tar.gz of .rego + data.json + .manifest)
pull:     GET /<name>/<version>/bundle.tar.gz  (revision served as ETag)

Bazel

endpoint: /bazel/<project>/<repo>/  (BCR-shaped)

Conan

endpoint: /conan/<project>/<repo>/
config:   conan remote add orbital ...

Cocoapods

endpoint: /cocoapods/<project>/<repo>/

Puppet Forge

endpoint: /puppet/<project>/<repo>/

Chef Supermarket

endpoint: /supermarket/<project>/<repo>/

Bower

endpoint: /bower/<project>/<repo>/

JetBrains Marketplace

endpoint: /jetbrains/<project>/<repo>/

VSIX (VS Code)

endpoint: /vsix/<project>/<repo>/

P2 (Eclipse)

endpoint: /p2/<project>/<repo>/

NVIDIA NIM / Skills

endpoint: /nim/<project>/<repo>/   (NGC-catalog-compatible model/skill registry)
config:   ngc config set -> api_url = https://...example.com/nim/acme/all
note:     NIM container images flow through the Docker endpoint at /v2/...

VCS proxies

Git LFS

endpoint: /lfs/<project>/<repo>/
config:   .lfsconfig -> [lfs] url = "..."

Generic VCS (read-through)

endpoint: /vcs/<project>/<repo>/
purpose:  proxy `go get`, `pip install -e git+...`, etc.

Generic blob

endpoint: /api/v1/artifacts/<project>/<repo>/...
purpose:  content-addressable raw artifact store (SHA-256), for anything
          without a native package format

Detection coverage

Most formats above run through Trivy / Grype / OSV.dev / Syft. The few that don't (Vagrant, Bazel, Cocoapods, Bower, JetBrains, VSIX, P2, NVIDIA NIM, Ollama, Argo Workflows, Kustomize, OPA, Deno, Homebrew, Nix, Puppet, Supermarket) lack reliable upstream advisory data; they still get SBOM generation via Syft when format-conventionally a package contains a manifest.

Adding a new format

The format-adapter contract is a Go interface in api/internal/formats/<format>/. Each adapter implements:

• Upload(ctx, *http.Request) (*Artifact, error)
• Download(ctx, path, version) (io.Reader, error)
• Index(ctx, repo) (Indexable, error)
• Metadata(ctx, artifact) (Metadata, error)

The integration-test harness in tests/integration/ boots the API against a real Postgres + MinIO and exercises every adapter against its native client tool (where one exists). Adding a format means landing the adapter, the integration fixture, and a row in PACKAGE-FORMATS-ROADMAP.md.