What Holger is
Holger is an immutable artifact repository and security gateway, written in pure Rust. It stands between your builds and the public registries: crates.io, npm, Maven Central, PyPI and container registries. Every artifact it takes in passes the intake chain before it is kept, and only artifacts that pass are served.
The intake chain
- Provenance: signatures and attestations are verified offline, among them Sigstore cosign keyless signatures and DSSE attestations (Chainguard is the primary source of verified images and packages).
- Scans: every unpack, scan and inspection of an artifact runs in an isolated container, with a CVE lookup and a YARA matcher.
- Rules: per source, the operator decides what passes; an artifact that is not verified is never treated as a pass.
Storage
Artifacts are kept content-addressed (Blake3) in znippy archives (Apache Arrow IPC), which hold the data and its metadata together, with atomic, versioned transactions.
Airgap
Holger runs fully disconnected. Artifacts are transferred from the internet, Nexus or Artifactory into an immutable archive, which an airgapped Holger then serves. The default install makes no outbound call.
Clients
Cargo reads Holger as a sparse registry, and npm, Maven, pip and container clients read it through their own protocols. Pull-through answers "not yet" for an artifact that is still in the intake chain, and lists only the artifacts that passed.
Running it
Holger is free software under AGPL-3.0-only. cargo build --release builds the server, holger starts it on loopback with a health check at /healthz. The source is at ssh://git@git.gunnar.rs:2222/nordisk/holger.git.