mirror-eu-3configure

Distribution repository · since 2014

Artefacts your build can actually trust.

OpenDepot keeps long-lived copies of open source distributions — source tarballs, binary archives, package indexes and documentation bundles — with checksums that never change and a history that goes back further than most upstreams do.

curl -fsSL https://opendepot.duckdns.org/keys/archive.asc \
  | gpg --dearmor -o /usr/share/keyrings/opendepot.gpg

echo "deb [signed-by=/usr/share/keyrings/opendepot.gpg] \
https://opendepot.duckdns.org/apt stable main" \
  > /etc/apt/sources.list.d/opendepot.list
GPG ed25519 sha256 + sha512 9 upstreams rsync hourly
14 TBmirrored
8 412package versions
1.2 PBserved in 2026
zerochecksum changes

What is mirrored

The depot is not a package manager of its own. It is a stable HTTP and rsync surface in front of upstream distributions, arranged so that a build script written in 2019 still resolves the exact bytes it was written against.

CollectionFormatUpstreamRefresh
apt/Debian binary + sourcearchive.debian.org6 h
rpm/RPM packages, repodatadl.fedoraproject.org6 h
apk/Alpine APKINDEXdl-cdn.alpinelinux.org6 h
src/upstream tarballsdirect from maintainersdaily
doc/HTML + PDF manualsproject sitesweekly

Index format

Every collection publishes a signed index in a single-file, line-oriented format so that a client can verify a whole tree with one signature check.

# /apt/dists/stable/Release
Origin: OpenDepot
Label: opendepot
Suite: stable
Codename: stable
Architectures: amd64 arm64
Date: Thu, 12 Nov 2026 04:11:02 UTC
Valid-Until: Thu, 19 Nov 2026 04:11:02 UTC
SHA256:
 4f9c1a0b…  1842 main/binary-amd64/Packages
 e0b73d92…  1204 main/binary-arm64/Packages

Indices are regenerated only when a package changes. Valid-Until is seven days, which is deliberately shorter than the mirror's worst-case refresh so that a stale mirror fails loudly instead of silently serving an old set.

Mirrors

Three HTTP endpoints and one rsync module serve the same content. Choose by distance; the index and signatures are byte-identical across all of them.

EndpointLocationProtocolsBandwidth
mirror-eu-1Frankfurthttps, rsync10 Gbit
mirror-eu-2Amsterdamhttps, rsync10 Gbit
mirror-eu-3Helsinkihttps5 Gbit

Retention

Released versions are kept indefinitely. Nightly and snapshot builds are kept for 90 days, and anything superseded by a security update is kept for a further two years so that pinned builds remain resolvable. Content is append-only: a path that has been served once is never rewritten.

If an upstream withdraws a tarball for legal reasons, the path is tombstoned rather than deleted: requests return 410 Gone with a note pointing at the replacement. Checksum history remains visible.