holger-ds, explained simply
What is this?
You know how Python people type pip install pandas and packages appear? Those packages come from a big shop on the internet called PyPI. holger-ds makes Holger that shop — but your own private one, that works with no internet (airgap), and that you can trust because every file is checksum-verified.
The story, in four steps
-
Fill the shelves. Holger's agent goes to PyPI (once, from the internet side), reads your shopping list (
requirements.txtoruv.lock), grabs the exact wheels you asked for, and packs them into one sealed box (a.znippyarchive). -
Open the shop. Holger serves that box as a normal Python index. When a tool asks "what versions of pandas do you have?", Holger answers with a web page (PEP 503) or a JSON list (PEP 691), and each entry says "…and here's its SHA-256 fingerprint."
-
Customers shop.
uvorpipreads the list, downloads a wheel, and checks the fingerprint. If the file doesn't match, the install stops — that's the safety net, and holger-ds gets it right. -
A robot shops too. An Airflow "DAG" is just a to-do list of tasks in order (get data → clean it → save it). Before each task runs, its little worker installs the Python packages it needs — from Holger. holger-ds proves that whole chain works.
Why the fingerprint matters
Holger stores files with a fingerprint called blake3 (fast, modern). But pip and uv only trust the SHA-256 fingerprint. So Holger computes SHA-256 too, and puts it next to each download link. That's "content-addressing": the name of a thing is its fingerprint, so you can never be handed the wrong bytes without noticing.
How do we know it's fast?
There's a stopwatch test called holger.pip_index_serve. It fills a shop with practice wheels, opens it, and hammers it with lots of downloads at once, then reports how many megabytes and how many downloads per second Holger served — the same kind of scoreboard we keep against Nexus and Artifactory. It also writes down how many CPU cores and how much memory the machine had, so the numbers mean something.
The one honest caveat
Real uv/pip ask for the JSON list using a hidden "Accept" note in the request. Holger's plug-in door can't read that note yet, so for now the JSON list lives at a plain address (/simple/<name>/json) and the normal web-page list (which now carries the fingerprints) is what a real install uses. Wiring up the hidden note is the next small job.